Contents
Index

- JunosE 11.2.x Policy Management Configuration Guide
  - Copyright and Trademark Information
  - Table of Contents
  - List of Figures
  - List of Tables
  - About the Documentation
    - E Series and JunosE Documentation and Release Notes
    - Audience
    - E Series and JunosE Text and Syntax Conventions
    - Obtaining Documentation
    - Documentation Feedback
    - Requesting Technical Support
  - Policy Management
    - Managing Policies on the E Series Router
      - Policy Management Overview
      - Description of a Policy
      - Policy Platform Considerations
      - Policy References
      - Policy Management Configuration Tasks
    - Creating Classifier Control Lists for Policies
      - Classifier Control Lists Overview
      - Creating or Modifying Classifier Control Lists for ATM Policy Lists
      - Creating or Modifying Classifier Control Lists for Frame-Relay Policy Lists
      - Creating or Modifying Classifier Control Lists for GRE Tunnel Policy Lists
      - Creating or Modifying Classifier Control Lists for IP Policy Lists
        - Creating Classifier Control List for Only IP Policy Lists
        - Setting Up an IP Classifier Control List to Accept Traffic from All Sources
        - Classifying IP Traffic Based on Source and Destination Addresses
        - Using IP Classifier Control Lists to Match Route Class Values
        - Creating IP Classifier Control Lists for TCP and UDP Ports
        - Creating an IP Classifier Control List That Matches the ToS Byte
        - Creating an IP Classifier Control List That Filters ICMP Echo Requests
        - Creating IP Classifier Control Lists That Use TCP or IP Flags
        - Creating IP Classifier Control Lists That Match the IP Fragmentation Offset
      - Creating or Modifying Classifier Control Lists for IPv6 Policy Lists
      - Creating or Modifying Classifier Control Lists for L2TP Policy Lists
      - Creating or Modifying Classifier Control Lists for MPLS Policy Lists
      - Creating or Modifying Classifier Control Lists for VLAN Policy Lists
    - Creating Policy Lists
      - Policy Lists Overview
      - Creating Policy Lists for ATM
      - Creating Policy Lists for Frame Relay
      - Creating Policy Lists for GRE Tunnels
      - Creating Policy Lists for IP
      - Creating Policy Lists for IPv6
      - Creating Policy Lists for L2TP
      - Creating Policy Lists for MPLS
      - Creating Policy Lists for VLANs
    - Creating Classifier Groups and Policy Rules
      - Classifier Groups and Policy Rules Overview
      - Policy Rule Precedence
      - Using Policy Rules to Provide Routing Solutions
      - Configuring Policies to Provide Network Security
      - Creating an Exception Rule within a Policy Classifier Group
      - Defining Policy Rules for Forwarding
      - Assigning Values to the ATM CLP Bit
      - Enabling ATM Cell Mode
      - Enabling IP Options Filtering
      - Packet Tagging Overview
      - Creating Multiple Forwarding Solutions with IP Policy Lists
      - Creating a Classifier Group for a Policy List
      - Applying Policy Lists to Interfaces and Profiles Overview
      - Using RADIUS to Create and Apply Policies Overview
        - Construction of IPv6 Classifiers from the Hexadecimal Ascend-Data-Filter Attribute
        - Ascend-Data-Filter Attribute for IPv4/IPv6 Subscribers in a Dual Stack
      - Examples: Using the Ascend-Data-Filter Attribute for IPv4 Subscribers
      - Examples: Using the Ascend-Data-Filter Attribute for IPv6 Subscribers
    - Creating Rate-Limit Profiles
      - Rate Limits for Interfaces Overview
      - Hierarchical Rate Limits Overview
        - Hierarchical Classifier Groups
        - Hierarchical Rate-Limit Profiles
        - Hierarchical Rate-Limit Actions
        - Example: Multiple Flows Sharing Preferred Bandwidth Rate-Limiting Hierarchical Policy
        - Example: Multiple Flows Sharing a Rate Limit Hierarchical Policy
        - Example: Shared Pool of Additional Bandwidth with Select Flows Rate-Limiting Hierarchical Policy
        - Example: Aggregate Marking with Oversubscription Rate-Limiting Hierarchical Policy
        - Color-Aware Configuration for Rate-Limiting Hierarchical Policy
