Configuring Actions
Actions define the action taken on packets that match conditions in a policy rule. You create actions within policy rules.
Topics that discuss how to configure the action include:
Configuring Color Actions (SRC CLI)
You can configure color actions for JunosE policy rules. The type of action that you can create depends on the type of policy rule.
Use the following configuration statements to configure color actions:
To configure a color action:
From configuration mode, enter the color action configuration.
user@host# edit policies group junose_filter list in rule pr color(Optional) Configure the color that is applied to a packet when it passes through the router.
[edit policies group junose_filter list in rule pr color]user@host# set color color(Optional) Enter a description for the color action.
[edit policies group junose_filter list in rule pr color]user@host# set description description(Optional) Verify the color action configuration.
[edit policies group junose_filter list in rule pr color] user@host# show color green; description "Color action for JunosE IPv6 policies";
Configuring Color Mark Actions (SRC CLI)
You can configure color-mark actions to apply a TOS mark value based on the packet’s color. A color-mark can be applied to a packet after it exits a rate-limit hierarchy.
The type of action that you can create depends on the type policy rule. See Policy Information Model.
Use the following configuration statements to configure color actions:
To configure a color mark action:
From configuration mode, enter the color mark action configuration.
[edit]user@host# edit policies group junose_filter list in rule pr color-mark(Optional) Specify the green-mark value.
[edit policies group junose_filter list in rule pr color-mark]user@host# set green-mark green-mark(Optional) Specify the yellow-mark value.
[edit policies group junose_filter list in rule pr color-mark]user@host# set yellow-mark yellow-mark(Optional) Specify the red-mark value.
[edit policies group junose_filter list in rule pr color-mark]user@host# set red-mark red-markSpecify the mask value to use when marking packets.
[edit policies group junose_filter list in rule pr color-mark]user@host# set mask mask(Optional) Enter a description for the color mark action.
[edit policies group junose_filter list in rule pr color-mark]user@host# set description description(Optional) Verify the color action mark configuration.
[edit policies group junose_filter list in rule pr color-mark] user@host# show description mark green packets; green-mark 100; mask 255;
Configuring DOCSIS Actions (SRC CLI)
You can configure Data over Cable Service Interface Specifications (DOCSIS) actions for PacketCable Multimedia Specification (PCMM) policy rules. The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure DOCSIS actions. Use the configuration statement for the service flow scheduling type that you want to use for the DOCSIS action. The types are best effort, downstream, non-real-time polling service, real-time polling service, unsolicited grant service, unsolicited grant service with activity detection, or parameter.
To configure a DOCSIS action:
From configuration mode, enter the DOCSIS action configuration. In this procedure, the parameter action is configured as an example.
user@host# edit policies group pcmm list DocsisParameter rule in docsis-paramAssign a parameter as the service flow scheduling type.
Before you assign a parameter, you must create a parameter of type trafficProfileType and commit the parameter configuration.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set service-flow-type service-flow-type(Optional) Configure a priority for the service flow. If two traffic flows are identical in all QoS parameters except priority, the higher-priority service flow is given preference.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set traffic-priority traffic-priority(Optional) Configure the request transmission policy, which is the interval usage code that the cable modem uses for upstream transmission requests and packet transmissions for this service flow. It also specifies whether requests can be piggybacked with data.
For data packets transmitted on this service flow, this option also specifies whether packets can be concatenated, fragmented, or have their payload headers suppressed.
For UGS service flows, this option also specifies how to treat packets that do not fit into the UGS grant.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set request-transmission-policy request-transmission-policy
(Optional) Configure the maximum sustained rate at which traffic can operate over the service flow.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set maximum-sustained-rate maximum-sustained-rate(Optional) Configure the maximum burst size for the service flow. This option has no effect unless you configure a nonzero value for the maximum sustained rate.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set maximum-traffic-burst maximum-traffic-burst(Optional) Configure the guaranteed minimum rate that is reserved for the service flow.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set minimum-reserved-rate minimum-reserved-rate(Optional) Configure the assumed minimum packet size for which the minimum reserved traffic rate is provided. If a packet is smaller than the assumed minimum packet size, the software treats the packet as if its size is equal to the value specified in this option.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set assumed-minimum-res-packet-size assumed-minimum-res-packet-size(Optional) Configure the maximum latency for downstream service flows. It is the maximum latency for a packet that passes through the CMTS device, from the time that the CMTS device’s network side interface receives the packet until the CMTS device forwards the packet on its radio frequency (RF) interface.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set maximum-latency maximum-latency(Optional) Configure the nominal interval between successive unicast request opportunities for this service flow.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set nominal-polling-interval nominal-polling-interval(Optional) Configure the maximum amount of time that unicast request intervals can be delayed beyond the nominal polling interval.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set tolerated-poll-jitter tolerated-poll-jitter(Optional) Configure the size of the individual data grants provided to the service flow.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set grant-size grant-size(Optional) Configure the actual number of data grants given to the service flow during each nominal grant interval.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set grants-per-interval grants-per-interval(Optional) Configure the maximum amount of time that the transmission opportunities can be delayed beyond the nominal grant interval.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set tolerated-grant-jitter tolerated-grant-jitter(Optional) Configure the nominal interval between successive unsolicited data grant opportunities for this service flow.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set nominal-grant-interval nominal-grant-interval(Optional) Enter a description for the filter action.
[edit policies group pcmm list DocsisParameter rule in docsis-param]user@host# set description description(Optional) Verify the DOCSIS action configuration.
[edit policies group pcmm list DocsisParameter rule in docsis-param] user@host# show service-flow-type action; traffic-priority 1; request-transmission-policy 1; maximum-sustained-rate 1500; maximum-traffic-burst 3044; minimum-reserved-rate 1240; assumed-minimum-res-packet-size 124; description "DOCSIS parameter action with a parameter service flow scheduling type";
Configuring Dynamic Profile Actions (SRC CLI)
Use this action to install existing dynamic profiles. You can configure dynamic profile actions for devices such as the MX Series routers.
