1

EX4200 switch has a firewall filter applied to input of trunk port. Intent is to rate-limit (police) input bandwidth per VLAN id.

However the 'show firewall' command points out that policing is taking place only for the filter last "catch all" term (so named ACCEPT_OTHER_VLANS). Traffic from VLAN115 is actually being policed at the 2Mbps limit of the ACCEPT_OTHER_VLANS term.

The configuration looks fine to me.

Question:

For this specific hardware/software, can anyone spot

  • a configuration mistake?
  • an unsupported feature?
  • a known defect?

Please advise.

Hardware: EX4200-24F

JunOS: 12.3R4.6

Configuration is:

set firewall policer RATE_LIMIT_2M_T if-exceeding bandwidth-limit 2m
set firewall policer RATE_LIMIT_2M_T if-exceeding burst-size-limit 6250000
set firewall policer RATE_LIMIT_2M_T then discard
set firewall policer RATE_LIMIT_30M_T if-exceeding bandwidth-limit 30m
set firewall policer RATE_LIMIT_30M_T if-exceeding burst-size-limit 6250000
set firewall policer RATE_LIMIT_30M_T then discard
set firewall policer RATE_LIMIT_20M_T if-exceeding bandwidth-limit 20m
set firewall policer RATE_LIMIT_20M_T if-exceeding burst-size-limit 6250000
set firewall policer RATE_LIMIT_20M_T then discard

set vlans vlan115 vlan-id 115
set vlans vlan123 vlan-id 123

set firewall family ethernet-switching filter RATE_LIMIT_VLANS term RATE_LIMIT_VLAN123 from vlan vlan123
set firewall family ethernet-switching filter RATE_LIMIT_VLANS term RATE_LIMIT_VLAN123 then policer RATE_LIMIT_30M_T
set firewall family ethernet-switching filter RATE_LIMIT_VLANS term RATE_LIMIT_VLAN115 from vlan vlan115
set firewall family ethernet-switching filter RATE_LIMIT_VLANS term RATE_LIMIT_VLAN115 then policer RATE_LIMIT_20M_T
set firewall family ethernet-switching filter RATE_LIMIT_VLANS term ACCEPT_OTHER_VLANS then policer RATE_LIMIT_2M_T

set interfaces xe-0/1/0 mtu 9216
set interfaces xe-0/1/0 unit 0 family ethernet-switching port-mode trunk
set interfaces xe-0/1/0 unit 0 family ethernet-switching vlan members vlan115
set interfaces xe-0/1/0 unit 0 family ethernet-switching vlan members vlan123
set interfaces xe-0/1/0 unit 0 family ethernet-switching filter input RATE_LIMIT_VLANS

Result is:

user@ex4200> show firewall filter RATE_LIMIT_VLANS

Filter: RATE_LIMIT_VLANS
Policers:
Name                                                Bytes                Packets
RATE_LIMIT_20M_T-RATE_LIMIT_VLAN115                                          0
RATE_LIMIT_2M_T-ACCEPT_OTHER_VLANS                                    28283836
RATE_LIMIT_30M_T-RATE_LIMIT_VLAN123                                          0

{master:0}
user@ex4200>
  • Can you create unit 115 and 123 and assign the vlans to each unit accordingly? Of course, set these unit to access mode. – Huy Vũ Trần Oct 17 '16 at 17:05
2
+50

This appears to be a defect - I just recreated a similar environment on an EX42000-VC running 15.1R3.6.

family ethernet-switching {
    filter LIMIT-VLANS {
        term VID10 {
            from {
                vlan v10;
            }
            then {
                count VID10;
                policer LIMIT-256K;
        }
        term ALL-ELSE {
            then policer LIMIT-1M;
        }
    }
}

In this version of code, I was able to get the vlan classifier to work (my VID10 counter was incrementing), but I could not get the policer to kick in, even though I was exceeding the bandwidth limit by a factor of 10.

To be honest, I've had nothing but grief with EX4200 firewall filters over the years - what commits and what ultimately gets applied/works are two very different things!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.