Discussion

which traffic is more important and which traffic should just be discarded when congestion
occurs. It also provides protection against DoS attacks. You set up packet
rate limiting by configuring policers that define the conditions under which traffic is
dropped.
This recipe sets up rate limiting for ICMP traffic. These policers traffic can be dropped
if the flow exceeds a set bandwidth or if a burst of packets exceeds a certain size. The
first command accepts ICMP traffic flowing at a sustained rate of up to 1 Mbps and
drops all packets when this rate is exceeded (if-exceeding bandwidth-limit 1m).
The second command accepts traffic bursts up to 50 Kbps and drops all packets
when this rate is exceeded (if-exceeding burst-size-limit 50k). When the flow of
ICMP packets exceeds either limit, all ICMP traffic will be discarded until the flow
rate subsides. To verify the configuration and see if any traffic has been discarded,
use the show firewall filter command:
aviva@RouterF> show firewall filter incoming-to-me
Filter: incoming-to-me
Counters:
Name Bytes Packets
incoming-accepted 160 2
Policers:
Name
Packets
limit-icmp-icmp 0
The policer counters are shown at the end of the output. The policer name is a concatenation
of the policer name (limit-icmp) and the term in which it is used (icmp).
At this point, no congestion has occurred, so no packets have been discarded as a
result of the policer.
Before configuring a policer, you need to have some idea of what normal traffic loads
are on your network and on your router. You generally do this with your network
traffic management tools. You can also gather some of this data from the router itself
by configuring counters for each term in the firewall filter over a representative
period of time, generally several days or weeks. The following command adds a
counter to the icmp term:
[edit firewall filter incoming-to-me]
aviva@RouterF# set term icmp then count icmp-counter
Then use the show firewall filter command to see the statistics:
aviva@RouterF> show firewall filter incoming-to-me
Filter: incoming-to-me
Counters:
Name Bytes Packets
icmp-counter 0 0
incoming-accepted 1680 25
Limiting Traffic on an Interface | 319
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.