Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Hierarchical Policers

Hierarchical Policer Overview

You can use a hierarchical policer to rate-limit ingress Layer 2 traffic at a physical or logical interface and apply different policing actions based on whether the packets are classified for expedited forwarding (EF) or for a lower priority.

Hierarchical policing is supported on M40E, M120, and M320 edge routers with incoming Flexible PIC Concentrators (FPCs) as SFPC and outgoing FPCs as FFPC, and on MX Series, ACX7100-L, T320, T640, and T1600 core routers with Enhanced Intelligent Queuing (IQE) PICs.

You can apply hierarchical policing to a logical interface.

A hierarchical policer configuration defines two policers—one for EF traffic only and another for non-EF traffic—that function in a hierarchical manner:

  • Premium policer—You configure the premium policer with traffic limits for high-priority EF traffic only: a guaranteed bandwidth and a corresponding burst-size limit. EF traffic is categorized as nonconforming when its average arrival rate exceeds the guaranteed bandwidth and its average packet size exceeds the premium burst-size limit. For a premium policer, the only configurable action for nonconforming traffic is to discard the packets.

  • Aggregate policer—You configure the aggregate policer with an aggregate bandwidth (to accommodate both high-priority EF traffic up to the guaranteed bandwidth and normal-priority non-EF traffic) and a burst-size limit for non-EF traffic only. Non-EF traffic is categorized as nonconforming when its average arrival rate exceeds the amount of aggregate bandwidth not currently consumed by EF traffic and its average packet size exceeds the burst-size limit defined in the aggregate policer. For an aggregate policer, the configurable actions for nonconforming traffic are to discard the packets, assign a forwarding class, or assign a packet loss priority (PLP) level.

Note:

You must configure the bandwidth limit of the premium policer at or below the bandwidth limit of the aggregate policer. If the two bandwidth limits are equal, then non-EF traffic passes through the interface unrestricted only while no EF traffic arrives at the interface.

EF traffic is guaranteed the bandwidth specified as the premium bandwidth limit, while non-EF traffic is rate-limited to the amount of aggregate bandwidth not currently consumed by the EF traffic. Non-EF traffic is rate-limited to the entire aggregate bandwidth only while no EF traffic is present.

For example, suppose that you configure a hierarchical policer with the following components:

  • Premium policer with bandwidth limit set to 2 Mbps, burst-size limit set to 3000 bytes, and nonconforming action set to discard packets.

  • Aggregate policer with bandwidth limit set to 10 Mbps, burst-size limit set to 3000 bytes, and nonconforming action set to discard packets.

EF traffic is guaranteed a bandwidth of 2 Mbps. Bursts of EF traffic—EF traffic that arrives at the interface at rates above 2 Mbps—can also pass through the interface provided sufficient tokens are available in the 3000-byte bucket. When no tokens are available for a burst of non-EF traffic, packets are rate-limited using policing actions for the premium policer.

Non-EF traffic is metered to a bandwidth limit that ranges between 8 Mbps and 10 Mbps, depending on the average arrival rate of the EF traffic. Bursts of non-EF traffic—non-EF traffic that arrives at the interface at rates above the current limit for non-EF traffic—also pass through the interface provided sufficient tokens are available in the 3000-byte bucket. When non-EF traffic exceeds the currently allowed bandwidth or when no tokens are available for a burst of non-EF traffic, packets are rate-limited using policing actions for the aggregate policer.

Subscriber Services Firewall Policer (ACX7100-48L Devices)

  • Starting Junos Evolved release 23.4R1, you can configure the hierarchical policer on DHCP and PPPoE access models at subscriber interfaces, that is activated during subscriber login or CoA. This feature supports colour coded traffic policing according to the colour classification of a packet. The packet colour is classified with packet matching criteria specified for two user-defined traffic classes. See the Example: Configuring a Hierarchical Policer for Subscriber Services Firewall (ACX7100-48L Devices) section for related configuration examples and limitations of the feature.

