Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Example: Configuring a Two-Color Logical Interface (Aggregate) Policer

Starting in Junos OS Release 15.1X49-D40 and Junos OS Release 17.3R1, you can configure a single-rate two-color policer as a logical interface policer and apply it to incoming IPv4 traffic on a logical interface. This example shows how to do to so.

Requirements

Before you begin, make sure that the logical interface to which you apply the two-color logical interface policer is hosted on a Gigabit Ethernet interface (ge-) or a 10-Gigabit Ethernet interface (xe-).

Overview

In this example, you configure the single-rate two-color policer policer_IFL as a logical interface policer and apply it to incoming IPv4 traffic at logical interface ge-1/3/1.0.

Topology

If the input IPv4 traffic on the physical interface ge-1/3/1 exceeds the bandwidth limit equal to 90 percent of the media rate with a 300 KB burst-size limit, then the logical interface policer policer_IFL rate-limits the input IPv4 traffic on the logical interface ge-1/3/1.0. Configure the policer to mark nonconforming traffic by setting packet loss priority (PLP) levels to high and classifying packets as best-effort.

As the incoming IPv4 traffic rate on the physical interface slows and conforms to the configured limits, Junos OS stops marking the incoming IPv4 packets at the logical interface.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Configuring the Logical Interfaces

Step-by-Step Procedure

To configure the logical interfaces:

  1. Enable configuration of the interface.

  2. Configure single tagging.

  3. Configure logical interface ge-1/3/1.0.

  4. Configure logical interface ge-1/3/1.0.

Results

Confirm the configuration of the logical interfaces by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

Configuring the Single-Rate Two-Color Policer as a Logical Interface Policer

Step-by-Step Procedure

To configure a single-rate two-color policer as a logical interface policer:

  1. Enable configuration of a single-rate two-color policer.

  2. Specify that the policer is a logical interface (aggregate) policer.

    A logical interface policer rate-limits traffic based on a percentage of the media rate of the physical interface underlying the logical interface to which the policer is applied. The policer is applied directly to the interface rather than referenced by a firewall filter.

  3. Specify the policer traffic limits.

    • Specify the bandwidth limit.

      • To specify the bandwidth limit as an absolute rate, from 8,000 bits per second through 50,000,000,000 bits per second, include the bandwidth-limit bps statement.

      • To specify the bandwidth limit as a percentage of the physical port speed on the interface, include the bandwidth-percent percent statement.

      In this example, the CLI commands and output are based on a bandwidth limit specified as a percentage rather than as an absolute rate.

    • Specify the burst-size limit, from 1,500 bytes through 100,000,000,000 bytes, which is the maximum packet size to be permitted for bursts of data that exceed the specified bandwidth limit.

  4. Specify the policer actions to be taken on traffic that exceeds the configured rate limits.

    • To discard the packet, include the discard statement.

    • To set the loss-priority value of the packet, include the loss-priority (low | medium-low | medium-high | high) statement.

    • To classify the packet to a forwarding class, include the forwarding-class (forwarding-class | assured-forwarding | best-effort | expedited-forwarding | network-control) statement.

    In this example, the CLI commands and output are based on both setting the packet loss priority level and classifying the packet.

Results

Confirm the configuration of the policer by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

Applying the Logical Interface Policer to Input IPv4 Traffic at a Logical Interface

Step-by-Step Procedure

To apply the two-color logical interface policer to input IPv4 traffic a logical interface:

  1. Enable configuration of the logical interface.

  2. Apply the policer to all traffic types or to a specific traffic type on the logical interface.

    • To apply the policer to all traffic types, regardless of the protocol family, include the policer (input | output) policer-name statement at the [edit interfaces interface-name unit number] hierarchy level.

    • To apply the policer to traffic of a specific protocol family, include the policer (input | output) policer-name statement at the [edit interfaces interface-name unit unit-number family family-name] hierarchy level.

    To apply the logical interface policer to incoming packets, use the policer input policer-name statement. To apply the logical interface policer to outgoing packets, use the policer output policer-name statement.

    In this example, the CLI commands and output are based on rate-limiting the IPv4 input traffic at logical interface ge-1/3/1.0.

Results

Confirm the configuration of the interface by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

Displaying Traffic Statistics and Policers for the Logical Interface

Purpose

Verify the traffic flow through the logical interface and that the policer is evaluating packets received on the logical interface.

Action

Use the show interfaces operational mode command for logical interface ge-1/3/1.0, and include the detail or extensive option. The command output section for Traffic statistics lists the number of bytes and packets received and transmitted on the logical interface. The Protocol inet subsection contains a Policer field that would list the policer policer_IFL as an input or output logical interface policer as follows:

  • Input: policer_IFL-ge-1/3/1.0-log_int-i

  • Output: policer_IFL-ge-1/3/1.0-log_int-o

The log_int-i suffix denotes a logical interface policer applied to input traffic, while the log_int-o suffix denotes a logical interface policer applied to output traffic. In this example, the logical interface policer is applied to input traffic only.

Displaying Statistics for the Policer

Purpose

Verify the number of packets evaluated by the policer.

Action

Use the show policer operational mode command and, optionally, specify the name of the policer. The command output displays the number of packets evaluated by each configured policer (or the specified policer), in each direction. For the policer policer_IFL, the input and output policer names are displayed as follows:

  • policer_IFL-ge-1/3/1.0-log_int-i

  • policer_IFL-ge-1/3/1.0-log_int-o

The log_int-i suffix denotes a logical interface policer applied to input traffic, while the log_int-o suffix denotes a logical interface policer applied to output traffic. In this example, the logical interface policer is applied to input traffic only.

Change History Table

Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.

Release
Description
15.1X49-D40
Starting in Junos OS Release 15.1X49-D40 and Junos OS Release 17.3R1, you can configure a single-rate two-color policer as a logical interface policer and apply it to incoming IPv4 traffic on a logical interface.