The profile name must match a dynamic profile configured on the device, and the variable name must match a variable configured for the dynamic profile.
Use the following configuration statements to configure a dynamic profile action:
To configure a dynamic profile action:
- From configuration mode, enter the dynamic profile action
configuration.user@host# edit policies group ise list l1 rule r1 dynamic-profile
- Enter the profile name to activate. [edit policies group ise list l1 rule r1 dynamic-profile]user@host# set profile-name profile-name
- (Optional) Enter a description for the dynamic profile
action. [edit policies group ise list l1 rule r1 dynamic-profile]user@host# set description description
- From configuration mode, enter the parameters used by
the profile. user@host# edit policies group ise list l1 rule r1 dynamic-profile variable name
For example:
user@host# edit policies group ise list l1 rule r1 dynamic-profile variable upstreamBandwidth - (Optional) Configure the value for the variable. [edit policies group ise list l1 rule r1 dynamic-profile variable name]user@host# set value value
For example:
[edit policies group ise list l1 rule r1 dynamic-profile variable upstreamBandwidth]user@host# set value rateParameter - (Optional) Configure the variable type. Variable types
are mapped to parameter types. [edit policies group ise list l1 rule r1 dynamic-profile variable name]user@host# set type type
For example:
[edit policies group ise list l1 rule r1 dynamic-profile variable upstreamBandwidth]user@host# set type rate
Configuring Exception Application Actions (SRC CLI)
Use the following statements to configure policy actions that specify exceptions to a rule to identify the client application that is a destination for packets.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
To configure an exception action in a policy rule to specify that traffic be sent to a client application:
From configuration mode, enter the exception application action configuration.
[edit]user@host# edit policies group http-policy list http-list rule redirect exception-applicationSpecify the application type, such as HTTP for Web traffic.
[edit policies group http-policy list http-list rule redirect exception-application]user@host# set application-type http
Configuring Filter Actions (SRC CLI)
Use this action to discard packets. You can configure filter actions for Junos OS filters and JunosE policy rules. The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statement to configure a filter action:
To configure a filter action:
From configuration mode, enter the filter action configuration.
user@host# edit policies group junos_filter list in rule pr filter(Optional) Enter a description for the filter action.
[edit policies group junos_filter list in rule pr filter]user@host# set description description(Optional) Verify the filter action configuration.
[edit policies group junos_filter list in rule pr filter] user@host# show description "Filter action for Junos OS policies";
Configuring FlowSpec Actions (SRC CLI)
A FlowSpec is made up of two parts, a traffic specification (TSpec) and a service request specification (RSpec). The TSpec describes the traffic requirements for the flow, and the RSpec specifies resource requirements for the desired service. You can configure FlowSpec actions for PCMM policy rules.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure FlowSpec actions:
To configure a FlowSpec action:
From configuration mode, enter the FlowSpec action configuration.
user@host# edit policies group pcmm list TrafficProfileFlowSpec rule pr flow-spec(Optional) Configure the type of FlowSpec service as either controlled_load_service or guaranteed_service. The FlowSpec options available for configuration change depending on the type of service that you select:
Controlled load services can contain only TSpec parameters.
Guaranteed services can contain both TSpec and RSpec parameters.
[edit policies group pcmm list TrafficProfileFlowSpec rule pr flow-spec]user@host# set service-type service-type
(Optional TSpec parameter) Configure the guaranteed minimum rate that is reserved for the service flow.
[edit policies group pcmm list TrafficProfileFlowSpec rule pr flow-spec]user@host# set token-bucket-rate token-bucket-rate(Optional TSpec parameter) Configure the maximum burst size for the service flow.
[edit policies group pcmm list TrafficProfileFlowSpec rule pr flow-spec]user@host# set token-bucket-size token-bucket-size(Optional TSpec parameter) Configure the amount of bandwidth over the committed rate that is allocated to accommodate excess traffic flow over the committed rate.
[edit policies group pcmm list TrafficProfileFlowSpec rule pr flow-spec]user@host# set peak-data-rate peak-data-rate(Optional TSpec parameter) Configure the assumed minimum-reserved-rate packet size. If a packet is smaller than the minimum policed unit, the software treats the packet as if its size is equal to the value specified in this option.
[edit policies group pcmm list TrafficProfileFlowSpec rule pr flow-spec]user@host# set minimum-policed-unit minimum-policed-unit(Optional TSpec parameter) Configure the maximum packet size for the FlowSpec.
[edit policies group pcmm list TrafficProfileFlowSpec rule pr flow-spec]user@host# set maximum-packet-size maximum-packet-size(Optional RSpec parameter) Configure the average rate.
[edit policies group pcmm list TrafficProfileFlowSpec rule pr flow-spec]user@host# set rate rate(Optional RSpec parameter) Configure the amount of slack in the bandwidth reservation that can be used without redefining the reservation.
[edit policies group pcmm list TrafficProfileFlowSpec rule pr flow-spec]user@host# set slack-term slack-term(Optional) Configure a description for the FlowSpec action.
[edit policies group pcmm list TrafficProfileFlowSpec rule pr flow-spec]user@host# set description description(Optional) Verify the FlowSpec action configuration.
[edit policies group pcmm list TrafficProfileFlowSpec rule pr flow-spec] user@host# show service-number guaranteed_service; token-bucket-rate bucketRate; token-bucket-size bucketDepth; peak-data-rate peakRate; minimum-policed-unit minPolicedUnit; rate reservedRate; slack-term slackTerm; description "FlowSpec guaranteed service";
Configuring Forward Actions (SRC CLI)
Use this action to forward packets, such as packets that are sent by means of a routing table. You can configure forward actions for Junos OS filters and JunosE policy rules.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statement to configure forward actions:
To configure a forward action:
From configuration mode, enter the forward action configuration.
user@host# edit policies group junose list forward rule pr forward(Optional) Enter a description for the forward action.
