Example: Configuring Hierarchical Policers to Limit Rates of Services in a Static Environment

Step-by-Step Procedure

A dynamic profile is a set of characteristics, defined in a type of template, that you can use to provide dynamic subscriber access and services for broadband applications. These services are assigned dynamically to interfaces. A basic profile must contain a profile name and have both an interface variable name (such as $junos-interface-ifd-name) included at the [edit dynamic-profiles profile-name interfaces hierarchy level and logical interface variable name (such as $junos-underlying-interface-unit or $junos-interface-unit) at the [edit dynamic-profiles profile-name interfaces variable-interface-name unit] hierarchy level.

1. Create the new dynamic profile.

   content_copy zoom_out_map

   [edit]
   user@host# set dynamic-profiles basic-profile
   

2. Define the interface-name variable statement with the internal $junos-interface-ifd-name variable used by the router to match the interface name of the receiving interface.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile]
   user@host# set interfaces “$junos-interface-ifd-name”
   

3. Define the variable-interface-name unit statement with the internal variable.

   • When referencing an existing interface, specify the $junos-underlying-interface-unit variable used by the router to match the unit value of the receiving interface.

   • When creating dynamic interfaces, specify the $junos-interface-unit variable used by the router to generate a unit value for the interface.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile interfaces "$junos-interface-ifd-name"]
   user@host# set unit $junos-underlying-interface-unit
   

   or

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile interfaces "$junos-interface-ifd-name"]
   user@host# set unit $junos-interface-unit
   

4. Define the family address type (inet for IPv4) for the $junos-interface-unit variable.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile interfaces "$junos-interface-ifd-name" unit $junos-underlying-interface-unit]
   user@host# set family inet
   

Results

Confirm the configuration of the dynamic profile by entering the show dynamic-profiles configuration command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

[edit]
user@host# show dynamic-profiles
dynamic-profiles {
    basic-profile {
        interfaces {
            "$junos-interface-ifd-name" {
                unit "$junos-underlying-interface-unit" {
                    family inet;
                }
            }
        }
    }
}

If you are done configuring the device, enter commit from configuration mode.

Step-by-Step Procedure

Define the physical and logical interfaces for this hierarchical policer example.

1. Configure the physical interface.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile]
   user@host# set interfaces ge-1/2/0
   

2. Configure the logical interface as unit 0 with its IPv4 (inet) protocol family interface.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile interfaces ge-1/2/0]
   user@host# set unit 0 family inet address 203.0.113.80/31
   

   Note:

   If you apply a Layer 2 policer to this logical interface, you must configure at least one protocol family.

Results

Confirm the configuration by entering the show dynamic-profiles basic-profile interfaces configuration command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

[edit]
user@host# show dynamic-profiles basic-profile interfaces
ge-1/2/0 {
    unit 0 {
        family inet {
            address 203.0.113.80/31;
        }
    }
}

Step-by-Step Procedure

To configure a hierarchical policer as a filter action, you must first configure a firewall filter.

1. Configure the family address type (inet for IPv4) for the firewall filter and specify the filter name.

   We recommend that you name the filter something that indicates the filter’s purpose.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile]
   user@host# set firewall family inet filter hierarch-filter
   

2. To override the aggregation of the counters and policing actions and make each counter or policy function specific to each interface application, include the interface-specific statement in the filter.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile firewall family inet filter hierarch-filter]
   user@host# set interface-specific
   

3. Specify the term names for the filter.

   Make each term name unique and represent what its function is.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile firewall family inet filter hierarch-filter]
   user@host# set term match-ip1
   user@host# set term match-ip2
   

4. In each firewall filter term, specify the conditions used to match components of a packet.

   Configure the first term to match IPv4 packets received through TCP with the IP precedence field critical-ecp (0xa0) protocol, and apply the hierarchical policer as a filter action.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile firewall family inet filter hierarch-filter term match-ip1]
   user@host# set from precedence critical-ecp protocol
   user@host# set from protocol tcp
   

5. Specify the actions to take when the packet matches all of the conditions in the first term. Enable all hierarchical policers in one filter to share the same policer instance in the Packet Forward Engine.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile firewall family inet filter hierarch-filter term match-ip1]
   user@host# set then hierarchical-policer hp1-share filter-specific
   

6. Configure the second term to match IPv4 packets received through TCP with the IP precedence field internet-control (0xc0), and apply the hierarchical policer as a filter action.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile firewall family inet filter hierarch-filter term match-ip2]
   user@host# set from precedence internet-control
   user@host# set from protocol tcp
   

7. Specify the actions to take when the packet matches all of the conditions in the second term.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile firewall family inet filter inet-filter term match-ip2]
   user@host# set then hierarchical-policer hp2-share
   

Results

Confirm the configuration by entering the show dynamic-profiles basic-profile firewall configuration command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

[edit]
user@host# show dynamic-profiles basic-profile firewall
family inet {
    filter hierarch-filter {
        interface-specific;
        term match-ip1 {
            from {
                precedence critical-ecp protocol;
                protocol tcp;
            }
            then hierarchical-policer hp1-share;
        }
        term match-ip2 {
            from {
                precedence internet-control;
                protocol tcp;
            }
            then hierarchical-policer hp2-share;
        }
    }
}

Step-by-Step Procedure

Define forwarding classes referenced as aggregate policer actions. For hierarchical policers to work, ingress traffic must be correctly classified into premium and non-premium buckets. Some class-of-service (CoS) configuration is required because the hierarchical policer must be able to separate premium/expedited forwarding (EF) traffic from non-premium/non-EF traffic.

