Juniper JUNOS OS 10.3 - SOFTWARE Manual page 3141

Step-by-Step
Procedure
Copyright © 2010, Juniper Networks, Inc.
To configure and apply a port firewall filter to prioritize voice traffic and rate-limit packets
that are destined for the
employee-vlan
Define the policers tcp-connection-policer
1.
[edit]
user@switch# set firewall policer tcp-connection-policer if-exceeding burst-size-limit
30k bandwidth-limit 1m
user@switch# set firewall policer tcp-connection-policer then discard
user@switch# set firewall policer icmp-connection-policer if-exceeding burst-size-limit
30k bandwidth-limit 1m
user@switch# set firewall policer icmp-connection-policer then discard
Define the firewall filter
2.
[edit firewall]
user@switch# set family ethernet-switching filter
ingress-port-voip-class-limit-tcp-icmp
Define the term
3. voip-high
[edit firewall family ethernet-switching filter
ingress-port-voip-class-limit-tcp-icmp ]
user@switch# set term voip-high from source-mac-address 00.05.85.00.00.01
user@switch# set term voip-high from source-mac-address 00.05.85.00.00.02
user@switch# set term voip-high from protocol udp
user@switch# set term voip-high then forwarding-class expedited-forwarding
user@switch# set term voip-high then loss-priority low
Define the term
network-control
4.
[edit firewall family ethernet-switching filter
ingress-port-voip-class-limit-tcp-icmp ]
user@switch# set term network-control from precedence net-control
user@switch# set term network-control then forwarding-class network-control
user@switch# set term network-control then loss-priority low
Define the term
5. tcp-connection
[edit firewall family ethernet-switching filter
ingress-port-voip-class-limit-tcp-icmp]
user@switch# set term tcp-connection from destination-address 192.0.2.16/28
user@switch# set term tcp-connection from protocol tcp
user@switch# set term tcp-connection then policer tcp-connection-policer
user@switch# set term tcp-connection then count tcp-counter
user@switch# set term tcp-connection then forwarding-class best-effort
user@switch# set term tcp-connection then loss-priority high
Define the term icmp-connection
6.
[edit firewall family ethernet-switching filter
ingress-port-voip-class-limit-tcp-icmp]
user@switch# set term icmp-connection from destination-address 192.0.2.16/28
user@switch# set term icmp-connection from protocol icmp
user@switch# set term icmp-connection then policer icmp-policer
user@switch# set term icmp-connection then count icmp-counter
user@switch# set term icmp-connection then forwarding-class best-effort
user@switch# set term icmp-connection then loss-priority high
Define the term
best-effort
7.
packets that did not match any other term in the firewall filter:
Chapter 101: Examples of Firewall Filters Configuration
subnet:
and icmp-connection-policer
ingress-port-voip-class-limit-tcp-icmp
:
:
to configure rate limits for TCP traffic:
to configure rate limits for ICMP traffic:
with no match conditions for an implicit match on all
:
:
3045