Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Example: Configuring a Rate-Limiting Filter Based on Destination Class

 

This example shows how to configure a rate-limiting stateless firewall filter.

Requirements

No special configuration beyond device initialization is required before configuring this example.

Before you begin, configure the destination class class1.

Overview

In this example, you use a stateless firewall filter to set rate limits based on a destination class.

To activate a policer from within a stateless firewall filter configuration:

  • Create a template for the policer by including the policer policer-name statement.

  • Reference the policer in a filter term that specifies the policer in the policer policer-name nonterminating action.

You can also activate a policer by including the policer (input | output) policer-template-name statement at a logical interface.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

CLI Quick Configuration

To quickly configure this example, copy the following commands into a text file, remove any line breaks, and then paste the commands into the CLI at the [edit] hierarchy level.

Configure the Stateless Firewall Filter

Step-by-Step Procedure

To configure the stateless firewall filter rl_dclass1 with policer police_class1 for destination class class1:

  1. Create the stateless firewall filter rl_dclass1.

  2. Configure the policer template police_class1.

  3. Configure a filter term that uses policer police_class1 to rate-limit traffic for destination class class1.

Apply the Stateless Firewall Filter to a Logical Interface

Step-by-Step Procedure

To apply the filter rl_dclass1 to a logical interface:

  1. Configure the logical interface to which you will apply the stateless firewall filter.

  2. Configure the interface address for the logical interface.

  3. Apply the stateless firewall filter to the logical interface.

Confirm and Commit Your Candidate Configuration

Step-by-Step Procedure

To confirm and then commit your candidate configuration:

  1. Confirm the configuration of the stateless firewall filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

  2. Confirm the configuration of the interface by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

  3. If you are done configuring the device, commit your candidate configuration.

Verification

To confirm that the configuration is working properly, enter the show class-of-service ge-0/0/1 operational mode command.