[edit policies group junose list forward rule pr forward]user@host# set description description(Optional) Verify the forward action configuration.
[edit policies group junose list forward rule pr forward] user@host# show description "Junos Forward Action";
Configuring Forwarding Class Actions (SRC CLI)
You can configure forwarding class actions for Junos OS filter policy rules. The forwarding class action causes the router to assign a forwarding class to packets that match the associated classify-traffic condition.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure a forwarding class action:
To configure a forwarding class action:
From configuration mode, enter the forwarding class action configuration.
user@host# edit policies group bod list input rule pr forwarding-class(Optional) Configure the name of the forwarding class assigned to packets.
[edit policies group bod list input rule pr forwarding-class]user@host# set forwarding-class(Optional) Enter a description for the forwarding class action.
[edit policies group bod list input rule pr forwarding-class]user@host# set description description(Optional) Verify the forwarding class action configuration.
[edit policies group bod list input rule pr forwarding-class] user@host# show forwarding-class fc_expedited; description "Expedited forwarding class";
Configuring GateSpec Actions (SRC CLI)
You can configure GateSpec actions for PCMM policy rules. See Policy Information Modelfor more information.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure GateSpec actions:
To configure a GateSpec action:
From configuration mode, enter the GateSpec action configuration.
user@host# edit policies group pcmm list GateSpec rule pr gate-spec(Optional) Configure the priority bits in the session class ID. The priority describes the relative importance of the session as compared with other sessions generated by the same policy decision point.
[edit policies group pcmm list GateSpec rule pr gate-spec]user@host# set session-class-id-priority session-class-id-priority(Optional) Configure the preemption bit in the session class ID. Use the preemption bit to allocate bandwidth to lower-priority sessions.
[edit policies group pcmm list GateSpec rule pr gate-spec]user@host# set session-class-id-preemption session-class-id-preemption(Optional) Configure the configurable bit in the session class ID.
[edit policies group pcmm list GateSpec rule pr gate-spec]user@host# set session-class-id-configurable session-class-id-configurable(Optional) Enter a description for the GateSpec action.
[edit policies group pcmm list GateSpec rule pr gate-spec]user@host# set description description(Optional) Verify the GateSpec action configuration.
[edit policies group pcmm list GateSpec rule pr gate-spec] user@host# show session-class-id-priority 5; session-class-id-preemption 0; session-class-id-configurable 5
Configuring HTTP Redirect Actions (SRC CLI)
Use the following statements to configure policy actions to redirect Web traffic to a specified URL.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
To configure an HTTP redirect action in a policy rule to specify that Web traffic be sent to a specified URL:
From configuration mode, enter the HTTP redirect action configuration.
[edit]user@host# edit policies group http list http-list rule redirect http-redirectSpecify the destination URL to which traffic will be redirected. For example, to redirect the traffic to www.new.com:
[edit policies group http list http-list rule redirect http-redirect]user@host# subscriber-url "\"http://www.new.com\""
Configuring Loss Priority Actions (SRC CLI)
You can configure loss priority actions for Junos OS filter policy rules. The loss priority action causes the router to assign a packet loss priority to packets that match the associated classify-traffic condition.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure loss priority actions:
To configure a loss priority action:
From configuration mode, enter the loss priority action configuration.
user@host# edit policies group junos list lossPriority rule pr loss-priority(Optional) Configure the packet loss priority.
[edit policies group junos list lossPriority rule pr loss-priority]user@host# set loss-priority loss-priority(Optional) Enter a description for the loss priority action.
[edit policies group junos list lossPriority rule pr loss-priority]user@host# set description description(Optional) Verify the loss priority action configuration.
[edit policies group junos list lossPriority rule pr loss-priority] user@host# show loss-priority high_priority; description "Loss Priority set to high";
Configuring Mark Actions (SRC CLI)
Use this action to mark packets. You can configure mark actions for JunosE and PCMM policy rules.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
If you configure more than one mark action in a rate limit, for example, for a committed, conformed, or exceed action, configure the same mask for each action. If you use different masks, the results can be unpredictable.
Use the following configuration statements to configure a mark action:
To configure a mark action:
From configuration mode, enter the mark action configuration.
user@host# edit policies group junose list mark rule pr mark(Optional) Enter a description for the mark action.
[edit policies group junose list mark rule pr mark]user@host# set description description(Optional) Configure the mark value.
[edit policies group junose list mark rule pr mark]user@host# set info value value(Optional) Configure the mark mask.
[edit policies group junose list mark rule pr mark]user@host# set info mask maskSupported values for the mask are 224 for precedence bits, 252 for DS bits, and 255 to mask all bits.
(Optional) Verify the mark action configuration.
[edit policies group junose list mark rule pr mark] user@host# show info { mark-value 10; mask 255; } description "Mark action";
Configuring NAT Actions (SRC CLI)
You can configure NAT actions for Junos OS ASP policy rules. The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure NAT actions:
To configure a NAT action:
From configuration mode, enter the NAT action configuration.
user@host# edit policies group junos list nat rule pr nat(Optional) Configure the type of network address translation that is used.
[edit policies group junos list nat rule pr nat]user@host# set translation-type translation-type(Optional) Enter a description for the NAT action.
[edit policies group junos list nat rule pr nat]user@host# set description description(Optional) Configure the port range to restrict port translation when the NAT translation type is configured in dynamic-source mode.
[edit policies group junos list nat rule pr nat]user@host# set port from-port from-port(Optional) Configure the IP address ranges.
[edit policies group junos list nat rule pr nat]user@host# set ip-network group-network network-specifier network-specifier(Optional) Verify the NAT action configuration.
[edit policies group junos list nat rule pr nat] user@host# show translation-type "source dynamic"; ip-network { group-network { network-specifier 192.168.1.100/32; } } port { from-port 2010..2020; }
Configuring Next-Hop Actions (SRC CLI)
Use this action for the ingress side of the interface to specify the next IP address where the classified packets should go. You can configure next-hop actions for Junos OS filters and JunosE policy rules.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure the next-hop action.
