Technical Documentation

Applying Interface Policers

In addition to including policers in firewall filters, you can apply an interface policer that is not part of a firewall filter configuration. An interface policer can be applied to each family on an interface.

To apply an interface policer, include the policer statement at the [edit interfaces interface-name unit logical-unit-number family family-name] hierarchy level:

[edit interfaces interface-name unit logical-unit-number family family-name]policer {input policer-name;output policer-name;}

You must first configure the policer at the [edit firewall] hierarchy level before you can apply it to an interface. Both input and output policers are allowed, and can be used in conjunction with existing firewall filters. Input interface policers are evaluated before any input firewall filters. Likewise, output interface policers are evaluated after any output firewall filters (see Order of Policer and Firewall Filter Operations).

To display a policer on a particular interface, issue the show interfaces policers command at the command-line interface (CLI).

Note: This type of policer can only be applied to unicast packets. For information on configuring a filter for flooded traffic, see Applying Filters to Forwarding Tables.

Example: Applying an Interface Policer

Apply a policer on circuit cross-connect (CCC) interfaces:

[edit interfaces]so-0/0/0 {encapsulation ppp-ccc;unit 0 {family ccc {policer {input dragnet;}}}}

Related Topics


Published: 2010-07-16

Help
|
My Account
|
Log Out