      - Percent-Based Rates for Rate-Limit Profiles Overview
        - Policy Parameter Reference-Rate
        - Specifying Rates Within Rate-Limit Profiles
        - Specifying Burst Sizes
        - Using Service Manager with Merged Policies
        - Policy Parameter Configuration Considerations
      - Policy Parameter Quick Configuration
      - Creating Rate-Limit Profiles
      - One-Rate Rate-Limit Profiles Overview
      - Creating a One-Rate Rate-Limit Profile
      - Configuring a TCP-Friendly One-Rate Rate-Limit Profile
      - Two-Rate Rate-Limits Overview
      - Creating a Two-Rate Rate-Limit Profile
      - Setting the Committed Action for a Rate-Limit Profile
      - Setting the Committed Burst for a Rate-Limit Profile
      - Setting the Committed Rate for a Rate-Limit Profile
      - Setting the Conformed Action for a Rate-Limit Profile
      - Setting the Exceeded Action for a Rate-Limit Profile
      - Setting the Excess Burst for a Rate-Limit Profile
      - Setting the Mask Value for MPLS Rate-Limit Profiles
      - Setting the Mask Value for IP and IPv6 Rate-Limit Profiles
      - Setting the Peak Burst for Two-Rate Rate-Limit Profiles
      - Setting the Peak Rate for Rate-Limit Profiles
      - Setting a One-Rate Rate-Limit Profile
      - Setting a Two-Rate Rate-Limit-Profile
      - Bandwidth Management Overview
        - Examples: One-Rate Rate-Limit Profile
        - Examples: Two-Rate Rate-Limit Profile
        - Examples: Rate-Limiting Individual or Aggregate Packet Flows
      - Rate-Limiting Traffic Flows
    - Merging Policies
      - Merging Policies Overview
      - Resolving Policy Merge Conflicts
      - Merged Policy Naming Conventions
      - Reference Counting for Merged Policies
      - Persistent Configuration Differences for Merged Policies Through Service Manager
      - Policy Attachment Sequence at Login Through Service Manager
      - Policy Attachment Rules for Merged Policies
      - Error Conditions for Merged Policies
      - Merging Policies Configuration
      - Parent Group Merge Algorithm
      - Overlapping Classification for IP Input Policy
        - Starting Policy Processing
        - Processing the Classifier Result
        - Processing the Auxiliary-Input Policy Attachment
        - Policy Actions
    - Creating Hierarchical Policies for Interface Groups
      - Hierarchical Policies for Interface Groups Overview
      - External Parent Groups
      - Example: Configuring Hierarchical Policy Parameters
      - Hierarchical Aggregation Nodes
      - RADIUS and Profile Configuration for Hierarchical Policies
      - Applying a Profile to Interfaces with Service Manager
      - Hierarchical Policy Configuration Considerations
      - Example: Hierarchical Policy Quick Configuration
      - Example: Configuring Hierarchical Policies
      - Example: VLAN Rate Limit Hierarchical Policy for Interface Groups Configuration
      - Example: Wholesale L2TP Model Hierarchical Policy Configuration
      - Example: Aggregate Rate Limit for All Nonvoice Traffic Hierarchical Policy Configuration
      - Example: Arbitrary Interface Groups Hierarchical Policy Configuration
      - Example: Service and User Rate-Limit Hierarchy Overlap Hierarchical Policy Configuration
      - Example: Percentage-Based Hierarchical Rate-Limit Profile for External Parent Group
      - Example: PPP Interfaces Hierarchical Policy Configuration
    - Policy Resources
      - Policy Resources Overview
      - FPGA Hardware Classifiers
      - CAM Hardware Classifiers Overview
      - Size Limit for IP and IPv6 CAM Hardware Classifiers
        - IP Classifiers and Size Limits
        - IPv6 Classifiers and Size Limits
      - Creating and Attaching a Policy with IP Classifiers
      - Variable-Sized CAM Classification for IPv6 Policies Examples
        - 144-bit IPv6 Classification Example
        - 288-bit IPv6 Classification Example
        - 576-bit IPv6 Classification Example
      - Performance Impact and Scalability Considerations
        - Performance Impact
        - Scalability Considerations
          - CAM Device Block Size and CAM Entry Allocation