To configure a next-hop action:
From configuration mode, enter the next-hop action configuration.
user@host# edit policies group junose list nexthop-to-ssp rule to-ssp next-hop(Optional) Configure the next IP address where the classified packets should go.
[edit policies group junose list nexthop-to-ssp rule to-ssp next-hop]user@host# set next-hop-address next-hop-address(Optional) Enter a description for the next-hop action.
[edit policies group junose list nexthop-to-ssp rule to-ssp next-hop]user@host# set description description(Optional) Verify the next-hop action configuration.
[edit policies group junose list nexthop-to-ssp rule to-ssp next-hop] user@host# show next-hop-address virtual_ipAddress; description "Next hop action";
Configuring Next-Interface Actions (SRC CLI)
Use this action to forward packets to a particular interface and/or a next-hop address. You can configure next-interface actions for Junos OS filters and JunosE policy rules. On routers running JunosE Software, you can use this action for both ingress and egress parts of the interface.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure next-interface actions:
To configure a next-interface action:
From configuration mode, enter the next-interface action configuration.
user@host# edit policies group redirect list input rule redirect next-interface(Optional) Configure the IP interface to be used as the next interface for packets.
[edit policies group redirect list input rule redirect next-interface]user@host# set interface-specifier interface-specifier(Optional) Configure the next IP address where the classified packets should go. This option is available only in JunosE policy rules.
[edit policies group redirect list input rule redirect next-interface]user@host# set next-hop-address next-hop-address(Optional) Enter a description for the next-interface action.
[edit policies group redirect list input rule redirect next-interface]user@host# set description description(Optional) Verify the next-interface action configuration.
[edit policies group redirect list input rule redirect next-interface] user@host# show interfaceSpec "name='fastethernet3/0'"; next-hop-address 10.10.227.3; description "Next-interface action for redirect policy";
Configuring Next-Rule Actions (SRC CLI)
You can configure next-rule actions for Junos OS filter policy rules. If a packet matches the classify-traffic condition, the next-rule action causes the router to continue to the next rule in the policy list for evaluation.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statement to configure next-rule actions.
To configure a next-rule action:
From configuration mode, enter the next-rule action configuration.
user@host# edit policies group junos list filter rule next next-rule(Optional) Enter a description for the next-rule action.
[edit policies group junos list filter rule next next-rule]user@host# set description description(Optional) Verify the next-rule action configuration.
[edit policies group junos list filter rule next next-rule] user@host# show configuration policies group junos list filter rule next next-rule nra description "Next-rule action";
Configuring Policer Actions (SRC CLI)
The policer action specifies rate and burst size limits and the action taken if a packet exceeds those limits. You can create policer actions in Junos OS policer and Junos OS filter policy rules.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure policer actions:
To configure a policer action:
From configuration mode, enter the policer action configuration.
user@host# edit policies group junos list firewallFilterPolicer rule pr policer(Optional) Configure the traffic rate that, if exceeded, causes the router to take the indicated packet action.
[edit policies group junos list firewallFilterPolicer rule pr policer]user@host# set bandwidth-limit bandwidth-limit(Optional) Configure the type of value entered for bandwidth limit.
[edit policies group junos list firewallFilterPolicer rule pr policer]user@host# set bandwidth-limit-unit bandwidth-limit-unit(Optional) Configure the maximum burst size. The minimum recommended value is the maximum transmission unit (MTU) of the IP packets being policed.
[edit policies group junos list firewallFilterPolicer rule pr policer]user@host# set burst burst(Optional) Enter a description for the policer action.
[edit policies group junos list firewallFilterPolicer rule pr policer]user@host# set description description(Optional) Verify the policer action configuration.
[edit policies group junos list firewallFilterPolicer rule pr policer] user@host# show bandwidth-limit 1048576; bandwidth-limit-unit bps; burst 15000;
Configuring the Packet Action for the Policer Action (SRC CLI)
The packet action specifies the action taken on a packet that exceeds its rate limits. You configure packet actions within policer actions.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure a packet action:
To configure a packet action:
From configuration mode, enter the packet action configuration. For example, in this procedure, pktAction is the name of the packet action.
user@host# edit policies group junos list firewallFilterPolicer rule pr policer packet-action pktAction(Optional) Configure the action to take on packets that exceed the bandwidth limit configured in the policer action.
Filter—Packets are discarded.
[edit policies group junos list firewallFilterPolicer rule pr policer packet-action pktAction]user@host# set filter
Forwarding class—Packets are assigned to the forwarding class that you specify.
[edit policies group junos list firewallFilterPolicer rule pr policer packet-action pktAction]user@host# set forwarding-class
Loss priority—Packets are assigned the loss priority that you specify.
[edit policies group junos list firewallFilterPolicer rule pr policer packet-action pktAction]user@host# set loss-priority loss-priorityParameter—The action specified by the parameter is applied. Before you assign a parameter, you must create a parameter of type packetOperation and commit the parameter configuration.
[edit policies group junos list firewallFilterPolicer rule pr policer packet-action pktAction]user@host# edit parameter[edit policies group junos list firewallFilterPolicer rule pr policer packet-action pktAction parameter]user@host# set action paramAction
(Optional) Verify the policer action configuration.
[edit policies group junos list firewallFilterPolicer rule pr policer packet-action pktAction parameter] user@host# show packet-action pktAction { parameter { action PolicyParameterAction; } } bandwidth-limit 1048576; bandwidth-limit-unit bps; burst 15000;
Configuring QoS Profile Attachment Actions (SRC CLI)
Use this action to specify the QoS profile and the QoS parameters to attach to the router interface when this action is taken. The QoS profile and the QoS parameters must be configured on the router. You can configure QoS actions for JunosE policy rules.
