Policy Framework Configuration Guide - Juniper Networks

Junos 10.4 Policy Framework Configuration Guide
Physical Interface Policers Configuration
A physical interface policer defines rate-limiting parameters for all the logical interfaces
and protocol families configured on a physical interface. These logical interfaces can
belong to different routing instances. You reference the policer within one or more firewall
filters. You must also apply the physical interface policer as an action for each term used
to define a set of match conditions for traffic on which you want to perform rate limiting.
You apply the firewall filters as input or output filters to the logical interfaces configured
on the physical interface referenced in the policer.
The following sections describe how to configure a physical interface policer, reference
the policer within a firewall filter, apply the policer as an action for a firewall filter, and
apply (to a logical interface) a firewall filter that references a physical interface filter.
• Configuring Physical Interface Policers on page 306
• Configuring Firewall Filters That Reference Physical Interface Policers on page 307
• Applying Firewall Filters That Reference Physical Interface Policers on page 308
Configuring Physical Interface Policers
To configure a policer for a physical interface:
1. Include the physical-interface-policer statement at the [edit firewall policer
policer-name] hierarchy level.
2. Include the if-exceeding statement at the [edit firewall policer policer-name] hierarchy
level to define rate-limiting parameters for the policer.
For the if-exceeding statement, you must configure the following parameters:
• bandwidth-limit bps—Traffic rate, in bits per second (bps)
• burst-size-limit bytes—Maximum burst size, in bytes
3. Include the then policer-action statement at the [edit firewall policer policer-name]
hierarchy level to apply an action to the policer.
For policer-action, you can apply the following:
• discard—Discard a packet that exceeds the rate limits
• loss-priority level—Set the loss priority level to low, medium-low, medium-high, high.
• forwarding-class class-name—Specify the forwarding class for any class-name
already configured.
In the following example, a physical interface policer, shared-police1, is configured to
rate-limit traffic at 100,000,000 bps and to permit a maximum burst of traffic of 500,000
bytes. The discard action results in the discarding of packets that exceed the configured
rate limits.
[edit]
firewall {
306
Copyright © 2010, Juniper Networks, Inc.