1. Enable configuration of the forwarding classes.

   content_copy zoom_out_map

   [edit]
   user@host# set class-of-service forwarding-classes
   

2. Define CoS forwarding classes to include the designation of which forwarding class is premium. This defaults to the forwarding class associated with EF traffic.

   content_copy zoom_out_map

   [edit class-of-service forwarding-classes]
   user@host# set class fc0 queue-num 0 priority high policing-priority premium
   user@host# set class fc1 queue-num 1 priority low policing-priority normal
   user@host# set class fc2 queue-num 2 priority low policing-priority normal
   user@host# set class fc3 queue-num 3 priority low policing-priority normal
   

Results

Confirm the configuration of the forwarding classes referenced as aggregate policer actions by entering the show class-of-service configuration command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

[edit]
user@host# show class-of-service
forwarding-classes {
    class fc0 queue-num 0 priority high policing-priority premium;
    class fc1 queue-num 1 priority low policing-priority normal;
    class fc2 queue-num 2 priority low policing-priority normal;
    class fc3 queue-num 3 priority low policing-priority normal;
}

Step-by-Step Procedure

Configure the aggregate and premium policing components of a hierarchical policer.

1. Enable configuration of the hierarchical policer.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile]
   user@host# set firewall hierarchical-policer policer-agg-prem
   

2. Configure the aggregate policer to have a bandwidth limit set to 10 Mbps, burst-size limit set to 100 KB, and nonconforming action set to change the forwarding class to fc1.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile firewall hierarchical-policer policer-agg-prem]
   user@host# set aggregate if-exceeding bandwidth-limit 10m burst-size-limit 100k
   user@host# set aggregate then forwarding-class fc1
   

   Note:

   For aggregate policers, the configurable actions for a packet in a nonconforming flow are to discard the packet, change the loss priority, or change the forwarding class.

3. Configure the premium policer to have a bandwidth limit set to 2 Mbps, burst-size limit set to 50 KB, and nonconforming action set to discard packets.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile firewall hierarchical-policer policer-agg-prem]
   user@host# set premium if-exceeding bandwidth-limit 2m burst-size-limit 50k
   user@host# set premium then discard
   

   Note:

   The bandwidth limit for the premium policer must not be greater than that of the aggregate policer. For the premium policers, the only configurable action for a packet in a nonconforming traffic flow is to discard the packet.

Results

Confirm the configuration of the hierarchical policer by entering the show dynamic-profiles basic-profile firewall configuration command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

[edit]
user@host# show dynamic-profiles basic-profile firewall
hierarchical-policer policer-agg-prem {
    aggregate {
        if-exceeding {
            bandwidth-limit 10m;
            burst-size-limit 100k;
        }
        then {
            forwarding-class fc1;
        }
    }
    premium {
        if-exceeding {
            bandwidth-limit 2m;
            burst-size-limit 50k;
        }
        then {
            discard;
        }
    }
}

Step-by-Step Procedure

You can apply policers directly to an interface or applied through a filter to affect only matching traffic. In most cases, you can invoke a policing function at ingress, egress, or in both directions.

• For physical interfaces, a hierarchical policer uses a single policer instance to rate-limit all logical interfaces and protocol families configured on a physical interface, even if the logical interfaces have mutually exclusive families such as inet or bridge.

• For logical interfaces, a hierarchical policer can police the traffic from multiple protocol families without requiring a separate instantiation of a policer for each such family on the logical interface.

To hierarchically rate-limit Layer 2 ingress traffic for IPv4 traffic on logical interface ge-1/2/0.0, reference the policer from the logical interface configuration.

1. Configure the logical interface.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile]
   user@host# set interfaces ge-1/2/0 unit 0
   

   When you apply a policer to Layer 2 traffic at a logical interface, you must define at least one protocol family for the logical interface.

2. Apply the policer to the logical interface.

   content_copy zoom_out_map

   [edit dynamic-profiles basic-profile interfaces ge-1/2/0 unit 0]
   user@host# set layer2-policer input-hierarchical-policer policer-agg-prem
   

   Alternatively, to hierarchically rate-limit Layer 2 ingress traffic for all protocol families and for all logical interfaces configured on physical interface ge-1/2/0, reference the policer from the physical interface configuration.

