Hierarchical Policers
Hierarchical Policer Overview
You can use a hierarchical policer to rate-limit ingress Layer 2 traffic at a physical or logical interface and apply different policing actions based on whether the packets are classified for expedited forwarding (EF) or for a lower priority.
Hierarchical policing is supported on M40E, M120, and M320 edge routers with incoming Flexible PIC Concentrators (FPCs) as SFPC and outgoing FPCs as FFPC, and on MX Series, ACX7100-L, T320, T640, and T1600 core routers with Enhanced Intelligent Queuing (IQE) PICs.
You can apply hierarchical policing to a logical interface.
A hierarchical policer configuration defines two policers—one for EF traffic only and another for non-EF traffic—that function in a hierarchical manner:
-
Premium policer—You configure the premium policer with traffic limits for high-priority EF traffic only: a guaranteed bandwidth and a corresponding burst-size limit. EF traffic is categorized as nonconforming when its average arrival rate exceeds the guaranteed bandwidth and its average packet size exceeds the premium burst-size limit. For a premium policer, the only configurable action for nonconforming traffic is to discard the packets.
-
Aggregate policer—You configure the aggregate policer with an aggregate bandwidth (to accommodate both high-priority EF traffic up to the guaranteed bandwidth and normal-priority non-EF traffic) and a burst-size limit for non-EF traffic only. Non-EF traffic is categorized as nonconforming when its average arrival rate exceeds the amount of aggregate bandwidth not currently consumed by EF traffic and its average packet size exceeds the burst-size limit defined in the aggregate policer. For an aggregate policer, the configurable actions for nonconforming traffic are to discard the packets, assign a forwarding class, or assign a packet loss priority (PLP) level.
You must configure the bandwidth limit of the premium policer at or below the bandwidth limit of the aggregate policer. If the two bandwidth limits are equal, then non-EF traffic passes through the interface unrestricted only while no EF traffic arrives at the interface.
EF traffic is guaranteed the bandwidth specified as the premium bandwidth limit, while non-EF traffic is rate-limited to the amount of aggregate bandwidth not currently consumed by the EF traffic. Non-EF traffic is rate-limited to the entire aggregate bandwidth only while no EF traffic is present.
For example, suppose that you configure a hierarchical policer with the following components:
-
Premium policer with bandwidth limit set to 2 Mbps, burst-size limit set to 3000 bytes, and nonconforming action set to discard packets.
-
Aggregate policer with bandwidth limit set to 10 Mbps, burst-size limit set to 3000 bytes, and nonconforming action set to discard packets.
EF traffic is guaranteed a bandwidth of 2 Mbps. Bursts of EF traffic—EF traffic that arrives at the interface at rates above 2 Mbps—can also pass through the interface provided sufficient tokens are available in the 3000-byte bucket. When no tokens are available for a burst of non-EF traffic, packets are rate-limited using policing actions for the premium policer.
Non-EF traffic is metered to a bandwidth limit that ranges between 8 Mbps and 10 Mbps, depending on the average arrival rate of the EF traffic. Bursts of non-EF traffic—non-EF traffic that arrives at the interface at rates above the current limit for non-EF traffic—also pass through the interface provided sufficient tokens are available in the 3000-byte bucket. When non-EF traffic exceeds the currently allowed bandwidth or when no tokens are available for a burst of non-EF traffic, packets are rate-limited using policing actions for the aggregate policer.
Subscriber Services Firewall Policer (ACX7100-48L Devices)
-
Starting Junos Evolved release 23.4R1, you can configure the hierarchical policer on DHCP and PPPoE access models at subscriber interfaces, that is activated during subscriber login or CoA. This feature supports colour coded traffic policing according to the colour classification of a packet. The packet colour is classified with packet matching criteria specified for two user-defined traffic classes. See the Example: Configuring a Hierarchical Policer for Subscriber Services Firewall (ACX7100-48L Devices) section for related configuration examples and limitations of the feature.
