Scenario 2: Subnet Prefix Is Longer Than The Prefix In The Filter Match Condition - Juniper EX9200 Features Manual

Traffic Policers Feature Guide for EX9200 Switches

Scenario 2: Subnet Prefix Is Longer Than the Prefix in the Filter Match Condition

110
source-address {
10.10.10.0/24;
10.11.0.0/16;
}
}
then prefix-action psa-1Mbps-per-source-24-32-256;
}
}
}
}
interfaces {
so-0/0/2 {
unit 0 {
family inet {
filter {
input limit-source-two-24-16;
}
address 10.39.1.1/16;
}
}
}
}
The complete example, "Example: Configuring Prefix-Specific Counting and Policing" on
page 100, shows the simplest case of prefix-specific actions, in which the single-term
firewall filter matches on one address with a prefix length that is the same as the subnet
prefix length specified in the prefix-specific action. Unlike the example, this scenario
describes a configuration in which the prefix-specific action defines a subnet prefix length
that is longer than the prefix of the source address matched by the firewall filter. In this
case, the prefix-specific action defines a subnet-prefix value of
matches on a source address in the
NOTE: The firewall filter passes the prefix-specific action packets with source
addresses that range from
prefix-specific action specifies a set of only 128 counters and policers,
numbered from 0 through 127.
The filter-matched packets that are passed to the prefix-specific action index into the
counter and policer set in such a way that the counting and policing instances are shared
by packets that contain either of two source addresses within the
The first counter and policer in the set are indexed by packets with source addresses
10.10.10.0 and 10.10.10.128
The second counter and policer in the set are indexed by packets with source addresses
and
10.10.10.1 10.10.10.129
The 128th (last) counter and policer in the set are indexed by packets with source
addresses 10.10.10.127 and
/24 subnet.
10.10.10.0 through
.
.
10.10.10.255 .
, while the firewall filter
25
10.10.10.255 , while the
subnet:
10.10.10.0/24
Copyright © 2016, Juniper Networks, Inc.