Junos® OS Ethernet Interfaces Configuration ... - Juniper Networks

Forwarding Untagged
Layer2 Control Packets
to Queue 3
Copyright © 2012, Juniper Networks, Inc.
occurs in this ingress control queue due to this malicious traffic, the provider's network
control packets may be affected.
In some applications, this can be perceived as a new vulnerability. To address this concern,
you can disable the control queue feature. With the control queue feature disabled, you
must take precautions to protect control traffic through other means, such as mapping
control packets (using BA classification) to a queue that is marked strict-high or is
configured with a high CIR.
You can disable the control queue for all ports on the PIC. To disable the control queue,
use the set chassis fpc n pic n no-pre-classifier command. By default, the no-pre-classifier
statement is not configured and the control queue is operational.
Deleting the no-pre-classifier statement re-enables the control queue feature on all ports
of the 10-Gigabit Ethernet LAN/WAN PIC.
NOTE:
• This functionality is applicable both in OSE and line-rate modes.
• The control queue feature is enabled by default in both OSE and line-rate
modes, which can be overridden by the user configuration.
• When the control queue is disabled, various show queue commands will
show control queue in the output. However, all control queue counters are
reported as zeros.
• Changing this configuration (enabling or disabling the control queue
feature) results in the PIC being taken offline and brought back online.
Once the control queue is disabled, the Layer 2/Layer 3 control packets are subject to
queue selection based on BA classification. However, some control protocol packets will
not be classified using BA classification, because they might not have a VLAN, MPLS, or
IP header. These are:
• Untagged ARP packets
• Untagged Layer 2 control packets such as LACP or Ethernet OAM
• Untagged IS-IS packets
When the control queue feature is disabled, untagged ARP, IS-IS, and other untagged
Layer 2 control packets will go to the restricted queue corresponding to the forwarding
class associated with queue 0, as shown in the following two examples.
With this configuration, the forwarding class (FC) associated with queue 0 is "be" (based
on the forwarding-class statement configuration). "be" maps to restricted-queue number
3 (based on the "restricted-queue" configuration). Hence, with this particular
configuration, untagged ARP, IS-IS, and other untagged Layer 2 control packets will go
to ingress queue 3 (not to ingress queue 0).
[edit chassis]
forwarding-classes {
queue 0 be;
Chapter 22: Configuring 10-Gigabit Ethernet LAN/WAN PICs
347