close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

Configuring and Applying Tricolor Marking Policers

date_range 29-Nov-23

A tricolor marking (TCM) policer polices traffic on the basis of metering rates, including the CIR, the PIR, their associated burst sizes, and any policing actions configured for the traffic.

This topic describes how to configure and apply TCM policers and includes the following topics:

Defining a Tricolor Marking Policer

To configure a TCM policer, first enable tricolor marking if not already enabled by default (see Enabling Tricolor Marking and Limitations of Three-Color Policers):

You can configure a tricolor policer to discard high loss priority traffic on a logical interface in the ingress or egress direction. statement.

In all cases, the range of allowable bits-per-second or byte values is 1500 to 100,000,000,000. You can specify the values for bps and bytes either as complete decimal numbers or as decimal numbers followed by the abbreviation k (1000), m (1,000,000), or g (1,000,000,000).

The color-blind policer implicitly marks packets into three loss priority categories:

Low
Medium-high
High

Table 1 describes all the configurable TCM statements.

Table 1: Tricolor Marking Policer Statements
Statement	Meaning	Configurable Values
`single-rate`	Marking is based on the CIR, CBS, and EBS.	–
`two-rate`	Marking is based on the CIR, PIR, and rated burst sizes.	–
`color-aware`	Metering depends on the packet’s preclassification. Metering can increase a packet’s assigned PLP, but cannot decrease it.	–
`color-blind`	All packets are evaluated by the CIR or CBS. If a packet exceeds the CIR or CBS, it is evaluated by the PIR or EBS.	–
`committed-information-rate`	Guaranteed bandwidth under normal line conditions and the average rate up to which packets are marked green.	1500 through 100,000,000,000 bps
`committed-burst-size`	Maximum number of bytes allowed for incoming packets to burst above the CIR, but still be marked green.	1500 through 100,000,000,000 bytes
`excess-burst-size`	Maximum number of bytes allowed for incoming packets to burst above the CIR, but still be marked yellow.	1500 through 100,000,000,000 bytes
`peak-information-rate`	Maximum achievable rate. Packets that exceed the CIR but are below the PIR are marked yellow. Packets that exceed the PIR are marked red.	1500 through 100,000,000,000 bps
`peak-burst-size`	Maximum number of bytes allowed for incoming packets to burst above the PIR, but still be marked yellow.	1500 through 100,000,000,000 bytes

Define the TCM policer at the [edit firewall] hierarchy level:

Create the TCM policer by defining a name for the policer.
```
[edit]
user@host# edit firewall three-color-policer three-color-policer-name
```

Discard traffic on a logical interface using tricolor marking policing.

content_copy zoom_out_map
[edit firewall three-color-policer name]
user@host# set action loss-priority high then discard

Define the filter as a logical interface policer.

content_copy zoom_out_map
[edit firewall three-color-policer name]
user@host# set logical-interface-policer

Configure a single-rate three-color policer in which marking is based on the committed information rate (CIR), committed burst size (CBS), and excess burst size (EBS).

content_copy zoom_out_map
[edit firewall three-color-policer name]
user@host# set single-rate (color-aware | color-blind)
user@host# set single-rate committed-information-rate bps
user@host# set single-rate committed-burst-size bytes 
user@host# set single-rate excess-burst-size bytes

Configure a two-rate three-color policer in which marking is based on the committed information rate (CIR), committed burst size (CBS), peak information rate (PIR), and peak burst size (PBS).

content_copy zoom_out_map
[edit firewall three-color-policer name]
user@host# set two-rate (color-aware | color-blind)
user@host# set two-rate committed-information-rate bps
user@host# set two-rate committed-burst-size bytes
user@host# set two-rate peak-information-rate bps 
user@host# set two-rate peak-burst-size bytes

Confirm the configuration.

content_copy zoom_out_map
[edit firewall]
user@host# show

three-color-policer name {
    action {
        loss-priority high then discard; # Only for IQ2 PICs
    }
    logical-interface-policer;
    single-rate {
        (color-aware | color-blind);
        committed-information-rate bps;
        committed-burst-size bytes;
        excess-burst-size bytes;
    }
    two-rate {
        (color-aware | color-blind);
        committed-information-rate bps;
        committed-burst-size bytes;
        peak-information-rate bps;
        peak-burst-size bytes;
    }
}

Save the configuration.
```
[edit]
user@host# commit
```

Applying Tricolor Marking Policers to Firewall Filters

To rate-limit traffic by applying a tricolor marking policer to a firewall filter:

Set the three-color-policer statement at the edit firewall hierarchy level:

content_copy zoom_out_map
[edit]
user@host# edit firewall
user@host# set three-color-policer  three-color-policer-name

You can include this statement at the following hierarchy levels:

[edit firewall family family filter filter-name term rule-name then]
[edit firewall filter filter-name term rule-name then]

In the family statement, the protocol family can be any, ccc, inet, inet6, mpls, or vpls.

