ON THIS PAGE
Example: Configuring a Rate-Limiting Filter Based on Destination Class
This example shows how to configure a rate-limiting stateless firewall filter.
Requirements
No special configuration beyond device initialization is required before configuring this example.
Before you begin, configure the destination class class1.
Overview
In this example, you use a stateless firewall filter to set rate limits based on a destination class.
To activate a policer from within a stateless firewall filter configuration:
Create a template for the policer by including the
policer policer-namestatement.Reference the policer in a filter term that specifies the policer in the
policer policer-namenonterminating action.
You can also activate a policer by including the policer (input | output) policer-template-name statement at a logical interface.
Configuration
The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Use the CLI Editor in Configuration Mode.
- CLI Quick Configuration
- Configure the Stateless Firewall Filter
- Apply the Stateless Firewall Filter to a Logical Interface
- Confirm and Commit Your Candidate Configuration
CLI Quick Configuration
To quickly configure this example, copy the following commands into a text file,
remove any line breaks, and then paste the commands into the CLI at the [edit] hierarchy
level.
set firewall policer police_class1 if-exceeding bandwidth-limit 25m set firewall policer police_class1 if-exceeding burst-size-limit 25m set firewall policer police_class1 then discard set firewall filter rl_dclass1 term term1 from destination-class class1 set firewall filter rl_dclass1 term term1 then policer police_class1 set interfaces ge-0/0/1 unit 0 family inet address 10.1.2.1/30 set interfaces ge-0/0/1 unit 0 family inet filter input rl_dclass1
Configure the Stateless Firewall Filter
Step-by-Step Procedure
To configure the stateless firewall filter rl_dclass1 with policer police_class1 for destination class class1:
Create the policer template
police_class1.[edit] user@host# edit firewall policer police_class1
Configure the policer template
police_class1.[edit firewall policer police_class1] user@host# set if-exceeding bandwidth-limit 25m user@host# set if-exceeding burst-size-limit 25m user@host# set then discard
Create the stateless firewall filter
rl_dclass1.[edit] user@host# edit firewall filter rl_dclass1
Configure a filter term that uses policer
police_class1to rate-limit traffic for destination classclass1.[edit firewall filter rl_dclass1] user@host# set term term1 from destination-class class1 user@host# set term term1 then policer police_class1
Apply the Stateless Firewall Filter to a Logical Interface
Step-by-Step Procedure
To apply the filter rl_dclass1 to a logical interface:
Configure the logical interface to which you will apply the stateless firewall filter.
[edit] user@host# edit interfaces ge-0/0/1 unit 0 family inet
Configure the interface address for the logical interface.
[edit interfaces ge-0/0/1 unit 0 family inet] user@host# set address 10.1.2.1/30
Apply the stateless firewall filter to the logical interface.
[edit interfaces ge-0/0/1 unit 0 family inet] user@host# set filter input rl_dclass1
Confirm and Commit Your Candidate Configuration
Step-by-Step Procedure
To confirm and then commit your candidate configuration:
Confirm the configuration of the stateless firewall filter by entering the
show firewallconfiguration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.[edit] user@host# show firewall policer police_class1 { if-exceeding { bandwidth-limit 25m; burst-size-limit 25m; } then discard; } filter rl_dclass1 { term term1 { from { destination-class class1; } then policer police_class1; } }Confirm the configuration of the interface by entering the
show interfacesconfiguration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.[edit] user@host# show interfaces ge-0/0/1 { unit 0 { family inet { filter { input rl_dclass1; } address 10.1.2.1/30; } } }If you are done configuring the device, commit your candidate configuration.
[edit] user@host# commit
Verification
To confirm that the configuration is working properly, enter the show class-of-service ge-0/0/1 operational
mode command.