Example: Configuring a Hierarchical Policer

This example shows how to configure a hierarchical policer and apply the policer to ingress Layer 2 traffic at a logical interface on a supported platform.

Requirements

Before you begin, be sure that your environment meets the following requirements:

  • The interface on which you apply the hierarchical policer is a SONET interface hosted on one of the following routing platforms:

    • M40e, M120, or M320 edge router with incoming FPCs as SFPC and outgoing FPCs as FFPC.

    • MX Series, T320, T640, or T1600 core router with Enhanced Intelligent Queuing (IQE) PICs.

  • No other policer is applied to the input of the interface on which you apply the hierarchical policer.

  • You are aware that, if you apply the hierarchical policer to logical interface on which an input filter is also applied, the policer is executed first.

Overview

In this example, you configure a hierarchical policer and apply the policer to ingress Layer 2 traffic at a logical interface.

Topology

You apply the policer to the SONET logical interface so-1/0/0.0, which you configure for IPv4 and VPLS traffic. When you apply the hierarchical policer to that logical interface, both IPv4 and VPLS traffic is hierarchically rate-limited.

You also configure the logical interface so-1/0/0.1 for MPLS traffic. If you choose to apply the hierarchical policer to physical interface so-1/0/0, hierarchical policing would apply to IPv4 and VPLS traffic at so-1/0/0.0 and to MPLS traffic at so-1/0/0.1.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Use the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

CLI Quick Configuration

To quickly configure this example, copy the following configuration commands into a text file, remove any line breaks, and then paste the commands into the CLI at the [edit] hierarchy level.

Defining the Interfaces

Step-by-Step Procedure

To define the interfaces:

  1. Enable configuration of the physical interface.

  2. Configure logical unit 0.

    If you apply a Layer 2 policer to this logical interface, you must configure at least one protocol family.

  3. Configure logical unit 1.

Results

Confirm the configuration of the interfaces by entering the show interfaces configuration command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

Defining the Forwarding Classes

Step-by-Step Procedure

To define the forwarding classes referenced as aggregate policer actions:

  1. Enable configuration of the forwarding classes.

  2. Define the forwarding classes.

Results

Confirm the configuration of the forwarding classes referenced as aggregate policer actions by entering the show class-of-service configuration command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

Configuring the Hierarchical Policer

Step-by-Step Procedure

To configure a hierarchical policer:

  1. Enable configuration of the hierarchical policer.

  2. Configure the aggregate policer.

    For the aggregate policer, the configurable actions for a packet in a nonconforming flow are to discard the packet, change the loss priority, or change the forwarding class.

  3. Configure the premium policer.

    The bandwidth limit for the premium policer must not be greater than that of the aggregate policer.

    For the premium policer, the only configurable action for a packet in a nonconforming traffic flow is to discard the packet.

Results

Confirm the configuration of the hierarchical policer by entering the show firewall configuration command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

Applying the Hierarchical Policer to Layer 2 Ingress Traffic at a Physical or Logical Interface

Step-by-Step Procedure

To hierarchically rate-limit Layer 2 ingress traffic for IPv4 and VPLS traffic only on logical interface so-1/0/0.0, reference the policer from the logical interface configuration:

  1. Enable configuration of the logical interface.

    When you apply a policer to Layer 2 traffic at a logical interface, you must define at least one protocol family for the logical interface.

  2. Apply the policer to the logical interface.

    Alternatively, to hierarchically rate-limit Layer 2 ingress traffic for all protocol families and for all logical interfaces configured on physical interface so-1/0/0, you could reference the policer from the physical interface configuration.

Results

Confirm the configuration of the hierarchical policer by entering the show interfaces configuration command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

Displaying Traffic Statistics and Policers for the Logical Interface

Purpose

Verify the traffic flow through the logical interface and that the policer is evaluated when packets are received on the logical interface.

