Technical Documentation

Configuring Aggregate Policers

You can configure a single aggregated policer to limit traffic on the same interface without the use of multiple instances of the same policer. Instead of policing each address family individually on an interface, you can aggregate policing with one policer. This single aggregated policer is also known as the logical interface policer.

To configure a logical interface policer, include the logical-interface-policer statement at the [edit firewall policer policer-name] hierarchy level:

You can configure rate limiting on the logical interface policer. For information about rate limiting, see Rate Limiting. You can configure a policer action for the logical interface policer. For information about policy actions, see Policer Actions.

After configuring the aggregated logical interface policer, you can apply the policer to an interface. To apply an aggregated logical interface policer, include the policer policer-name option at the [edit interfaces interface-name unit 0 family family-name] hierarchy level:

policer policer-name;

For more information about applying policers, see the Junos Class of Service Configuration Guide.

Example: Configuring an Aggregate Policer

Configure an aggregate policer to perform rating limiting:

[edit firewall policer new-police1]if-exceeding {bandwidth-limit 100m;burst-size-limit 500k;}logical-interface-policer;then {discard;}

Apply the aggregate policer to rate-limit IPv4 and IPv6 traffic on interface fe-0/1/1:

[edit interfaces fe-0/1/1 unit 0 family inet]policer new-police1;[edit interfaces fe-0/1/1 unit 0 family inet6]policer new-police1;

Related Topics


Published: 2010-08-05

Help
|
My Account
|
Log Out