3

I have created a virtual routing instance allow traffic to be transmitted over private IP space:

static-cust-inet {
    description "Virtual Routing Instance";
    instance-type virtual-router;
    interface ge-1/1/3.5312;
    interface ge-1/1/3.5324;
    routing-options {
        static {
            route 10.0.0.0/24 next-hop 172.30.212.2;
            route 192.168.0.0/24 next-hop 172.30.211.2;
        }
    }
}

Applying a filter to the interfaces specified there doesn't work. How would I do it in this situation? This is the policer I want to apply is like this:

if-exceeding {
    bandwidth-limit 10m;
    burst-size-limit 1m;
}
then discard;

The firewall filter is specified under the "firewall family inet" hierarchy level. Is that the correct place?

  • Technically, that is policing, not shaping. Policing purposely drops traffic, while shaping tries to queue it. – Ron Maupin Feb 28 '17 at 20:00
  • @RonMaupin Ok, fair enough :-) I guess that's what I want then. – Beeelze Feb 28 '17 at 20:01
1

Here's how we do this on an MX80. Important to understand that policing is ingress (drops traffic if metrics are exceeded and can also cause lots of problems with TCP if the remote end isn't shaping toward you) and shaping is egress (which is queued and plays nicely with TCP by default).

I have to admit though that I'm not certain if the syntax with a VRI would be different:

class-of-service {
    interfaces {
         {
            unit "vlan_id" {
                shaping-rate "shaping_rate";
            }
        }
    }
}


Example:
class-of-service {
    interfaces {
        xe-1/2/0 {
            unit 948 {
                shaping-rate 500m;
            }
        }
    }
}
  • Thanks Jeremy. I looked it up on the kb.juniper website and found this: kb.juniper.net/InfoCenter/… . Is this what I should look into? – Beeelze Mar 1 '17 at 8:30
  • In the Juniper example they are taking a subset of the traffic on interface ge-0/0/0 from source block 10.132.245.0/24 and then applying shaping to traffic originating from that source netblock. All other traffic is treated as best effort. You might do something like this if you were wanting to provide a guarantee of bandwidth to a particular subnet. If that's the effect you're after then that should work just fine. If all you want is to shape traffic on an interface basis then the example I provided above should do the trick. – Jeremy Malli Mar 1 '17 at 15:17
  • When I use shaping on my side, I should also shape on the customer side, right? Since shaping is egress.. That's why I used a lot of policies matching on source and destination address and therefore limiting traffic both ways. – Beeelze Mar 7 '17 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.