Specifying Policers In A Firewall Filter Configuration; Applying A Firewall Filter That Is Configured With A Policer - Juniper JUNOS OS 10.3 - SOFTWARE Manual

Complete Software Guide for Junos

Specifying Policers in a Firewall Filter Configuration

Applying a Firewall Filter That Is Configured with a Policer

3074
®
OS for EX Series Ethernet Switches, Release 10.3
Specify the name of the policer:
1.
[edit firewall]
user@switch# set policer policer-one
The policer name can contain letters, numbers, and hyphens (-) and can be up to 64
characters long.
Configure rate limiting for the policer:
2.
Specify the bandwidth limit in bits per second (bps) to control the traffic rate on
a.
an interface:
[edit firewall policer policer-one]
user@switch# set if-exceeding bandwidth-limit 300k
The range for the bandwidth limit is 1k through 102.3g bps.
Specify the maximum allowed burst size to control the amount of traffic bursting:
b.
[edit firewall policer policer-one]
user@switch# set if-exceeding burst-size-limit 500k
To determine the value for the burst-size limit, multiply the bandwidth of the
interface on which the filter is applied by the amount of time to allow a burst of
traffic at that bandwidth to occur:
burst size = bandwidth * allowable time for burst traffic
The range for the burst-size limit is 1 through 2,147,450,880 bytes.
Specify the policer action
3.
[edit firewall policer]
user@switch# set policer-one then discard
Discard is the only supported policer action.
To reference a policer for a single firewall, configure a filter term that includes the policer
action:
[edit firewall family ethernet-switching]
user@switch# set filter limit-hosts term term-one from source-address 192.0.2.16/28
userswitch# set filter limit-hosts term term-one then policer policer-one
A firewall filter that is configured with one or more policer actions, like any other filter,
must be applied to a port, VLAN, or Layer 3 interface. For information about applying
firewall filters, see the sections on applying firewall filters in "Configuring Firewall Filters
(CLI Procedure)" on page 3063.
NOTE: You can include policer actions on ingress firewall filters only.
to discard packets that exceed the rate limits:
discard
Copyright © 2010, Juniper Networks, Inc.