Multifield Classification; Order Of Policer And Firewall Filter Operations - Juniper EX9200 Features Manual

Related
Documentation

Order of Policer and Firewall Filter Operations

Copyright © 2016, Juniper Networks, Inc.

Multifield Classification

Like behavior aggregate (BA) classification, which is sometimes referred to as
class-of-service (CoS) value traffic classification, multifield classification is a method
of classifying incoming traffic by associating each packet with a forwarding class, a packet
loss priority level, or both. The CoS scheduling configuration assigns packets to output
queues based on forwarding class. The CoS random early detection (RED) process uses
the drop probability configuration, output queue fullness percentage, and packet loss
priority to drop packets as needed to control congestion at the output stage.
BA classification and multifield classification use different fields of a packet to perform
traffic classification. BA classification is based on a CoS value in the IP packet header.
Multifield classification can be based on multiple fields in the IP packet header, including
CoS values. Multifield classification is used instead of BA classification when you need
to classify packets based on information in the packet other than the CoS values only.
Multifield classification is configured using a stateless firewall filter term that matches
on any packet header fields and associates matched packets with a forwarding class, a
loss priority, or both. The forwarding class or loss priority can be set by a firewall filter
action or by a policer referenced as a firewall filter action.
Controlling Network Access Using Traffic Policing Overview on page 3
Order of Policer and Firewall Filter Operations on page 11
Two-Color Policer Configuration Overview on page 49
Three-Color Policer Configuration Overview on page 145
Two-Color Policing at Layer 2 Overview on page 39
Three-Color Policing at Layer 2 Overview on page 41
You can apply a both a traffic policer and a stateless firewall filter (with or without policing
actions) to a single logical interface at the same time. In this case, the order of precedence
of operations is such that policers applied directly to the logical interface are evaluated
before input filters but after output filters.
If an input firewall filter is configured on the same logical interface as a policer, the
policer is executed first.
If an output firewall filter is configured on the same logical interface as a policer, the
firewall filter is executed first.
Figure 2 on page 12 illustrates the order of policer and firewall filter processing at the
same interface.
Chapter 1: Understanding Traffic Policers
11