          - Number of CAM Entries Per Allocation and Free Entries
      - Software Classifiers Overview
      - Interface Attachment Resources Overview
      - CAM Hardware Classifiers and Interface Attachment Resources
      - Range Vector Hardware Classifiers and Interface Attachment Resources
    - Monitoring Policy Management
      - Monitoring Policy Management Overview
      - Setting a Statistics Baseline for Policies
      - Monitoring the Policy Configuration of ATM Subinterfaces
      - Monitoring Classifier Control Lists
      - Monitoring Color-Mark Profiles
      - Monitoring Control Plane Policer Information
      - Monitoring the Policy Configuration of Frame Relay Subinterfaces
      - Monitoring GRE Tunnel Information
      - Monitoring Interfaces and Policy Lists
      - Monitoring the Policy Configuration of IP Interfaces
      - Monitoring the Policy Configuration of IPv6 Interfaces
      - Monitoring the Policy Configuration of Layer 2 Services over MPLS
      - Monitoring External Parent Groups
      - Monitoring Policy Lists
      - Monitoring Policy List Parameters
      - Monitoring Rate-Limit Profiles
      - Monitoring the Policy Configuration of VLAN Subinterfaces
      - Packet Flow Monitoring Overview
  - Packet Mirroring
    - Packet Mirroring Overview
      - Packet Mirroring Overview
      - Comparing CLI-Based Mirroring and RADIUS-Based Mirroring
        - Configuration
        - Security
        - Application
      - Packet-Mirroring Terms
      - Packet Mirroring Platform Considerations
      - Packet Mirroring References
    - Configuring CLI-Based Packet Mirroring
      - CLI-Based Packet Mirroring Overview
      - Enabling and Securing CLI-Based Packet Mirroring
      - Reloading a CLI-Based Packet-Mirroring Configuration
      - Using TACACS+ and Vty Access Lists to Secure Packet Mirroring
      - Using Vty Access Lists to Secure Packet Mirroring
      - CLI-Based Packet Mirroring Sequence of Events
      - Configuring CLI-Based Mirroring
      - Configuring Triggers for CLI-Based Mirroring
      - Configuring the Analyzer Device
      - Configuring the E Series Router
      - Example: Configuring CLI-Based Interface-Specific Mirroring
      - Example: Configuring CLI-Based User-Specific Mirroring
    - Configuring RADIUS-Based Mirroring
      - RADIUS-Based Mirroring Overview
      - RADIUS Attributes Used for Packet Mirroring
      - RADIUS-Based Packet Mirroring Dynamically Created Secure Policies
      - RADIUS-Based Packet Mirroring MLPPP Sessions
      - RADIUS-Based Mirroring Sequence of Events
      - Configuring Router to Start Mirroring When User Logs On
      - Configuring Router to Mirror Users Already Logged In
    - Managing Packet Mirroring
      - Avoiding Conflicts Between Multiple Packet Mirroring Configurations
      - Understanding the Prepended Header During a Packet Mirroring Session
        - Format of the Mirror Header Attributes
          - 8-Byte Format
          - 4-Byte Format
      - Resolving and Tracking the Analyzer Device’s Address
      - Using Multiple Triggers for CLI-Based Packet Mirroring
      - Optimizing Packet Mirroring Performance
        - Determine Traffic Loads
        - Establish Resource Guidelines
      - Logging Packet Mirroring Information
      - Using SNMP Secure Packet Mirroring Traps
        - Additional Packet-Mirroring Traps for CALEA Compliance
        - Packet Mirroring Trap Severity Levels
      - Configuring SNMP Secure Packet Mirroring Traps
      - Capturing SNMP Secure Audit Logs
    - Monitoring Packet Mirroring
      - Monitoring Packet Mirroring Overview
      - Monitoring CLI-Based Packet Mirroring
      - Monitoring the Packet Mirroring Configuration of IP Interfaces
      - Monitoring Failure Messages for Secure Policies
      - Monitoring Packet Mirroring Triggers
      - Monitoring Packet Mirroring Subscriber Information
      - Monitoring RADIUS Dynamic-Request Server Information
      - Monitoring Secure CLACL Configurations
      - Monitoring Secure Policy Lists
      - Monitoring Information for Secure Policies
      - Monitoring SNMP Secure Packet Mirroring Traps
      - Monitoring SNMP Secure Audit Logs
  - Index
    - Index

