3

In my gateway Juniper Switch:

...
irb {
    unit 0 {
        family inet;
    }
    unit 2 {
        family inet {
            address 10.10.10.254/24;
        }
    }
    unit 9 {
        family inet {
            address 40.224.224.14/29;
        }
    }

  ...

I want to limit the IP 40.224.224.1's traffic in my gateway device, how to realize this?

I hear about use filter can do it, but I am not sure of this.

my gateway switch is: Juniper EX4300.


EDIT-01

thanks Vink's response, but my attempt seems go wrong:

I write a filter:

admin@C1-A# show firewall family inet filter Egress-SVI-filter
term Limit-traffic {
    from {
        source-address {
            40.224.224.1/32;
            40.224.224.2/32;
        }
    }
    then policer Limit-200m;
}

and apply it to a SVI:

admin@C1-A# show interfaces irb unit 96
family inet {
    filter {
        output Egress-SVI-filter;
    }
    address 40.224.224.6/29;
}

but the 40.224.224.1-2 will be uncommunicative right now.

My policer:

admin@C1-A# show firewall policer Limit-200m
filter-specific;
if-exceeding {
    bandwidth-limit 200m;
    burst-size-limit 40m;
}
then discard;

EDIT-02

I tried change the term to like this:

admin@C1-A# show firewall family inet filter Egress-SVI-filter
term Limit-traffic {
    from {
        source-address {
            40.224.224.1/32;
            40.224.224.2/32;
        }
    }
    then {
        policer Limit-200m;
        accept;
    }
}

but still will cause the network uncommunicate.


Edit-03

enter image description here

9
  • I think you need to provide a bit more context on what you're trying to achieve and the setup you're using if you want a more detailed answer.
    – Teun Vink
    May 31, 2019 at 20:35
  • @TeunVink i want to limit 40.224.224.1and 2 egress traffic to 200m.
    – aircraft
    Jun 1, 2019 at 0:58
  • As @RobinG mentioned you need an explicit permit policy at the end of your filter.
    – Teun Vink
    Jun 1, 2019 at 5:39
  • @TeunVink See my EDIT-02, friend. it still not work.
    – aircraft
    Jun 1, 2019 at 7:48
  • You're talking about an egress filter but are matching source adresses on an output filter, either that doesn't make sense and you should be matching destination addresses or I don't understand your topology and exactly what you're filtering.
    – Teun Vink
    Jun 1, 2019 at 11:34

2 Answers 2

7

You can apply a filter to an interface in the interface:

irb {
    unit 9 {
        family inet {
            address 40.224.224.14/29;
            filter input my-filter;
        }
    }
}

And then define that filter under firewall family inet:

firewall {
    family inet {
        filter my-filter {
            term one {
                # filter criteria and actions
            }
            term two {
                # some more criteria and actions
            }
        }
    }
}

You can read more on how to configure this filters in this free Juniper ebook: Day One: Configuring Junos Policies and Firewall Filters.

3
  • can you give me an example of how to judge a special IP(40.224.224.1) then limit its traffic to 200m?
    – aircraft
    May 31, 2019 at 16:41
  • I tried, but seems get wrong .
    – aircraft
    May 31, 2019 at 19:12
  • 1
    Do not forget to add a term at the end accepting all other traffic, the default action for a filter is drop.
    – RobinG
    May 31, 2019 at 19:54
5

Adjust your filter to allow all other traffic - at the moment, you are blocking everything except the two IP addresses in question.

term Limit-traffic {
    from {
        source-address {
            40.224.224.1/32;
            40.224.224.2/32;
        }
    }
    then {
        policer Limit-200m;
        accept;
    }
}
term Permit-All-Else {      <---- Add an allow-all term 
    then accept;
}
1
  • give you the upvote, thanks for the detail answer.
    – aircraft
    Jun 3, 2019 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.