Action

Use the show interfaces operational mode command for logical interface so-1/0/0.0, and include the detail or extensive option. The command output section for Traffic statistics lists the number of bytes and packets received and transmitted on the logical interface, and the Protocol inet section contains a Policer field that would list the policer policer1 as an input or output policer as follows:

  • Input: policer1-so-1/0/0.0-inet-i

  • Output: policer1-so-1/0/0.0-inet-o

In this example, the policer is applied to logical interface traffic in the input direction only.

Displaying Statistics for the Policer

Purpose

Verify the number of packets evaluated by the policer.

Action

Use the show policer operational mode command and optionally specify the name of the policer. The command output displays the number of packets evaluated by each configured policer (or the specified policer), in each direction. For the policer policer1, the input and output policer names are displayed as follows:

  • policer1-so-1/0/0.0-inet-i

  • policer1-so-1/0/0.0-inet-o

The -inet-i suffix denotes a policer applied to IPv4 input traffic, while the -inet-o suffix denotes a policer applied to IPv4 output traffic. In this example, the policer is applied to input traffic only.

Example: Configuring a Hierarchical Policer for Subscriber Services Firewall (ACX7100-48L Devices)

This example shows how to configure a hierarchical policer and apply the policer to ingress traffic at a subscriber interface on a supported platform (ACX7100-48L).

Overview

Starting Junos Evolved release 23.4R1, you can configure hierarchical policers and apply the policers to ingress traffic at a subscriber interface. This feature is supported on ACX7100-48L devices.

Note:
  • The subscriber services hierarchical policer has the following limitations:

    • You can configure only four levels of hierarchical policers with each level having aggregate and premium configuration.

    • Logical interface policers and aggregate policers are not supported for subscriber services.

    • Policing priority set inside forwarding class is not supported. For example:
    • next term is allowed only for hierarchical policers and not for filters.
    • Attaching policers directly to an interface or family is not supported. Policers are supported only through firewall filter action.
    • Policer action forwarding-class is not supported in ingress and egress. loss-priority high action is supported in ingress. Only discard action is supported in egress.
    • A single policy cannot have loss-priority and policer actions configured. Only one of both actions are supported at any given time.
    • filter-specific option is not supported in policer configuration.
    • Hierarchical policers and tri-color policers are not supported in the Egress direction.
    • Filter terms chaining feature is not available.

    • Tri-color policer and hierarchical policers are not supported in Egress direction.

Configuration Scenarios

The following section provides the different configurations for various hierarchical policer options:

Single Rate Two Color Marking Policer Configuration

You can configure single rate two color marking policer on DHCP and PPPoE access models. The configuration is activated during subscriber login or CoA. View the configuration by entering the show dynamic-profiles pppoe-client-policer-1-profile command. A sample configuration is as follows:

You can configure single rate tri-color marking policer on DHCP and PPPoE access models. It is activated during subscriber login or CoA. View the configuration by entering the show dynamic-profiles pppoe-client-policer-1-profile command. A sample configuration is as follows:

Two Rate Tri Color Marking Policer

You can configure two rate tri color marking policer on DHCP and PPPoE access models. It is activated during subscriber login or CoA.

In this section you can see a sample dynamic profile configuration on controller point. Contents of dynamic profile are propagated forward during subscriber login for a client profile or during service activation for a service profile. View the configuration by entering the show dynamic-profiles pppoe-client-policer-1-profile command. A sample configuration is as follows:

Hierarchical Policer for DHCP and PPPoE

In this section you can see a sample dynamic profile configuration at the controller point on DHCP and PPPoE access models. Contents of dynamic profile are propagated forward during subscriber login for a client profile or during service activation for a service profile. View the configuration by entering the show dynamic-profiles pppoe-client-policer-1-profile command. A sample configuration is as follows:

If you are done configuring the device, enter commit from configuration mode.