Symbols A B C D E F G H I M N O P R S T V

Symbols

> 144–bit CAM entries
>   example of IPv6 classifiers in a policy
>     supported by CAM classifiers 1
> 288–bit CAM entries
>   example of IPv6 classifiers in a policy
>     supported by CAM classifiers 1
> 576–bit CAM entries
>   example of IPv6 classifiers in a policy
>     supported by CAM classifiers 1

A

> access level
>   mirror-enable command 1
>   packet mirroring 1
> analyzer interfaces
>   interface types 1
> atm commands
>   atm-cell-mode 1, 2
> attachment of IPv6 policies
>   to an interface
>     with CAM entries greater than 128 bits 1
> audit logging, SNMP secure 1, 2

B

> bandwidth management 1
> baseline commands
>   baseline radius dynamic-request 1

C

> CAM blocks
>   containing equal-sized CAM entries 1
>   support for variable-sized entries
>     1
>   utilization for CAM entries
>     in an IPv4 policy, example 1
>     in an IPv6 policy, example 1
> CAM device block size
>   division to hold CAM entries
>     example 1
> CAM entries
>   configured on line moduels
>     calculation of CAM bit size 1
>   division into blocks to store policies
>     example for GE-2 LMs 1
>   number per allocation
>     formula for scaling limits on GE-2 LMs 1
>     formula for scaling limits on GE-HDE LMs 1
>   obtaining length dynamically, three types
>     between 128 and 272 bits 1
>     between 272 and 336 bits 1
>     less than 128 bits 1
>   using the optimum size
>     for IPv6 policies 1
> CAM hardware classifiers
>   three types of CAM entries supported
>     on line modules of E Series Broadband Services Routers 1
>   variables-sized entries
>     for IPv6 policies 1
> CAM resources
>   and variable-sized CAM entries
>     factors used to determine availability 1
> classifier
>   CAM hardware 1, 2, 3
>   consumption 1
>   FPGA hardware 1, 2, 3
>   hardware 1, 2
>   line module support 1, 2, 3
>   policy consumption 1, 2
>   software 1, 2, 3
> classifier control list
>   criteria defined 1
>   matching IP flags 1
>   matching IP fragmentation offset 1
>   matching TCP flags 1
>   multiple elements in 1
> classifier groups
>   creating 1
> classifier-group commands
>   classifier-group 1
> color-aware configuration 1
> committed-action command 1
> committed-burst command 1
> conventions
>   notice icons 1
>   text and syntax 1
> customer support 1
>   contacting JTAC 1

D

> default classifier
>   allocation of CAM blocks
>     determined by the CAM entry size 1
>   consumption of CAM blocks
>     same as the size computed for the policy 1
> documentation set
>   comments on 1

E

> E320 routers
>   Ethernet interfaces 1
> exceeded-action command 1
> excess-burst command 1
> exp-mask command 1
> explicit packet coloring 1

F

> forward command 1, 2
> forward interface command 1
> forward next-hop command 1
> fragmentation offsets, filtering 1

