Example: Configuring a Physical Interface Policer for Aggregate Traffic at a Physical Interface

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

A physical interface policer specifies rate-limiting for aggregate traffic, which encompasses all protocol families and logical interfaces configured on a physical interface, even if the interfaces belong to different routing instances.

You can apply a physical interface policer to Layer 3 input or output traffic only by referencing the policer from a stateless firewall filter that is configured for specific a specific protocol family (not for family any) and configured as a physical interface filter. You configure the filter terms with match conditions that select the types of packets you want to rate-limit, and you specify the physical interface policer as the action to apply to matched packets.

Topology

The physical interface policer in this example, shared-policer-A, rate-limits to 10,000,000 bps and permits a maximum burst of traffic of 500,000 bytes. You configure the policer to discard packets in nonconforming flows, but you could instead configure the policer to re-mark nonconforming traffic with a forwarding class, a packet loss priority (PLP) level, or both.

• Packets received through TCP and with the IP precedence fields critical-ecp (0xa0), immediate (0x40), or priority (0x20)
• Packets received through TCP and with the IP precedence fields internet-control (0xc0) or routine (0x00)

You could also reference the policer from physical interface filters for other protocol families.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

• Configuring the Logical Interfaces on the Physical Interface
• Configuring a Physical Interface Policer
• Configuring an IPv4 Physical Interface Filter
• Applying the IPv4 Physical interface Filter to a Physical Interface

CLI Quick Configuration

Configuring the Logical Interfaces on the Physical Interface

Step-by-Step Procedure

1. Enable configuration of logical interfaces.

   [edit]user@host# edit interfaces so-1/0/0

2. Configure protocol families on logical unit 0.

   [edit interfaces so-1/0/0]user@host# set unit 0 family inet address 192.168.1.1/24user@host# set unit 0 family vpls

3. Configure protocol families on logical unit 1.

   [edit interfaces so-1/0/0]user@host# set unit 1 family mpls

Results

Configuring a Physical Interface Policer

Step-by-Step Procedure

1. Enable configuration of the two-color policer.

   [edit]user@host# edit firewall policer shared-policer-A

2. Configure the type of two-color policer.

   [edit firewall policer shared-policer-A]user@host# set physical-interface-policer

3. Configure the traffic limits and the action for packets in a nonconforming traffic flow.

   [edit firewall policer shared-policer-A]user@host# set if-exceeding bandwidth-limit 100m burst-size-limit 500kuser@host# set then discard
   For a physical interface filter, the actions you can configure for packets in a nonconforming traffic flow are to discard the packets, assign a forwarding class, assign a PLP value, or assign both a forwarding class and a PLP value.

Results

Configuring an IPv4 Physical Interface Filter

Step-by-Step Procedure

1. Configure a standard stateless firewall filter under a specific protocol family.

   [edit]user@host# edit firewall family inet filter ipv4-filter
   You cannot configure a physical interface firewall filter for family any.

2. Configure the filter as a physical interface filter so that you can apply the physical interface policer as an action.

   [edit firewall family inet filter ipv4-filter]user@host# set physical-interface-filter

3. Configure the first term to match IPv4 packets received through TCP with the IP precedence fields critical-ecp, immediate, or priority and to apply the physical interface policer as a filter action.

   [edit firewall family inet filter ipv4-filter]user@host# set term tcp-police-1 from precedence [ critical-ecp immediate priority ]user@host# set term tcp-police-1 from protocol tcpuser@host# set term tcp-police-1 then policer shared-policer-A

4. Configure the first term to match IPv4 packets received through TCP with the IP precedence fields internet-control or routine and to apply the physical interface policer as a filter action.

   [edit firewall family inet filter ipv4-filter]user@host# set term tcp-police-2 from precedence [ internet-control routine ]user@host# set term tcp-police-2 from protocol tcpuser@host# set term tcp-police-2 then policer shared-policer-A

Results

Applying the IPv4 Physical interface Filter to a Physical Interface

Step-by-Step Procedure

1. Enable configuration of IPv4 on the logical interface.

   [edit]user@host# edit interfaces so-1/0/0 unit 0 family inet

2. Apply the IPv4 physical interface filter in the input direction.

   [edit interfaces so-1/0/0 unit 0 family inet]user@host# set filter input ipv4-filter

Results

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

• Displaying the Firewall Filters Applied to an Interface
• Displaying the Number of Packets Processed by the Policer at the Logical Interface

Displaying the Firewall Filters Applied to an Interface

Purpose

Verify that the firewall filter ipv4-filter is applied to the IPv4 input traffic at logical interface so-1/0/0.0.

Action

Use the show interfaces statistics operational mode command for logical interface so-1/0/0.0, and include the detail option. In the Protocol inet section of the command output, the Input Filters field shows that the firewall filter ipv4-filter is applied in the input direction.

  Logical interface so-1/0/0.0 (Index 79) (SNMP ifIndex 510) (Generation 149)
    Flags: Hardware-Down Point-To-Point SNMP-Traps 0x4000 Encapsulation: PPP
    Protocol inet, MTU: 4470, Generation: 173, Route table: 0
      Flags: Sendbcast-pkt-to-re, Protocol-Down
      Input Filters: ipv4-filter
      Addresses, Flags: Dest-route-down Is-Preferred Is-Primary
        Destination: 10.39/16, Local: 10.39.1.1, Broadcast: 10.39.255.255, Generation: 163

Displaying the Number of Packets Processed by the Policer at the Logical Interface

Purpose

Verify the traffic flow through the logical interface and that the policer is evaluated when packets are received on the logical interface.

Action

Use the show firewall operational mode command for the filter you applied to the logical interface.

Filter: ipv4-filter                                          
Policers:
Name                                              Packets 
shared-policer-A-tcp-police-1                       32863
shared-policer-A-tcp-police-2                        3870

The command output displays the name of policer (shared-policer-A), the name of the filter term (police-1) under which the policer action is specified, and the number of packets that matched the filter term. This is only the number of out-of-specification (out-of-spec) packet counts, not all packets policed by the policer.