Example: Using Two-Color Policers and Prefix Lists

If you provide specific amounts of bandwidth to internal or external customers, you can use policing to make sure that customers do not consume more bandwidth than they should receive. For example, you might connect many customers to one 10-Gbps interface and want to ensure that none of them congest the interface by using more bandwidth than they have been allotted.

You could accomplish this by creating a two-color policer similar to the following for each customer:

firewall {
    policer Limit-Customer-1 {
        if-exceeding {
            bandwidth-limit 100m;
            burst-size-limit 150m;
        }
        then discard;
    }

Creating a policer for each customer is clearly not a scalable solution, however. As an alternative, you can create prefix lists that group classes of customers and then create policers for each prefix list. For example, you could create prefix lists such as Class-A-Customer-Prefixes, Class-B-Customer-Prefixes, and Class-C-Customer-Prefixes (at the [edit policy-options] hierarchy level) and create the following corresponding policers:

firewall {
    policer Class-A {
        if-exceeding {
            bandwidth-limit 100m;
            burst-size-limit 150m;
        }
        then discard;
    }
    policer Class-B {
        if-exceeding {
            bandwidth-limit 75m;
            burst-size-limit 100m;
        }
        then discard;
    }
    policer Class-C {
        if-exceeding {
            bandwidth-limit 50m;
            burst-size-limit 75m;
        }
        then discard;
    }
}

You must create filter terms that specify the prefix lists in their from statements and the corresponding policers in their then statements similar to the following:

firewall
    family inet {
        filter Class-A-Customers {
            term term-1 {
                from {
                    destination-prefix-list {
                        Class-A-Customer-Prefixes;
                    }
                }
                then policer Class-A;
            }
        }
        filter Class-B-Customers {
            term term-1 {
                from {
                    destination-prefix-list {
                        Class-B-Customer-Prefixes;
                    }
                }
                then policer Class-B;
            }
        }
        filter Class-C-Customers {
            term term-1 {
                from {
                    destination-prefix-list {
                        Class-C-Customer-Prefixes;
                    }
                }
                then policer Class-C;
            }
        }
    }

Here are the steps to create this firewall configuration:

1. Create the first policer:

   content_copy zoom_out_map

   [edit firewall]
   user@switch# set policer Class-A if-exceeding bandwidth-limit 100m burst-size-limit 150m
   user@switch# set policer Class-A then discard

2. Create the second policer:

   content_copy zoom_out_map

   [edit firewall]
   user@switch# set policer Class-B if-exceeding bandwidth-limit 75m burst-size-limit 100m
   user@switch# set policer Class-B then discard

3. Create the third policer:

   content_copy zoom_out_map

   [edit firewall]
   user@switch# set policer Class-C if-exceeding bandwidth-limit 50m burst-size-limit 75m
   user@switch# set policer Class-C then discard

4. Create a filter for class A customers:

   content_copy zoom_out_map

   [edit firewall]
   user@switch# edit family inet filter Class-A-Customers
   

5. Configure the filter to send packets matching the Class-A-Customer-Prefixes prefix list to the Class-A policer:

   content_copy zoom_out_map

   [edit firewall family inet filter Class-A-Customers]
   user@switch# set term term-1 from source-prefix-list Class-A-Customers
   user@switch# set term term-1 then policer Class-A

6. Create a filter for class B customers:

   content_copy zoom_out_map

   [edit firewall]
   user@switch# edit family inet filter Class-B-Customers

7. Configure the filter to send packets matching the Class-B-Customer-Prefixes prefix list to the Class-B policer:

   content_copy zoom_out_map

   [edit firewall family inet filter Class-B-Customers]
   user@switch# set term term-1 from source-prefix-list Class-B-Customers
   user@switch# set term term-1 then policer Class-B

8. Create a filter for class C customers:

   content_copy zoom_out_map

   [edit firewall]
   user@switch# edit family inet filter Class-C-Customers

9. Configure the filter to send packets matching the Class-C-Customer-Prefixes prefix list to the Class-C policer:

   content_copy zoom_out_map

   [edit firewall family inet filter Class-C-Customers]
   user@switch# set term term-1 from source-prefix-list Class-C-Customers
   user@switch# set term term-1 then policer Class-C

10. Apply the filters you created to the appropriate interfaces in the output direction.