G

> GE-2 line modules
>   formula for scaling numbers of
>     CAM entries 1
> GE-HDE line modules
>   formula for scaling limits
>     CAM entries 1

H

> hierarchical aggregation nodes 1
> hierarchical policing for interface groups 1

I

> interface mirroring
>   supported modules 1
> IP auxiliary input policy 1, 2
> ip commands
>   ip classifier-list 1
>   ipv6 classifier-list 1
> IP fragmentation
>   offset, matching in a policy 1
> IP options, filtering 1
> IP policies
>   scalability improvement for
>     using optimum CAM entry size 1
> IPv4 classifier
>   number of bits consumed
>     for CAM entries 1
> IPv6 classification
>   144–bit CAM entries
>     active classifiers in the example and size of each 1
>     example for a policy attachment 1
>   288–bit CAM entries
>     active classifiers in the example and size of each 1
>     example for a policy attachment 1
>   576–bit CAM entries
>     active classifiers in the example and size of each 1
>     example for a policy attachment 1
>     number of lookups to the CAM hardware 1
>   determination of fields in the classifier
>     using policy definition 1
>   minimum and maximum entry sizes
>     for IPv6 header CAM entries 1
>   support for traffic greater than 128 bits
>     1
>   variable-sized CAM entries
>     and available CAM resources 1
>     maximum policies supported with four classifier per policy 1
>     maximum policies supported with one classifier per policy 1
>     performance impact 1
> IPv6 classifier See IPv6 classification
> IPv6 policies
>   with four classifiers per policy
>     maximum supported with variable-sized CAM entries 1
>   with one classifier per policy
>     maximum supported with variable-sized CAM entries 1
> IPv6 policy definition
>   sum of classification fields in the
>     and variable-sized CAM entries 1

M

> manuals
>   comments on 1
> mark rule
>   with rate-limit rule 1
> mark-exp command 1, 2
> merged policy naming conventions 1
> merging policies 1
>   configuration example 1
>   error conditions 1
>   naming conventions 1
>   persistent configuration differences 1
>   policy attachment rules 1
>   policy attachment sequence 1
>   reference counting 1
>   resolving conflicts 1
>   restrictions 1
>   rules for attachment 1
> mirror-enable command
>   access level 1
>   and TACACS+ 1
> MTU (maximum transmission unit)
>   IP 1, 2
> multiple forwarding solutions 1

N

> notice icons 1

O

> one-rate rate-limit profile 1
> overlapping classification 1, 2

P

> packet coloring, explicit 1
> packet flow monitoring 1
> packet mirroring
>   access level 1
>   analyzer device 1
>   CLI-based 1, 2
>   configuration conflicts 1
>   configuring traps 1
>   interface-specific 1
>   ip analyzer interface 1
>   mediation device 1
>   multiple configurations 1
>   RADIUS-based 1
>   secure audit logging 1, 2
>   secure local logs 1
>   secure logging 1
>   secure SNMP traps 1
>   securing with TACACS+ 1
>   SNMP secure traps 1
>   system resources 1
>   terms 1
>   trigger 1
>   triggers for CLI-based 1
>   user-specific 1
> packet tagging 1
> parent group merge algorithm 1
> peak-burst command 1
> peak-rate command 1
> percent-based rates 1
> platform considerations
>   packet mirroring 1
> policies
>   using RADIUS to create
>     overview 1
> policy attachment rules 1
> policy list
>   constructing a 1
>   creating or modifying 1
> policy lists
>   applying
>     overview 1
> policy management
>   applications
>     packet tagging 1
>   bandwidth management 1
>   baselining statistics 1
>   classifier groups, creating 1
>   classifier resources 1
>   committed burst calculation 1, 2
>   congestion management 1
>   creating a one-rate rate-limit profile 1
>   creating a two-rate rate-limit profile 1
>   explicit packet coloring 1
>   filtering fragmentation offsets 1
>   filtering IP options 1
>   matching IP flags in a CLACL 1
>   matching IP fragmentation offset in a CLACL 1
>   matching TCP flags in a CLACL 1
>   merging policies 1
>   modifying a one-rate rate-limit profile 1
>   modifying a two-rate rate-limit profile 1
>   monitoring packet flow 1, 2
>   one-rate rate-limit profile 1
>   overview 1
>   packet logging 1
>   packet mirroring 1
>   packet tagging 1, 2, 3
>   policy actions and rate-limit profiles 1
>   policy routing 1
>   policy rules, creating 1
>   QoS classification and marking 1
>   RADIUS support 1
>   rate limiting traffic flows 1
>   rate-limit profile actions 1
>   rate-limit profile attributes 1
>   rate-limit profile calculations 1
>   rate-limit profile defaults 1, 2
>   resources 1
>   security 1
> policy management configuration tasks 1
> policy parameter
>   considerations 1
>   quick configuration 1
>   reference-rate 1
> policy rule commands
>   forward 1
>   forward interface 1
>   forward next-hop 1
> policy rules
>   creating 1
>   precedence 1
>   supported commands 1