See Also
Example: Configuring a Hierarchical Policer
This example shows how to configure a hierarchical policer and apply the policer to ingress Layer 2 traffic at a logical interface on a supported platform.
Requirements
Before you begin, be sure that your environment meets the following requirements:
The interface on which you apply the hierarchical policer is a SONET interface hosted on one of the following routing platforms:
M40e, M120, or M320 edge router with incoming FPCs as SFPC and outgoing FPCs as FFPC.
MX Series, T320, T640, or T1600 core router with Enhanced Intelligent Queuing (IQE) PICs.
No other policer is applied to the input of the interface on which you apply the hierarchical policer.
You are aware that, if you apply the hierarchical policer to logical interface on which an input filter is also applied, the policer is executed first.
Overview
In this example, you configure a hierarchical policer and apply the policer to ingress Layer 2 traffic at a logical interface.
Topology
You apply the policer to the SONET logical interface so-1/0/0.0, which you configure for IPv4 and VPLS traffic. When you apply the
hierarchical policer to that logical interface, both IPv4 and VPLS
traffic is hierarchically rate-limited.
You also configure the logical interface so-1/0/0.1 for MPLS traffic. If you choose to apply the hierarchical policer
to physical interface so-1/0/0, hierarchical policing would
apply to IPv4 and VPLS traffic at so-1/0/0.0 and to MPLS
traffic at so-1/0/0.1.
Configuration
The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Use the CLI Editor in Configuration Mode.
To configure this example, perform the following tasks:
- CLI Quick Configuration
- Defining the Interfaces
- Defining the Forwarding Classes
- Configuring the Hierarchical Policer
- Applying the Hierarchical Policer to Layer 2 Ingress Traffic at a Physical or Logical Interface
CLI Quick Configuration
To quickly configure this example, copy the following
configuration commands into a text file, remove any line breaks, and
then paste the commands into the CLI at the [edit] hierarchy
level.
set interfaces so-1/0/0 unit 0 family inet address 192.168.1.1/24 set interfaces so-1/0/0 unit 0 family vpls set interfaces so-1/0/0 unit 1 family mpls set class-of-service forwarding-classes class fc0 queue-num 0 priority high policing-priority premium set class-of-service forwarding-classes class fc1 queue-num 1 priority low policing-priority normal set class-of-service forwarding-classes class fc2 queue-num 2 priority low policing-priority normal set class-of-service forwarding-classes class fc3 queue-num 3 priority low policing-priority normal set firewall hierarchical-policer policer1 aggregate if-exceeding bandwidth-limit 300m burst-size-limit 30k set firewall hierarchical-policer policer1 aggregate then forwarding-class fc1 set firewall hierarchical-policer policer1 premium if-exceeding bandwidth-limit 100m burst-size-limit 50k set firewall hierarchical-policer policer1 premium then discard set interfaces so-1/0/0 unit 0 layer2-policer input-hierarchical-policer policer1
Defining the Interfaces
Step-by-Step Procedure
To define the interfaces:
Enable configuration of the physical interface.
[edit] user@host# edit interfaces so-1/0/0
Configure logical unit 0.
[edit interfaces so-1/0/0] user@host# set unit 0 family inet address 192.168.1.1/24 user@host# set unit 0 family vpls
If you apply a Layer 2 policer to this logical interface, you must configure at least one protocol family.
Configure logical unit 1.
[edit interfaces so-1/0/0] user@host# set unit 1 family mpls
Results
Confirm the configuration of the interfaces by entering
the show interfaces configuration command. If the command
output does not display the intended configuration, repeat the instructions
in this procedure to correct the configuration.
[edit]
user@host# show interfaces
so-1/0/0 {
unit 0 {
family inet {
address 192.168.1.1/24;
}
family vpls;
}
unit 1 {
family mpls;
}
}
Defining the Forwarding Classes
Step-by-Step Procedure
To define the forwarding classes referenced as aggregate policer actions:
Enable configuration of the forwarding classes.
[edit] user@host# edit class-of-service forwarding-classes
Define the forwarding classes.