The router allows only one QoS profile to be attached to an interface at one time. Therefore, as a subscriber activates and deactivates different services, the QoS profile running on the interface needs to change. The SRC software provides a QoS-tracking plug-in (QTP) that you can use to ensure that as a subscriber activates and deactivates services, the required QoS profile is attached to the subscriber interface. See Dynamically Managing QoS Profiles.
The QoS parameters allow you to specify rates in QoS profiles as parameters instead of fixed values. The actual values for the parameters can be specified for each interface. Therefore, you can share a QoS profile among different interfaces with different rates.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure QoS profile attachment actions:
To configure a QoS profile attachment action:
From configuration mode, enter the QoS profile attachment action configuration.
user@host# edit policies group junose list qos rule input qos-attachConfigure the name of the QoS profile to attach to the JunosE interface when this action is taken.
[edit policies group junose list qos rule input qos-attach]user@host# set qos-profile qos-profile(Optional) Configure the names and values of the QoS parameters to attach to the JunosE interface when this action is taken. Use map expressions to specify multiple values.
[edit policies group junose list qos rule input qos-attach]user@host# set qos-parameters qos-parameters(Optional) Enter a description for the QoS profile attachment action.
[edit policies group junose list qos rule input qos-attach]user@host# set description description(Optional) Verify the QoS profile attachment action configuration.
[edit policies group junose list qos rule input qos-attach] user@host# show qos-profile qp-vod-1024; description "Action for QoS video-on-demand";
Configuring Rate-Limit Actions (SRC CLI)
Use this action to define the quality of service. You can configure rate-limit actions for JunosE policy rules.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure rate-limit actions:
To configure a rate-limit action:
From configuration mode, enter the rate-limit action configuration.
user@host# edit policies group junose list rate-limiter rule pr rate-limit(Optional) Specify that the rate-limit profile is either one rate or two rate. The rate-limit type determines the options that you can configure for a rate-limit action.
[edit policies group junose list rate-limiter rule pr rate-limit]user@host# set type type(Optional) Configure the target rate for the traffic that the policy covers.
[edit policies group junose list rate-limiter rule pr rate-limit]user@host# set committed-rate committed-rate(Optional) Configure the amount of bandwidth allocated to burst traffic in bytes.
[edit policies group junose list rate-limiter rule pr rate-limit]user@host# set committed-burst committed-burst(Optional) For two-rate rate-limit profiles, specify the amount of bandwidth allocated to excess traffic flow over the committed rate.
[edit policies group junose list rate-limiter rule pr rate-limit]user@host# set peak-rate peak-rate(Optional) For two-rate rate-limit profiles, specify the amount of bandwidth allocated to burst traffic in excess of the peak rate.
[edit policies group junose list rate-limiter rule pr rate-limit]user@host# set peak-burst peak-burst(Optional) For one-rate rate-limit profiles, specify the amount of bandwidth allocated to accommodate burst traffic.
[edit policies group junose list rate-limiter rule pr rate-limit]user@host# set excess-burst excess-burst(Optional) Set the rate limit to color aware for the rate-limit to process color values.
[edit policies group junose list rate-limiter rule pr rate-limit]user@host# set color-aware(Optional) Set the rate limit to support hierarchical rate limits.
[edit policies group junose list rate-limiter rule pr rate-limit]user@host# set support-hierarchical(Optional) Configure the rate-limit action for traffic flows that:
Do not exceed the committed rate
Exceed the committed rate but remain below the peak rate.
Exceed the peak rate.
See Configuring Types of Actions for Rate-Limit Actions (SRC CLI).
(Optional) Enter a description for the rate-limit action.
[edit policies group junose list rate-limiter rule pr rate-limit]user@host# set description description(Optional) Return to the rate-limit action configuration, and verify the configuration.
[edit policies group junose list rate-limiter rule pr rate-limit] user@host# show committed-action { forward { } } conformed-action { forward { } } exceed-action { filter { } } type 1; committed-rate 1000000; committed-burst 125000; excess-burst 312500;
Configuring Hierarchical Rate-Limit Actions (SRC CLI)
You configure parent groups to create a hierarchy of rate-limits actions.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure rate-limit actions:
To configure a parent group:
From configuration mode, create a parent group in a policy list—for example, PGShared.
[edit policies group parentGroupDefault list twoRate]user@host# edit parent-group PGSharedConfigure a rate limit for the parent group.
[edit policies group parentGroupDefault list twoRate parent-group PGShared]user@host# edit rate-limitSpecify that the rate limit is either one rate or two rate. The rate-limit type determines the options that you can configure for a rate-limit action.
[edit policies group parentGroupDefault list twoRate parent-group PGShared rate-limit]user@host# set type type(Optional) Configure the target rate for the traffic that the policy covers.
[edit policies group parentGroupDefault list twoRate parent-group PGShared rate-limit]user@host# set committed-rate committed-rate(Optional) Configure the amount of bandwidth allocated to burst traffic in bytes.
[edit policies group parentGroupDefault list twoRate parent-group PGShared rate-limit]user@host# set committed-burst committed-burst(Optional) For two-rate rate-limit profiles, specify the amount of bandwidth allocated to excess traffic flow over the committed rate.
[edit policies group parentGroupDefault list twoRate parent-group PGShared rate-limit]user@host# set peak-rate peak-rate(Optional) For two-rate rate limit profiles, specify the amount of bandwidth allocated to burst traffic in excess of the peak rate.
[edit policies group parentGroupDefault list twoRate parent-group PGShared rate-limit]user@host# set peak-burst peak-burst(Optional) For one-rate rate limit profiles, specify the amount of bandwidth allocated to accommodate burst traffic.
[edit policies group parentGroupDefault list twoRate parent-group PGShared rate-limit]user@host# set excess-burst excess-burst(Optional) Set the rate-limit to color aware for the rate-limit to process color values set in the TOS byte of the packet header.
