Policy Framework Configuration Guide - Juniper Networks

Chapter 11: Policer Configuration
Configuring Two-Rate Three-Color Policers
• Two-Rate Three-Color Policer Overview on page 289
• Configuring a Two-Rate Three-Color Policer on page 290
Two-Rate Three-Color Policer Overview
Two-rate three-color policing uses two bandwidth limits: one for guaranteed traffic and
one for peak traffic [also called a committed information rate (CIR) and a peak
information rate (PIR)]. This policer also has two burst sizes: the committed burst size
and the peak burst size. The main difference between a single-rate and a two-rate policer
is that the two-rate policer allows sustained bursts of traffic. In single-rate three-color
policing, bursts of traffic are allowed for short periods. A period of relatively low activity
has to occur between the bursts to allow the second token bucket to refill. In two-rate
policing, the second bucket does not rely on overflow from the first token bucket; this
enables the second token bucket to maintain a steadier supply of tokens, thus allowing
sustained bursts of traffic.
The policer classifies traffic into three groups: traffic that conforms to the CIR limit and
the committed burst size, traffic that exceeds the CIR or committed burst size but
conforms to the PIR, and traffic that exceeds the PIR. Each category is associated with
an action. For traffic that conforms to the CIR and the committed burst size (also called
green traffic), the action is to mark the packet with an implicit low loss priority and transmit
the packet. For traffic that exceeds the CIR or committed burst size but conforms to the
PIR (also called yellow traffic), the action is to mark the packet with an implicit loss
priority of medium-high and then transmit the packet. For traffic that exceeds the PIR,
the action is to mark the packet with an implicit loss priority of high and, optionally, to
discard the packet. If congestion occurs downstream, the packets with higher loss priority
are more likely to be discarded.
NOTE: The discard action for a tricolor marking policer for a firewall filter is
supported on the M120, M320 with Enhanced-III FPCs, M7i and M10i with the
Enhanced CFEB (CFEB-E), and the MX Series routers, so it is not necessary
to include the logical-interface-policer statement for them.
The following configuration demonstrates how the policer works in a sample scenario.
firewall {
three-color-policer policer2 {
logical-interface-policer;
action {
loss-priority high then discard;
}
two-rate {
color-aware;
committed-information-rate 40m;
committed-burst-size 100k;
peak-information-rate 60m;
peak-burst-size 200k;
Copyright © 2010, Juniper Networks, Inc.
289