[edit class-of-service forwarding-classes] user@host# set class fc0 queue-num 0 priority high policing-priority premium user@host# set class fc1 queue-num 1 priority low policing-priority normal user@host# set class fc2 queue-num 2 priority low policing-priority normal user@host# set class fc3 queue-num 3 priority low policing-priority normal
Results
Confirm the configuration of the forwarding classes referenced
as aggregate policer actions by entering the show class-of-service configuration command. If the command output does not display the
intended configuration, repeat the instructions in this procedure
to correct the configuration.
[edit]
user@host# show class-of-service
forwarding-classes {
class fc0 queue-num 0 priority high policing-priority premium;
class fc1 queue-num 1 priority low policing-priority normal;
class fc2 queue-num 2 priority low policing-priority normal;
class fc3 queue-num 3 priority low policing-priority normal;
}
Configuring the Hierarchical Policer
Step-by-Step Procedure
To configure a hierarchical policer:
Enable configuration of the hierarchical policer.
[edit] user@host# edit firewall hierarchical-policer policer1
Configure the aggregate policer.
[edit firewall hierarchical-policer policer1] user@host# set aggregate if-exceeding bandwidth-limit 300m burst-size-limit 30k user@host# set aggregate then forwarding-class fc1
For the aggregate policer, the configurable actions for a packet in a nonconforming flow are to discard the packet, change the loss priority, or change the forwarding class.
Configure the premium policer.
[edit firewall hierarchical-policer policer1] user@host# set premium if-exceeding bandwidth-limit 100m burst-size-limit 50k user@host# set premium then discard
The bandwidth limit for the premium policer must not be greater than that of the aggregate policer.
For the premium policer, the only configurable action for a packet in a nonconforming traffic flow is to discard the packet.
Results
Confirm the configuration of the hierarchical policer
by entering the show firewall configuration command. If
the command output does not display the intended configuration, repeat
the instructions in this procedure to correct the configuration.
[edit]
user@host# show firewall
hierarchical-policer policer1 {
aggregate {
if-exceeding {
bandwidth-limit 300m;
burst-size-limit 30k;
}
then {
forwarding-class fc1;
}
}
premium {
if-exceeding {
bandwidth-limit 100m;
burst-size-limit 50k;
}
then {
discard;
}
}
}
Applying the Hierarchical Policer to Layer 2 Ingress Traffic at a Physical or Logical Interface
Step-by-Step Procedure
To hierarchically rate-limit Layer 2 ingress traffic for IPv4 and VPLS traffic only on logical interface so-1/0/0.0, reference the policer from the logical interface configuration:
Enable configuration of the logical interface.
[edit] user@host# edit interfaces so-1/0/0 unit 0
When you apply a policer to Layer 2 traffic at a logical interface, you must define at least one protocol family for the logical interface.
Apply the policer to the logical interface.
[edit] user@host# set layer2-policer input-hierarchical-policer policer1
Alternatively, to hierarchically rate-limit Layer 2 ingress traffic for all protocol families and for all logical interfaces configured on physical interface
so-1/0/0, you could reference the policer from the physical interface configuration.
Results
Confirm the configuration of the hierarchical policer
by entering the show interfaces configuration command.
If the command output does not display the intended configuration,
repeat the instructions in this procedure to correct the configuration.
[edit]
user@host# show interfaces
so-1/0/0 {
unit 0 {
layer2-policer {
input-hierarchical-policer policer1;
}
family inet {
address 192.168.1.1/24;
}
family vpls;
}
unit 1 {
family mpls;
}
}
If you are done configuring the device, enter commit from configuration mode.
Verification
Confirm that the configuration is working properly.
- Displaying Traffic Statistics and Policers for the Logical Interface
- Displaying Statistics for the Policer
Displaying Traffic Statistics and Policers for the Logical Interface
Purpose
Verify the traffic flow through the logical interface and that the policer is evaluated when packets are received on the logical interface.