R

> rate limiting
>   aggregate traffic flows 1
>   for interfaces 1
>   hierarchical 1
>   individual traffic flows 1
> rate-limit hierarchies 1
>   classifier groups 1
>   color-aware configuration 1
>   rate-limit actions 1
>   rate-limit profiles 1
>   rate-limit rules 1
> rate-limit profiles
>   attributes 1
>   burst size 1
>   calculations 1
>   configuration procedure 1
>   creating 1, 2
>   default values 1, 2
>   modifying 1, 2
>   percent-based rates 1
>   policy actions 1
>   rates 1
> rate-limit rule
>   with mark rule 1
> rate-limit-profile one-rate command 1
> rate-limit-profile two-rate command 1
> rate-limiting SRP traffic flows 1
> resolving merge conflicts 1

S

> secure audit logging for packet mirroring 1, 2
> secure policy-list command 1
> Service Manager
>   merging policies 1
> show commands
>   show color-mark-profile 1
>   show control-plane policer 1
>   show frame-relay subinterface 1
>   show gre tunnel 1
>   show interfaces 1
>   show ipv6 interface 1
>   show parent-group 1, 2, 3, 4, 5
>   show policy-parameter 1
>   show rate-limit-profile 1
>   show secure classifier-list 1
>   show vlan subinterfaces 1, 2
> show ip commands
>   show ip interface 1, 2
>   show ip mirror interface 1
> show mirror commands
>   show mirror log 1, 2
>   show mirror rules 1
>   show mirror subscribers 1
> show radius commands
>   show radius servers 1
>   show radius statistics 1
> show secure policy-list command 1
> show snmp commands
>   show snmp secure-log 1
>   show snmp trap 1
> single-rate rate limit profile 1
> SNMP (Simple Network Management Protocol)
>   secure audit logs 1, 2
> SNMP traps 1
>   secure logs 1
> support, technical See technical support

T

> TCP-friendly one-rate rate-limit profile 1
> technical support
>   contacting JTAC 1
> text and syntax conventions 1
> traffic-class command 1
> traps, SNMP
>   status information 1
> two-rate rate-limit profile 1

V

> variable length IPv6 classifiers
>   examples of
>     supported CAM entries 1
> variable-sized CAM entries
>   144–bit size
>     active classifiers in the example policy 1
>     creation and attachment of an IPv6 policy, example 1
>     size of each classifier in the IPv6 policy example 1
>   288–bit size
>     active classifiers in the example policy 1
>     creation and attachment of an IPv6 policy, example 1
>     size of each classifier in the IPv6 policy example 1
>   576–bit size
>     active classifiers in the example policy 1
>     creation and attachment of an IPv6 policy, example 1
>     size of each classifier in the IPv6 policy example 1
>   factors to determine
>     available CAM resources 1
>   for IPv6 classification
>     supported bit sizes 1
>   maximum IPv6 policies supported
>     with four classifiers per policy 1
>     with one classifier per policy 1
>   performance impact
>     caused by CAM addressing 1