Example: Limiting Inbound Traffic At Your Network Border By Configuring An Ingress Single-Rate Two-Color Policer - Juniper EX9200 Features Manual

Traffic Policers Feature Guide for EX9200 Switches
Related
Documentation
Example: Limiting Inbound Traffic at Your Network Border by Configuring an Ingress
Single-Rate Two-Color Policer
Requirements
56
To rate-limit Layer 3 traffic, you can apply a two-color policer in the following ways:
Directly to a logical interface, at a specific protocol level.
As the action of a standard stateless firewall filter that is applied to a logical interface,
at a specific protocol level.
To rate-limit Layer 2 traffic, you can apply a two-color policer as a logical interface policer
only. You cannot apply a two-color policer to Layer 2 traffic through a firewall filter.
Two-Color Policer Configuration Overview on page 49
Example: Limiting Inbound Traffic at Your Network Border by Configuring an Ingress
Single-Rate Two-Color Policer on page 56
Example: Configuring Interface and Firewall Filter Policers at the Same Interface on
page 64
This example shows you how to configure an ingress single-rate two-color policer to
filter incoming traffic. The policer enforces the class-of-service (CoS) strategy for
in-contract and out-of-contract traffic. You can apply a single-rate two-color policer to
incoming packets, outgoing packets, or both. This example applies the policer as an input
(ingress) policer. The goal of this topic is to provide you with an introduction to policing
by using a example that shows traffic policing in action.
Policers use a concept known as a token bucket to allocate system resources based on
the parameters defined for the policer. A thorough explanation of the token bucket
concept and its underlying algorithms is beyond the scope of this document. For more
information about traffic policing, and CoS in general, refer to QOS-Enabled
Networks—Tools and Foundations by Miguel Barreiros and Peter Lundqvist. This book is
available at many online booksellers and at www.juniper.net/books.
Requirements on page 56
Overview on page 57
Configuration on page 59
Verification on page 63
To verify this procedure, this example uses a traffic generator. The traffic generator can
be hardware-based or it can be software running on a server or host machine.
The functionality in this procedure is widely supported on devices that run Junos OS. The
example shown here was tested and verified on MX Series routers running Junos OS
Release 10.4.
Copyright © 2016, Juniper Networks, Inc.