Action
Use the show interfaces operational mode command
for logical interface so-1/0/0.0, and include the detail or extensive option. The command output section
for Traffic statistics lists the number
of bytes and packets received and transmitted on the logical interface,
and the Protocol inet section contains
a Policer field that would list the policer policer1 as an input or output policer as follows:
Input: policer1-so-1/0/0.0-inet-i
Output: policer1-so-1/0/0.0-inet-o
In this example, the policer is applied to logical interface traffic in the input direction only.
Displaying Statistics for the Policer
Purpose
Verify the number of packets evaluated by the policer.
Action
Use the show policer operational mode command and optionally specify the name of
the policer. The command output displays the number of packets evaluated
by each configured policer (or the specified policer), in each direction.
For the policer policer1, the input and output policer
names are displayed as follows:
policer1-so-1/0/0.0-inet-i
policer1-so-1/0/0.0-inet-o
The -inet-i suffix denotes a policer applied to IPv4 input traffic, while the -inet-o suffix denotes a policer applied to IPv4 output traffic. In this example, the policer is applied to input traffic only.
Example: Configuring a Hierarchical Policer for Subscriber Services Firewall (ACX7100-48L Devices)
This example shows how to configure a hierarchical policer and apply the policer to ingress traffic at a subscriber interface on a supported platform (ACX7100-48L).
Overview
Starting Junos Evolved release 23.4R1, you can configure hierarchical policers and apply the policers to ingress traffic at a subscriber interface. This feature is supported on ACX7100-48L devices.
-
The subscriber services hierarchical policer has the following limitations:
-
You can configure only four levels of hierarchical policers with each level having aggregate and premium configuration.
-
Logical interface policers and aggregate policers are not supported for subscriber services.
- Policing priority set inside forwarding class is not supported.
For example:
class-of-service { forwarding-classes { class BestEffort queue-num 0 priority low policing-priority normal; } } next termis allowed only for hierarchical policers and not for filters.- Attaching policers directly to an interface or family is not supported. Policers are supported only through firewall filter action.
- Policer action
forwarding-classis not supported in ingress and egress.loss-priority highaction is supported in ingress. Onlydiscardaction is supported in egress. - A single policy cannot have
loss-priorityandpoliceractions configured. Only one of both actions are supported at any given time. filter-specificoption is not supported in policer configuration.- Hierarchical policers and tri-color policers are not supported in the Egress direction.
-
Filter terms chaining feature is not available.
-
Tri-color policer and hierarchical policers are not supported in Egress direction.
-
Configuration Scenarios
The following section provides the different configurations for various hierarchical policer options:
- Single Rate Two Color Marking Policer Configuration Single Rate Tri Color Marking Policer Configuration
- Two Rate Tri Color Marking Policer
- Hierarchical Policer for DHCP and PPPoE
Single Rate Two Color Marking Policer Configuration
You can configure single rate two color marking policer on DHCP and PPPoE
access models. The configuration is activated during subscriber login or
CoA. View the configuration by entering the show
dynamic-profiles pppoe-client-policer-1-profile command. A
sample configuration is as follows:
[edit]
root@bng-controller# show dynamic-profiles pppoe-client-policer-1-profile
