Policy Framework Configuration Guide - Juniper Networks

Junos 10.4 Policy Framework Configuration Guide
traffic received through TCP with the IP precedence fields internet-control or routine.
IPv4 traffic that matches these characteristics has rate limiting performed, as defined in
the shared-police1 policer, which is applied as an action to the term tcp-police-2.
[edit firewall]
family inet {
filter inet-filter {
physical-interface-filter;
term tcp-police-1 {
from {
precedence [ critical-ecp immediate priority ];
protocol tcp;
}
then policer shared-police1;
}
term tcp-police-2 {
from {
precedence [ internet-control routine ];
protocol tcp;
}
then policer shared-police1
}
}
}
Applying Firewall Filters That Reference Physical Interface Policers
After you configure a firewall filter that references a physical interface policer, you apply
it as an input or an output filter to a logical interface.
To apply a firewall filter that references a physical interface policer as an input filter:
• Include the input filter-name statement at the [edit interfaces interface-name unit
logical-unit-number family family-name filter] hierarchy level.
To apply a firewall filter that references a physical interface policer as an output filter:
• Include the output filter-name statement at the [edit interfaces interface-name unit
logical-unit-number family family-name] hierarchy level.
In the following example, firewall filter inet-filter is applied to family inet on interface
ge-1/2/0.0. The filter is applied to incoming IPv4 traffic on the interface.
[edit]
interfaces {
ge-1/2/0 {
unit 0 {
family inet {
filter {
input inet-filter;
}
address 10.100.16.2/24
}
}
}
308
Copyright © 2010, Juniper Networks, Inc.