You must identify the referenced policer as a single-rate or two-rate policer, and this statement must match the configured TCM policer. Otherwise, an error message appears in the configuration listing.

For example, if you configure srTCM as a single-rate TCM policer and try to apply it as a two-rate policer, the following message appears:

content_copy zoom_out_map
[edit firewall]
user@host# show three-color-policer srTCM
single-rate {
    color-aware;
    . . .
}
user@host# show filter TESTER
term A {
    then {
        three-color-policer {
            ##
            ## Warning: Referenced two-rate policer does not exist
            ##
            two-rate srTCM;
        }
    }
}

Applying Firewall Filter Tricolor Marking Policers to Interfaces

To apply a tricolor marking policer to an interface, you must reference the filter name in the interface configuration.

Set the filter statement:

content_copy zoom_out_map
[edit]
user@host# edit interfaces interface-name unit logical-unit-number family family
user@host# set filter input filter-name
user@host# set filter output filter-name

Note:

The filter name that you reference must have an attached tricolor marking policer.

You can include these statements at the following hierarchy levels:

[edit interfaces interface-name unit logical-unit-number family family]
[edit logical-systems logical-system-name interfaces interface-name unit logical-unit-number family family]

Example: Configuring and Applying a Single-Rate Tricolor Marking Policer

The following example requires that you navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.

This example describes how to configure and apply a color-blind, single-rate, tricolor policer.

Configure the single-rate, color-blind, three-color policer.

content_copy zoom_out_map
[edit]
user@host# edit firewall three-color-policer srtcm1-cb single-rate
user@host# set color-blind
user@host# set committed-information-rate 1048576
user@host# set committed-burst-size 65536
user@host# excess-burst-size 131072

Apply the policer to the fil firewall filter.

content_copy zoom_out_map
[edit firewall]
user@host# set filter fil term default then three-color-policer single-rate srtc1-cb

Apply the fil firewall filter to the logical interface:

content_copy zoom_out_map
[edit]
user@host# edit interfaces so-1/0/0 unit 0
user@host# set family inet filter input fil

Verify the configuration.

content_copy zoom_out_map
[edit firewall]
user@host# show

content_copy zoom_out_map
three-color-policer srtcm1-cb {
    single-rate {
        color-blind;
        committed-information-rate 1048576;
        committed-burst-size 65536;
        excess-burst-size 131072;
    }
}
filter fil {
    term default {
        then {
            three-color-policer {
                single-rate srtcm1-cb;
            }
        }
    }
}

content_copy zoom_out_map
[edit interfaces]
user@host# show

content_copy zoom_out_map
so-1/0/0 {
    unit 0 {
        family inet {
            filter {
                input fil;
            }
        }
    }
}

Save the configuration.
```
[edit]
user@host# commit
```

arrow_backward PREVIOUS Enabling Tricolor Marking and Limitations of Three-Color Policers

NEXT arrow_forward Configuring Single-Rate Tricolor Marking

Class of Service User Guide (Routers and EX9200 Switches)

ON THIS PAGE

Configuring and Applying Tricolor Marking Policers

Defining a Tricolor Marking Policer

Applying Tricolor Marking Policers to Firewall Filters

Applying Firewall Filter Tricolor Marking Policers to Interfaces

Example: Configuring and Applying a Single-Rate Tricolor Marking Policer

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Class of Service User Guide (Routers and EX9200 Switches)

ON THIS PAGE

Configuring and Applying Tricolor Marking Policers

Defining a Tricolor Marking Policer

Applying Tricolor Marking Policers to Firewall Filters

Applying Firewall Filter Tricolor Marking Policers to Interfaces

Example: Configuring and Applying a Single-Rate Tricolor Marking Policer

Related Documentation

Stay in touch