[edit policies group parentGroupDefault list twoRate parent-group PGShared rate-limit]user@host# set color-aware
(Optional) Configure the rate-limit actions for traffic flows that:
Do not exceed the committed rate and burst size
Exceed the committed rate but remain below the peak burst size
See Configuring Types of Actions for Rate-Limit Actions (SRC CLI).
Enter a description for the parent group.
[edit policies group parentGroupDefault list twoRate parent-group PGShared]user@host# set description descriptionStep up one level in the edit hierarchy.
[edit policies group parentGroupDefault list twoRate parent-group PGShared rate-limit]user@host# up[edit policies group parentGroupDefault list twoRate parent-group PGShared](Optional) Configure the parent group to reference an external parent group. For example, to add a reference called epg1-ref:
[edit policies group parentGroupDefault list twoRate parent-group PGShared]user@host# edit external-parent-group-reference epg1-refSpecify the name of the external parent group that you want to reference. For example, to reference the external parent group epg1:
[edit policies group parentGroupDefault list twoRate parent-group PGShared external-parent-group-reference epg1-ref]user@host# set external-parent-group-name epg1Specify the name of the hierarchical policy parameter for the external parent group. For example, to associate the hierarchical policy parameter called hpp1:
[edit policies group parentGroupDefault list twoRate parent-group PGShared external-parent-group-reference epg1-ref]user@host# set hierarchical-policy-parameter hpp1Specify the attributes of the hierarchical policy parameter that you are referencing.
[edit policies group parentGroupDefault list twoRate parent-group PGShared external-parent-group-reference epg1-reference hierarchical-policy-parameter hpp1]user@host# set numeric-aggregation-node numeric-aggregation-nodeuser@host# set level-aggregation-node level-aggregation-nodeuser@host# set level-aggregation-node-id level-aggregation-node-idFor information about configuring the attributes of the hierarchical policy parameter, see Configuring Hierarchical Policy Parameters for External Parent Groups (SRC CLI).
(Optional) Return to the rate-limit action configuration and verify the configuration.
[edit policies group parentGroupDefault list twoRate parent-group PGShared] user@host# show
(Optional) Create another parent group within this parent group. For example:
[edit policies group parentgroupDefault list twoRate parent-group PGShared]user@host# edit parent-group parent-group-name(Optional) Follow the instructions in this procedure for configuring the parent group.
Configuring Types of Actions for Rate-Limit Actions (SRC CLI)
When you configure a rate-limit action or a rate-limit hierarchy, you specify types of actions for conformed traffic, committed traffic, and exceed traffic.
Before you configure the various types of action, configure the rate limit or parent group (for rate-limit hierarchies) that is to include the actions. See
Use the following configuration statements to configure rate-limit actions from the following hierarchy levels:
[edit policies group name list name rule name]
[edit policies group name list name parent-group name]
To specify types of actions for rate-limit actions:
Specify an action for a rate-limit action or a rate-limit hierarchy:
Note The following examples show the configuration for a committed action. You can configure the same actions for committed actions, conformed actions, and exceed actions.
Filter (drop packet).
[edit policies group junose list rate-limiter rule pr rate-limit]user@host# set committed-action filterForward.
[edit policies group parentGroupDefault list twoRate parent-group PGShared rate-limit]user@host# set committed-action forward(For rate-limit hierarchies only) Forward conditionally.
[edit policies group parentGroupDefault list twoRate parent-group PGShared rate-limit]user@host# set committed-action forward-conditional(Rate-limit hierarchies only for committed and conformed actions) Forward unconditionally.
[edit policies group parentGroupDefault list twoRate parent-group PGShared rate-limit]user@host# set committed-action forward-unconditional(For rate-limit hierarchies only) Forward and exit from the rate-limit hierarchy.
[edit policies group parentGroupDefault list twoRate parent-group PGShared rate-limit]user@host# set committed-action forward-finalMark. If you select mark, enter the mark values.
[edit policies group junose list rate-limiter rule pr rate-limit]user@host# edit committed-action mark mark-info[edit policies group junose list rate-limiter rule pr rate-limit committed-action mark mark-info]user@host# set value value[edit policies group junose list rate-limiter rule pr rate-limit committed-action mark mark-info]user@host# set mask maskMake sure that masks configured with a rate limit action are the same for different mark actions.
Parameter. Before you assign a parameter, you must create a parameter of type packetOperation and commit the parameter configuration.
[edit policies group junose list rate-limiter rule pr rate-limit committed-action]user@host# set committed-action parameter action action
Configuring Reject Actions (SRC CLI)
You can configure reject actions for Junos OS filter policy rules. The reject action causes the router to discard a packet and send an ICMP destination unreachable message.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure reject actions:
To configure a reject action:
From configuration mode, enter the reject action configuration.
user@host# edit policies group junos list filter rule rejectRule reject(Optional) Configure the type of ICMP destination unreachable message sent to the client.
[edit policies group junos list filter rule rejectRule reject]user@host# set message-type message-type(Optional) Enter a description for the reject action.
[edit policies group junos list filter rule rejectRule reject]user@host# set description description(Optional) Verify the reject action configuration.
[edit policies group junos list filter rule rejectRule reject] user@host# show message-type network-prohibited; description "Reject action in Junos OS filter policy";
Configuring Routing Instance Actions (SRC CLI)
You can configure routing instance actions for Junos OS filter policy rules. Use routing instance actions for filter-based forwarding to direct traffic to a specific routing instance configured on the router.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure routing instance actions:
To configure a routing instance action:
From configuration mode, enter the routing instance action configuration.
user@host# edit policies group junos list bodVpn rule pr routing-instance(Optional) Configure the routing instance to which packets are forwarded. The routing instance must be configured on the router.
[edit policies group junos list bodVpn rule pr routing-instance]user@host# set routing-instance routing-instance(Optional) Enter a description for the reject action.
[edit policies group junos list bodVpn rule pr routing-instance]user@host# set description description(Optional) Verify the routing instance action configuration.
