Policy Framework Configuration Guide - Juniper Networks

Chapter 11: Policer Configuration
policer shared-police1 {
physical-interface-policer;
if-exceeding {
bandwidth-limit 100m;
burst-size-limit 500k;
}
then {
discard;
}
}
}
Configuring Firewall Filters That Reference Physical Interface Policers
To use a physical interface policer, you must reference it in a firewall filter. For each filter,
you also configure one or more terms for which you configure match conditions to define
the types of traffic on which you limit traffic. To apply the policer to traffic that meets
the match conditions in a term, you configure the physical interface policer as an action
for the term.
To configure a firewall filter that references a physical interface policer:
1. Include the physical-interface-filter statement at the [edit firewall family family-name
filter filter-name] hierarchy level.
NOTE: You cannot specify family any. You must configure a specific
protocol family for a firewall filter that references a physical interface
policer.
2. Include the term term-name statement at the [edit firewall family family-name filter
filter-name] hierarchy level to define a term.
3. Include the from match-conditions statement at the [edit firewall family family-name
filter filter-name term term-name] hierarchy level to define the characteristics that
packets must have to have rate limiting performed as defined in the physical interface
policer.
For more information about configuring specific match conditions, see “Overview of
Match Conditions in Firewall Filter Terms” on page 197.
4. Include the then policer policer-name statement at the [edit firewall family family-name
filter filter-name term term-name] hierarchy level to apply the specified physical
interface policer as an action for the specified term. The rate-limiting parameters
defined in the physical interface policer are performed on any traffic that matches
the conditions defined in the term.
In the following example, a firewall filter is configured that references a physical interface
filter. The filter is configured with family inet as the protocol family. A term tcp-police-1
is defined to match any IPv4 traffic that is received through TCP with the IP precedence
fields critical-ecp, immediate, or priority. IPv4 traffic that matches these characteristics
has rate limiting performed, as defined in the shared-police1 policer, which is applied as
an action to the term tcp-police-1. A second term, tcp-police-2, is defined to match IPv4
Copyright © 2010, Juniper Networks, Inc.
307