Results

Confirm the configuration of the hierarchical policer by entering the show dynamic-profiles basic-profile interfaces configuration command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

[edit]
user@host# show dynamic-profiles basic-profile interfaces
ge-1/2/0 {
    unit 0 {
        layer2-policer {
            input-hierarchical-policer policer-agg-prem;
        }
        family inet {
            address 203.0.113.80/31;
        }
    }
}

Purpose

Verify the traffic flow through the physical interface.

Action

Use the show interfaces operational mode command for physical interface ge-1/2/0, and include the detail or extensive option.

user@host> show interfaces ge-1/2/0 extensive

Physical interface: ge-1/2/0, Enabled, Physical link is Down
  Interface index: 156, SNMP ifIndex: 630, Generation: 159
  Link-level type: Ethernet, MTU: 1514, MRU: 1522, Speed: 1000mbps, BPDU Error: None, MAC-REWRITE Error: None, Loopback: Disabled,
  Source filtering: Disabled, Flow control: Enabled, Auto-negotiation: Enabled, Remote fault: Online
  Pad to minimum frame size: Disabled
  Device flags   : Present Running Down
  Interface flags: Hardware-Down SNMP-Traps Internal: 0x4000
  Link flags     : None
  CoS queues     : 8 supported, 8 maximum usable queues
  Schedulers     : 0
  Hold-times     : Up 0 ms, Down 0 ms
  Current address: 00:00:5E:00:53:4c, Hardware address: 00:00:5E:00:53:4c
  Last flapped   : 2014-11-10 13:36:25 EST (01:26:30 ago)
  Statistics last cleared: Never
  Traffic statistics:
   Input  bytes  :                    0                    0 bps
   Output bytes  :                   42                    0 bps
   Input  packets:                    0                    0 pps
   Output packets:                    1                    0 pps
   IPv6 transit statistics:
    Input  bytes  :                   0
    Output bytes  :                   0
    Input  packets:                   0
    Output packets:                   0
  Dropped traffic statistics due to STP State:
   Input  bytes  :                    0
   Output bytes  :                    0
   Input  packets:                    0
   Output packets:                    0
  Input errors:
    Errors: 0, Drops: 0, Framing errors: 0, Runts: 0, Policed discards: 0, L3 incompletes: 0, L2 channel errors: 0, L2 mismatch timeouts: 0,
    FIFO errors: 0, Resource errors: 0
  Output errors:
    Carrier transitions: 0, Errors: 0, Drops: 0, Collisions: 0, Aged packets: 0, FIFO errors: 0, HS link CRC errors: 0, MTU errors: 0,
    Resource errors: 0
  Egress queues: 8 supported, 8 in use
  Queue counters:       Queued packets  Transmitted packets      Dropped packets
    0                                0                    0                    0
    1                                0                    0                    0
    2                                0                    0                    0
    3                                0                    0                    0
    4                                0                    0                    0
    5                                0                    0                    0
    6                                0                    0                    0
    7                                0                    0                    0
  Queue number:         Mapped forwarding classes
    0                   best-effort
    1                   expedited-forwarding
    2                   assured-forwarding
    3                   network-control
    4                   be1
    5                   ef1
    6                   af1
    7                   nc1
  Active alarms  : LINK
  Active defects : LINK
  MAC statistics:                      Receive         Transmit
    Total octets                             0                0
    Total packets                            0                0
    Unicast packets                          0                0
    Broadcast packets                        0                0
    Multicast packets                        0                0
    CRC/Align errors                         0                0
    FIFO errors                              0                0
    MAC control frames                       0                0
    MAC pause frames                         0                0
    Oversized frames                         0
    Jabber frames                            0
    Fragment frames                          0
    VLAN tagged frames                       0
    Code violations                          0
    Total errors                             0                0
  Filter statistics:
    Input packet count                       0
    Input packet rejects                     0
    Input DA rejects                         0
    Input SA rejects                         0
    Output packet count                                       0
    Output packet pad count                                   0
    Output packet error count                                 0
    CAM destination filters: 0, CAM source filters: 0
  Autonegotiation information:
    Negotiation status: Incomplete
  Packet Forwarding Engine configuration:
    Destination slot: 0 (0x00)
  CoS information:
    Direction : Output
    CoS transmit queue               Bandwidth               Buffer Priority   Limit
                              %            bps     %           usec
    0 best-effort            95      950000000    95              0      low    none
    3 network-control         5       50000000     5              0      low    none
  Interface transmit statistics: Disabled

Meaning

The command output section for Traffic statistics lists the number of bytes and packets received and transmitted on the interface.

Purpose

Verify the number of packets evaluated by the policer. Premium policer counters are not supported.

Action

Use the show policer operational mode command and optionally specify the name of the policer policer-agg-prem. The command output displays the number of packets evaluated by the specified policer in each direction.

user@host> show policer policer-agg-prem
Policers:
Name                                                Bytes              Packets
policer-agg-prem-ge-1/2/0.0-inet-i               10372300               103723

The -inet-i suffix denotes a policer applied to IPv4 input traffic. In this example, the policer is applied to input traffic only.

Meaning

The command output displays the number of packets evaluated by the specified policer in each direction.