variables {
downstream-inet uid;
upstream-inet uid;
HPolicer-in uid;
HPolicer-out uid;
}
interfaces {
pp0 {
unit "$junos-interface-unit" {
actual-transit-statistics;
no-traps;
ppp-options {
chap;
pap;
}
pppoe-options {
underlying-interface "$junos-underlying-interface";
server;
}
keepalives interval 30;
family inet {
filter {
input "$upstream-inet";
output "$downstream-inet";
}
unnumbered-address lo0.0;
}
family inet6 {
unnumbered-address lo0.0;
}
}
}
}
firewall
{
family inet
{
filter "$downstream-inet"
{
interface-specific;
term t1 {
from {
source-port 80;
}
then {
policer "$HPolicer-in";
accept;
}
}
}
filter "$upstream-inet" {
interface-specific;
term t1 {
from {
source-port 80;
}
then {
policer "$HPolicer-out";
accept;
}
}
}
}
policer "$HPolicer-in" {
if-exceeding {
bandwidth-limit 5m;
burst-size-limit 5k;
}
then discard;
}
policer "$HPolicer-out" {
if-exceeding {
bandwidth-limit 10m;
burst-size-limit 10k;
}
then discard;
}
}
You can configure single rate tri-color marking policer on DHCP and PPPoE
access models. It is activated during subscriber login or CoA. View the
configuration by entering the show dynamic-profiles
pppoe-client-policer-1-profile command. A sample
configuration is as follows:
[edit]
user@bng-controller# show dynamic-profiles pppoe-client-policer-2-profile | no-more
variables
{
downstream-inet uid;
upstream-inet uid;
HPolicer-in uid;
HPolicer-out uid;
}
interfaces
{
pp0
{
unit "$junos-interface-unit" {
actual-transit-statistics;
no-traps;
ppp-options
{
chap;
pap;
}
pppoe-options
{
underlying-interface "$junos-underlying-interface";
server;
}
keepalives interval 30;
family inet {
filter {
input "$upstream-inet";
output "$downstream-inet";
}
unnumbered-address lo0.0;
}
family inet6 {
unnumbered-address lo0.0;
}
}
}
}
firewall {
family inet {
filter "$downstream-inet" {
interface-specific;
term t1 {
from {
source-port 80;
}
then {
policer "$HPolicer-out";
accept;
}
}
}
filter "$upstream-inet" {
interface-specific;
term t1 {
from {
source-port 80;
}
then {
three-color-policer {
single-rate "$HPolicer-in";
}
count three-color-policer-count;
accept;
}
}
}
}
policer "$HPolicer-out" {
if-exceeding {
bandwidth-limit 10m;
burst-size-limit 10k;
}
then discard;
}
three-color-policer "$HPolicer-in" {
action {
loss-priority high then discard;
}
single-rate {
color-blind;
committed-information-rate 5m;
committed-burst-size 5k;
excess-burst-size 15k;
}
}
}
Two Rate Tri Color Marking Policer
You can configure two rate tri color marking policer on DHCP and PPPoE access models. It is activated during subscriber login or CoA.
In this section you can see a sample dynamic profile configuration on
controller point. Contents of dynamic profile are propagated forward during
subscriber login for a client profile or during service activation for a
service profile. View the configuration by entering the show
dynamic-profiles pppoe-client-policer-1-profile command. A
sample configuration is as follows:
[edit]
root@bng-controller# show dynamic-profiles pppoe-client-policer-3-profile | no-more
variables {
downstream-inet uid;
upstream-inet uid;
HPolicer-in uid;
HPolicer-out uid;
}
interfaces {
pp0 {
unit "$junos-interface-unit" {
actual-transit-statistics;
no-traps;
ppp-options {
chap;
pap;
}
pppoe-options {
underlying-interface "$junos-underlying-interface";
server;
}
keepalives interval 30;
family inet {
filter {
input "$upstream-inet";
output "$downstream-inet";
}
unnumbered-address lo0.0;
}
family inet6 {
unnumbered-address lo0.0;
}
}
}
}
firewall {
family inet {
filter "$downstream-inet" {
interface-specific;
term t1 {
from {
source-port 80;
}
then {
policer "$HPolicer-out";
accept;
}
}
}
filter "$upstream-inet" {