[edit policies group junos list bodVpn rule pr routing-instance] user@host# show routing-instance isp2-route-table; description "Routing Instance Action";
Configuring Scheduler Actions (SRC CLI)
You use scheduler actions along with QoS conditions and traffic-shape actions to configure transmission scheduling and rate control. Schedulers define the priority, bandwidth, delay buffer size, rate control status, and random early detection (RED) drop profiles to be applied to a particular class of traffic. You can create scheduler actions in Junos OS scheduler policy rules.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure scheduler actions:
To configure a scheduler action:
From configuration mode, enter the scheduler action configuration.
user@host# edit policies group junos list qos rule pr scheduler-action(Optional) Configure the queue transmission buffer size.
[edit policies group junos list qos rule pr scheduler-action]user@host# set buffer-size buffer-size(Optional) Configure the type of value that you entered for buffer size.
[edit policies group junos list qos rule pr scheduler-action]user@host# set buffer-size-unit buffer-size-unit(Optional) Configure the packet-scheduling priority. The priority determines the order in which an output interface transmits traffic from the queues.
[edit policies group junos list qos rule pr scheduler-action]user@host# set priority priority(Optional) Configure the transmit rate.
[edit policies group junos list qos rule pr scheduler-action]user@host# set transmit-rate transmit-rate(Optional) Configure the type of value entered for transmit rate.
[edit policies group junos list qos rule pr scheduler-action]user@host# set transmit-rate-unit transmit-rate-unit(Optional) Specify whether or not to enforce the exact transmission rate. Under sustained congestion, a rate-controlled queue that goes into negative credit fills up and eventually drops packets.
[edit policies group junos list qos rule pr scheduler-action]user@host# set exact exact(Optional) Enter a description for the scheduler action.
[edit policies group junos list qos rule pr scheduler-action]user@host# set description description(Optional) Verify the scheduler action configuration.
[edit policies group junos list qos rule pr scheduler-action] user@host# show buffer-size 85; buffer-size-unit buffer_size_percentage; priority low; transmit-rate 10485760; transmit-rate-unit rate_in_bps; description "Scheduler action for logical interface scheduling";
Configuring Drop Profiles (SRC CLI)
You configure drop profiles within scheduler actions. Drop profiles support the RED process by defining the drop probabilities across the range of delay-buffer occupancy. For a packet to be dropped, it must match the drop profile. When a packet arrives, RED checks the queue fill level. If the fill level corresponds to a nonzero drop probability, the RED algorithm determines whether to drop the arriving packet. Depending on the drop probabilities, RED might drop packets aggressively long before the buffer becomes full, or it might drop only a few packets even if the buffer is almost full.
In drop profiles you configure the queue threshold and drop probability as paired values. The values can be either percentage values (segmented) or data points (interpolated). These two alternatives enable you to configure each drop probability at up to 64 fill-level/drop-probability paired values, or to configure a profile represented as a series of line segments. For more information about configuring fill level and drop probabilities, see the Junos OS documentation.
Use the following configuration statements to configure drop profiles:
To configure drop profiles:
From configuration mode, enter the drop profile configuration. For example, in this procedure, drop1 is the name of the drop profile.
user@host# edit policies group junos list qosWithDropProfile rule pr scheduler-action drop-profile drop1Configure the loss priority.
[edit policies group junos list qosWithDropProfile rule pr scheduler-action drop-profile drop1]user@host# set loss-priority loss-priorityConfigure the protocol type.
[edit policies group junos list qosWithDropProfile rule pr scheduler-action drop-profile drop1]user@host# set protocol protocolConfigure the relationship between the fill level and drop probability.
[edit policies group junos list qosWithDropProfile rule pr scheduler-action drop-profile drop1]user@host# set drop-profile-type drop-profile-typeConfigure the probability that a packet will be dropped.
[edit policies group junos list qosWithDropProfile rule pr scheduler-action drop-profile drop1]user@host# set drop-probability drop-probabilityConfigure the fill level of the queue.
[edit policies group junos list qosWithDropProfile rule pr scheduler-action drop-profile drop1]user@host# set queue-threshold queue-threshold(Optional) Verify the drop profile configuration.
[edit policies group junos list qosWithDropProfile rule pr scheduler-action drop-profile drop1] user@host# show loss-priority high_priority; protocol any_protocol; drop-probability "[75, 100]"; drop-profile-type interpolated; queue-threshold "[50, 80]";
Configuring Service Class Name Actions (SRC CLI)
You can configure service class name actions for PCMM policy rules. The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure service class name actions:
To configure a service class name action:
From configuration mode, enter the service class name action configuration.
user@host# edit policies group pcmm list serviceClass rule pr service-class-name(Optional) Configure the name of a service class on the CMTS device that specifies QoS parameters for a service flow.
[edit policies group pcmm list serviceClass rule pr service-class-name]user@host# set service-class-name service-class-name(Optional) Enter a description for the service class name action.
[edit policies group pcmm list serviceClass rule pr service-class-name]user@host# set description description(Optional) Verify the service class name action configuration.
[edit policies group pcmm list serviceClass rule pr service-class-name] user@host# show configuration policies group pcmm list serviceClass rule pr service-class-name scna service-class-name scn_up; description "Service class name action for pcmm service class policy.";
Configuring Stateful Firewall Actions (SRC CLI)
You can configure stateful firewall actions for Junos OS ASP policy rules. Stateful firewall actions specify the action to take on packets that match the classify-traffic condition.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure stateful firewall actions:
To configure a stateful firewall action:
From configuration mode, enter the stateful firewall action configuration.
user@host# edit policies group junos list sfw rule pr stateful-firewall(Optional) Set the action to take on a packet to one of the following:
Filter.
[edit policies group junos list sfw rule pr stateful-firewall]user@host# set packet-action filter
Forward.
[edit policies group junos list sfw rule pr stateful-firewall]user@host# set packet-action forward
Reject. If you set the action to reject, configure the type of ICMP destination unreachable message sent to the client.
