Policy Framework Configuration Guide - Juniper Networks

CHAPTER 10
Introduction to Traffic Policing
Policer Overview
The following sections describe:
• Policer Overview on page 277
• Policer Types on page 278
• Policer Actions on page 278
• Order of Policer and Firewall Filter Operations on page 279
• Policer Levels on page 280
• Rate Limiting on page 280
• Color Modes for Three-Color Policers on page 281
Policing, or rate limiting, enables you to limit the amount of traffic that passes into or out
of an interface. It is an essential component of firewall filters that is designed to thwart
denial-of-service (DoS) attacks. Networks police traffic by limiting the input or output
transmission rate of a class of traffic on the basis of user-defined criteria. Policing traffic
allows you to control the maximum rate of traffic sent or received on an interface and
to partition a network into multiple priority levels or classes of service.
Policers require that you apply limits to the traffic flow and set a consequence for packets
that exceed these limits—usually a higher loss priority—so that if packets encounter
downstream congestion, they are discarded first.
Policing uses the token-bucket algorithm, which enforces a limit on average bandwidth
while allowing bursts up to a specified maximum value. It offers more flexibility than the
leaky bucket algorithm in allowing a certain amount of bursty traffic before it starts
discarding packets.
You can define specific classes of traffic on an interface and apply a set of rate limits to
each. You can use a policer in one of two ways: as part of a filter configuration or as part
of a logical interface (where the policer is applied to all traffic on that interface).
After you have defined and named a policer, it is stored as a template. You can later use
the same policer name to provide the same policer configuration each time you wish to
use it. This eliminates the need to define the same policer values more than once.
Copyright © 2010, Juniper Networks, Inc.
277