interface-specific;
term t1 {
from {
source-port 80;
}
then {
three-color-policer {
two-rate "$HPolicer-in";
}
count three-color-policer-count;
accept;
}
}
}
}
policer "$HPolicer-out" {
if-exceeding {
bandwidth-limit 10m;
burst-size-limit 10k;
}
then discard;
}
three-color-policer "$HPolicer-in" {
action {
loss-priority high then discard;
}
two-rate {
color-blind;
committed-information-rate 5m;
committed-burst-size 5k;
peak-information-rate 10m;
peak-burst-size 10k;
}
}
}
Hierarchical Policer for DHCP and PPPoE
In this section you can see a sample dynamic profile configuration at the
controller point on DHCP and PPPoE access models. Contents of dynamic
profile are propagated forward during subscriber login for a client
profile or during service activation for a service profile. View the
configuration by entering the show dynamic-profiles
pppoe-client-policer-1-profile command. A sample
configuration is as follows:
[edit]
user@host# show dynamic-profiles pppoe-client-policer-4-profile
variables {
downstream-inet uid;
upstream-inet uid;
HPolicer-in uid;
HPolicer-out uid;
P0-IN uid;
P1-IN uid;
P2-IN uid;
Session-IN uid;
}
interfaces {
pp0 {
unit "$junos-interface-unit" {
actual-transit-statistics;
no-traps;
ppp-options {
chap;
pap;
}
pppoe-options {
underlying-interface "$junos-underlying-interface";
server;
}
keepalives interval 30;
family inet {
filter {
input "$upstream-inet";
output "$downstream-inet";
}
unnumbered-address lo0.0;
}
family inet6 {
unnumbered-address lo0.0;
}
}
}
}
firewall {
family inet {
filter "$downstream-inet" {
interface-specific;
term t1 {
from {
source-port 80;
}
then {
policer "$HPolicer-out";
accept;
}
}
}
filter "$upstream-inet" {
interface-specific;
term P0-Aggregate {
from {
dscp 46;
}
then {
hierarchical-policer "$P0-IN";
next term;
}
}
term P1-Premium {
from {
dscp [ 46 22 ];
}
then {
force-premium;
next term;
}
}
term P1-Aggregate {
from {
dscp [ 46 22 ];
}
then {
hierarchical-policer "$P1-IN";
next term;
}
}
term P2-Premium {
from {
dscp [ 46 22 56 ];
}
then {
force-premium;
next term;
}
}
term P2-Aggregate {
from {
dscp [ 46 22 56 ];
}
then {
hierarchical-policer "$P2-IN";
next term;
}
}
term final-Premium {
from {
dscp [ 46 22 56 00 ];
}
then {
force-premium;
next term;
}
}
term final {
then {
hierarchical-policer "$Session-IN";
accept;
}
}
}
}
policer "$HPolicer-out" {
if-exceeding {
bandwidth-limit 10m;
burst-size-limit 10k;
}
then discard;
}
hierarchical-policer "$HPolicer-in" {
aggregate {
if-exceeding {
bandwidth-limit 30m;
burst-size-limit 30k;
}
then {
loss-priority high;
}
}
premium {
if-exceeding {
bandwidth-limit 10m;
burst-size-limit 10k;
}
then {
discard;
}
}
}
hierarchical-policer "$P0-IN" {
logical-interface-policer;
aggregate {
if-exceeding {
bandwidth-limit 5m;
burst-size-limit 5k;
}
then {
discard;
}
}
premium {
if-exceeding {
bandwidth-limit 5m;
burst-size-limit 5k;
}
then {
discard;
}
}
}
hierarchical-policer "$P1-IN" {
logical-interface-policer;
aggregate {
if-exceeding {
bandwidth-limit 5m;
burst-size-limit 5k;
}
then {
discard;
}
}
premium {
if-exceeding {
bandwidth-limit 5m;
burst-size-limit 5k;
}
then {
discard;
}
}
}
hierarchical-policer "$P2-IN" {
logical-interface-policer;
aggregate {
if-exceeding {
bandwidth-limit 5m;
burst-size-limit 5k;
}
then {
discard;
}
}
premium {
if-exceeding {
bandwidth-limit 5m;
burst-size-limit 5k;
}
then {
discard;
}
}
}
hierarchical-policer "$Session-IN" {
logical-interface-policer;
aggregate {
if-exceeding {
bandwidth-limit 5m;
burst-size-limit 5k;
}
then {
discard;
}
}
premium {
if-exceeding {
bandwidth-limit 5m;
burst-size-limit 5k;
}
then {
discard;
}
}
}
}
If you are done configuring the device, enter commit
from configuration mode.