[edit policies group junos list sfw rule pr stateful-firewall]user@host# set packet-action reject message-type message-typeParameter. Before you assign a parameter, you must create a parameter of type packetOperation and commit the parameter configuration.
[edit policies group junos list sfw rule pr stateful-firewall]user@host# set packet-action parameter action action
(Optional) Enter a description for the stateful firewall action.
[edit policies group junos list sfw rule pr stateful-firewall]user@host# set description description(Optional) Verify the stateful firewall action configuration.
[edit policies group junos list sfw rule pr stateful-firewall] user@host# show packet-action { reject { message-type administratively-prohibited; } } description "Stateful firewall action";
Configuring Template Activation Actions (SRC CLI)
Use this action to activate templates for RADIUS-enabled devices. You can configure template activation actions for AAA policy rules.
The template name and parameters are listed in the custom router template on the IMS AAA Server.
Use the following configuration statements to configure template activation actions:
To configure a template activation action:
From configuration mode, enter the template activation action configuration.
user@host# edit policies group tiered_aaa list l1 rule r1 template-activationEnter the template name to activate.
[edit policies group tiered_aaa list l1 rule r1 template-activation]user@host# set template-name template-name(Optional) Enter a description for the template activation action.
[edit policies group tiered_aaa list l1 rule r1 template-activation]user@host# set description descriptionFrom configuration mode, enter the parameters used by the template.
user@host# edit policies group tiered_aaa list l1 rule r1 template-activation variable nameFor example:
user@host# edit policies group tiered_aaa list l1 rule r1 template-activation variable upstreamBandwidth(Optional) Configure the value for the variable.
[edit policies group tiered_aaa list l1 rule r1 template-activation variable name]user@host# set value valueFor example:
[edit policies group tiered_aaa list l1 rule r1 template-activation variable upstreamBandwidth]user@host# set value rateParameter(Optional) Configure the variable type. Variable types are mapped to parameter types.
[edit policies group tiered_aaa list l1 rule r1 template-activation variable name]user@host# set type typeFor example:
[edit policies group tiered_aaa list l1 rule r1 template-activation variable upstreamBandwidth]user@host# set type rate(Optional) Verify the template activation action configuration.
[edit policies group tiered_aaa list l1 rule r1 template-activation] user@host# show
Configuring Traffic-Class Actions (SRC CLI)
Use this action to put packets in a particular traffic class. You can configure traffic-class actions for JunosE policy rules.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statement to configure traffic-class actions:
To configure a traffic-class action:
From configuration mode, enter the traffic-class configuration.
user@host# edit policies group junose list class rule pr traffic-class(Optional) Configure the name of the traffic-class profile that is applied to a packet when it passes through the router.
[edit policies group junose list class rule pr traffic-class]user@host# set traffic-class(Optional) Enter a description for the traffic-class action.
[edit policies group junose list class rule pr traffic-class]user@host# set description description(Optional) Verify the traffic-class action configuration.
[edit policies group junose list class rule pr traffic-class] user@host# show traffic-class TCent; description "Traffic class action";
Configuring Traffic-Mirror Actions (SRC CLI)
Use this action to mirror traffic from a destination to a source or from a source to a destination. You can configure traffic-mirror actions for Junos OS filter input policy rules.
Before you use traffic-mirror actions, configure forwarding options on routers running Junos OS for port mirroring and next-hop group. For information about how these features work on the router, see the Junos OS Policy Framework Configuration Guide.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
The rule containing a traffic-mirror action must comply with these conditions:
It must be combined with forward actions in the same rule. One of the forward actions must accept the traffic if the source and/or destination IP addresses do not match the conditions.
It contains either no classify-traffic condition or only one classify-traffic condition.
It can be marked for accounting.
Use the following configuration statement to configure a traffic-mirror action:
To configure a traffic-mirror action:
From configuration mode, enter the traffic-mirror configuration.
user@host# edit policies group junos list mirror rule pr traffic-mirror(Optional) Enter a description for the traffic-mirror action.
[edit policies group junos list mirror rule pr traffic-mirror]user@host# set description description(Optional) Verify the traffic-mirror action configuration.
[edit policies group junos list mirror rule pr traffic-mirror] user@host# show description "Traffic mirroring action for subnet.";
Configuring Traffic-Shape Actions (SRC CLI)
Traffic-shape actions specify the maximum rate of traffic transmitted on an interface. You can create traffic-shape actions in Junos OS shaping policy rules.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statements to configure traffic-shape actions:
To configure a traffic-shape action:
From configuration mode, enter the traffic-shape configuration.
user@host# edit policies group junos list trafficShaping rule shaping traffic-shape(Optional) Configure the maximum transmission rate.
[edit policies group junos list trafficShaping rule shaping traffic-shape]user@host# set rate rate(Optional) Enter a description for the traffic-shape action.
[edit policies group junos list trafficShaping rule shaping traffic-shape]user@host# set description description(Optional) Verify the traffic-shape action configuration.
[edit policies group junos list trafficShaping rule shaping traffic-shape] user@host# show rate 10200000; description "Traffic-shaping action";
Configuring User Packet Class Actions (SRC CLI)
Use this action to put packets in a particular user packet class. You can configure user packet class actions for JunosE policy rules.
The type of action that you can create depends on the type of policy rule. See Policy Information Model.
Use the following configuration statement to configure user packet class actions:
To configure a user packet class action:
From configuration mode, enter the user packet class configuration.
user@host# edit policies group junose list class rule pr user-packet-class(Optional) Configure the user packet class that is applied to a packet when it passes through the router.
[edit policies group junose list class rule pr user-packet-class]user@host# set user-packet-class user-packet-class(Optional) Enter a description for the user packet class action.
[edit policies group junose list class rule pr user-packet-class]user@host# set description description(Optional) Verify the user packet class action configuration.
[edit policies group junose list class rule pr user-packet-class] user@host# show user-packet-class 5; description "User packet class action";