Order of Policer and Firewall Filter Operations

You can apply a both a traffic policer and a stateless firewall filter (with or without policing actions) to a single logical interface at the same time. In this case, the order of precedence of operations is such that policers applied directly to the logical interface are evaluated before input filters but after output filters.

• If an input firewall filter is configured on the same logical interface as a policer, the policer is executed first.

• If an output firewall filter is configured on the same logical interface as a policer, the firewall filter is executed first.

Figure 1 illustrates the order of policer and firewall filter processing at the same interface.

Figure 1: Incoming and Outgoing Policers and Firewall Filters