- play_arrow Overview
- play_arrow Introduction to Class of Service
-
- play_arrow Configuring Class of Service Scheduler Hierarchy
- play_arrow Controlling Traffic by Configuring Scheduler Hierarchy
-
- play_arrow Configuring Class of Service for IPv6
- play_arrow Configuring Class of Service for IPv6 Traffic
-
- play_arrow Configuring Class of Service for I/O Cards
- play_arrow Configuring Class of Service for I/O Cards
- PIR-Only and CIR Mode Overview
- Understanding Priority Propagation
- Understanding IOC Hardware Properties
- Understanding IOC Map Queues
- WRED on the IOC Overview
- MDRR on the IOC Overview
- CoS Support on the SRX5000 Module Port Concentrator Overview
- Example: Configuring CoS on SRX5000 Firewalls with an MPC
-
- play_arrow Configuration Statements and Operational Commands
Two-Color Policer Configuration Overview
Starting in Junos OS Release 15.1X49-D40 and Junos OS Release 17.3R1, you can configure and apply single-rate two-color policers to Layer 3 traffic.
For vSRX Virtual Firewall, SRX1500, SRX1600, SRX2300, SRX4100, SRX4200, and SRX4600 firewalls, we recommend limiting the traffic rate in a given policer to 80 Mbps or less.
Table 1 describes the hierarchy levels at which you can configure and apply them.
Policer Configuration | Layer 3 Application | Key Points |
|---|---|---|
| Single-Rate
Two-Color Policer Defines traffic rate limiting that you can apply to Layer 3 protocol-specific traffic at a logical interface. Can be applied as an interface policer or as a firewall filter policer. | ||
Basic policer configuration: [edit firewall]
policer policer-name {
if-exceeding {
bandwidth-limit bps;
burst-size-limit bytes;
}
then {
discard;
forwarding-class class-name;
loss-priority supported-value;
}
}
| Method A—Apply as an interface policer at the protocol family level: [edit interfaces]
interface-name {
unit unit-number {
family family-name {
policer {
input policer-name;
output policer-name;
}
}
}
}
Method B—Apply as a firewall filter policer at the protocol family level: [edit firewall]
family family-name {
filter filter-name {
interface-specific; # (*)
from {
... match-conditions ...
}
then {
policer policer-name;
}
}
}
[edit interfaces]
interface-name {
unit unit-number {
family family-name {
filter {
input filter-name;
output filter-name;
}
... protocol-configuration ...
}
}
}
| Policer configuration:
Firewall filter configuration (
Interface policer verification:
Firewall filter policer verification:
|
| Logical
Interface (Aggregate) Policer Defines traffic rate limiting that you can apply to multiple protocol families on the same logical interface without creating multiple instances of the policer. Can be applied directly to a logical interface configuration only. | ||
Logical interface policer configuration: [edit firewall]
policer policer-name {
logical-interface-policer;
if-exceeding {
bandwidth-limit bps;
burst-size-limit bytes;
}
then {
discard;
forwarding-class class-name;
loss-priority supported-value;
}
}
| Method A—Apply as an interface policer only: [edit interfaces]
interface-name {
unit unit-number {
policer { # All protocols
input policer-name;
output policer-name;
}
family family-name {
policer { # One protocol
input policer-name;
output policer-name;
}
}
}
}
Method B—Apply as a firewall filter policer at the protocol family level: [edit firewall]
family family-name {
filter filter-name {
interface-specific;
term term-name{
from {
... match-conditions ...
}
}
then {
policer policer-name;
}
}
}
| Policer configuration:
Two options for interface policer application:
Interface policer verification:
|
Change History Table
Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.
