Example: Configuring a Single-Rate Three-Color Policer on a Security Device

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

• Nonconforming traffic that does not exceed the burst size for excess traffic is categorized as yellow.

• Nonconforming traffic that exceeds the burst size for excess traffic is categorized as red.

Each category is associated with an action. For green traffic, packets are implicitly set with a loss-priority value of low and then transmitted. For yellow traffic, packets are implicitly set with a loss-priority value of medium-high and then transmitted. For red traffic, packets are implicitly set with a loss-priority value of high and then transmitted. If the policer configuration includes the optional action statement (action loss-priority high then discard), then packets in a red flow are discarded instead.

You can apply a three-color policer to Layer 3 traffic as a firewall filter policer only. You reference the policer from a stateless firewall filter term, and then you apply the filter to the input or output of a logical interface at the protocol level.

Topology

In this example, you apply a color-aware, single-rate three-color policer to the input IPv4 traffic at IRB interface. The IPv4 firewall filter term that references the policer does not apply any packet-filtering. The filter is used only to apply the three-color policer to the interface.

You configure the policer to rate-limit traffic to a bandwidth limit of 40 Mbps and a burst-size limit of 100 KB for green traffic, but also allow an excess burst-size limit of 200 KB for yellow traffic. Only nonconforming traffic that exceeds the peak burst-size limit is categorized as red. In this example, you configure the three-color policer action loss-priority high then discard, which overrides the implicit marking of red traffic to a high loss priority.

Configuration

• Configuring a Single-Rate Three-Color Policer

• Applying the Filter to the Logical Interface

CLI Quick Configuration

Configuring a Single-Rate Three-Color Policer

Step-by-Step Procedure

1. Enable configuration of a three-color policer.

2. Configure the color mode of the single-rate three-color policer.

3. Configure the single-rate guaranteed traffic limits.

4. Configure the single-rate burst-size limit that is used to classify nonconforming traffic.

5. (Optional) Configure the action for nonconforming traffic.

   For three-color policers, the only configurable action is to discard packets in a red traffic flow. In this example, packets in a red traffic flow have been implicitly marked with a high packet loss priority (PLP) level because the traffic flow exceeded the rate-limiting defined by the single rate-limit (specified by the committed-information-rate 40m statement) and the larger burst-size limit (specified by the excess-burst-size 200k statement). Because the optional action statement is included, this example takes the more severe action of discarding packets in a red traffic flow.

Results

Applying the Filter to the Logical Interface

Step-by-Step Procedure

1. Enable configuration of the IRB interface.

2. Configure an IP address.

3. Reference the filter as an input filter.

Results

If you are done configuring the device, enter commit from configuration mode.

Verification

Displaying the Firewall Filters Applied to the IRB Interface

Purpose

Verify that the firewall filter is applied to the IRB interface.

Action

Use the show interfaces operational mode command for the logical interface ge-2/0/5.0, and specify detail mode. The Protocol inet section of the command output displays information for the IRB interface.

Meaning

The firewall filter is applied to the IRB interface as expected.