3

I've managed to get QinQ subscriber management working. Now I want to shape / police both VLAN connections. As a test I have configured this:

DYNINTF-STACKED-KANTOOR-TEST {
    interfaces {
        "$junos-interface-ifd-name" {
            unit "$junos-interface-unit" {
                proxy-arp restricted;
                vlan-tags outer "$junos-stacked-vlan-id" inner "$junos-vlan-id";
                filter {
                    input "$junos-input-filter";
                    output "$junos-output-filter";
                }
                family inet {
                    unnumbered-address lo0.0 preferred-source-address 10.110.110.1;
                }
            }
        }
    }

}

The filter:

show firewall filter 17Mb 
term test {
    then policer 17Mb-policer;
}

And at last, the policer:

policer 17Mb-policer {
    if-exceeding {
        bandwidth-limit 17m;
        burst-size-limit 1m;
    }
    then discard;
}

If I for example configure police-17M on both input and output filter hierarchy in the dynamic profile then it works fine:

IPv4 Input Filter Name: police-17M-ge-1/1/4.1073936801-in
IPv4 Output Filter Name: police-17M-ge-1/1/4.1073936801-out

But this is not the way it should be..

UPDATE

This is what I now receive on the Juniper:

Apr  7 12:16:58.908497 radius-access-accept: Ingress-Policy-Name (Juniper-ERX-VSA) received: police-17M
Apr  7 12:16:58.908552 radius-access-accept: Egress-Policy-Name (Juniper-ERX-VSA) received: police-17M

However, showing this subscriber in extensive mode, I don't see it being applied to the dynamic interface. Any idea why?

  • I think that for proper traffic shaping you should use combination of firewall policers and class-of-service. – Stefan Stoyanov Mar 22 '18 at 7:55
1

So you need two dynamic profiles. A VLAN and an IP profile. The VLAN profile is for creating dynamic profiles and the IP profile is for applying filters to them.

Notice the use of $junos-underlhing-interface-unit which is basically the dynamically created unit by the VLAN profile.

VLAN profile:

DYNINTF-VLAN-DHCP-INET-KPN {
    interfaces {
        "$junos-interface-ifd-name" {
            unit "$junos-interface-unit" {
                proxy-arp restricted;
                vlan-id "$junos-vlan-id";
                family inet {
                    unnumbered-address lo0.0 preferred-source-address 10.110.110.1;
                }
            }
        }
    }
 }

IP profile:

 DYNSUB-IP-PROFILE-KPN {
    interfaces {
        "$junos-interface-ifd-name" {
            unit "$junos-underlying-interface-unit" {
                family inet {
                    filter {
                        input "$junos-input-filter";
                        output "$junos-output-filter";
                    }
                }
            }
        }
    }
}

--

In my situation, i have two VLAN profiles. One for single and one for stacked VLAN customers. The IP profile is configured under the DHCP group for the whole interface while only the stacked VLAN profiles should use them. If anyone got an idea for this, I'm happy to hear you out :-)

0

You can check if the counters of the policer are increasing:

show policer | match interface "ge-1/1/4"

  • Well, the client first needs to get an IP address automatically. If it does, then the policy will be active with the virtually created interface on the Juniper MX. But it doesn't get one because the log says that it is "missing (an) inet input filter name". – Beeelze Apr 6 '17 at 13:33
0

I'm going to go out on a limb here, please let me know if this isn't what you're after. I think you might be getting bitten by what is basically a syntax issue.

both [edit firewall filter] and [edit firewall family inet filter] are valid configuration hierarchies. the [edit firewall filter] configuration section was left over from much earlier releases of JUNOS, and while can still be valid in some scenarios, it's a lot more clear to use family inet (it's also best practice).

DYNINTF-STACKED-KANTOOR-TEST {
    interfaces {
        "$junos-interface-ifd-name" {
            unit "$junos-interface-unit" {
                proxy-arp restricted;
                vlan-tags outer "$junos-stacked-vlan-id" inner "$junos-vlan-id";
                filter {
                    input "$junos-input-filter";
                    output "$junos-output-filter";
                }
                family inet {
                    unnumbered-address lo0.0 preferred-source-address 10.110.110.1;
                }
            }
        }
    }
}

What you should likely have is this:

DYNINTF-STACKED-KANTOOR-TEST {
    interfaces {
        "$junos-interface-ifd-name" {
            unit "$junos-interface-unit" {
                proxy-arp restricted;
                vlan-tags outer "$junos-stacked-vlan-id" inner "$junos-vlan-id";
                family inet {
                    filter {
                        input "$junos-input-filter";
                        output "$junos-output-filter";
                    }                    
                    unnumbered-address lo0.0 preferred-source-address 10.110.110.1;
                }
            }
        }
    }
}

So, basically, you're not defining the filter as "inet" in your dynamic-profile.

OR

It could be your filter itself that you're not defining as "inet".

jhead@lab01# show firewall family inet filter 17Mb
term test {
    then policer 17Mb-policer;
}

jhead@lab# show firewall policer 17Mb-policer
if-exceeding {
    bandwidth-limit 17m;
    burst-size-limit 1m;
}
then discard;

Or it could be both.

  • Hi Jordan, eventually it was not a syntax issue of the firewall configuration. I missed the part that there need to be 2 dynamic profiles. One VLAN profile for the creation of virtual interfaces and one IP profile for applying firewall polices. I've got this configuration working. See my answer. – Beeelze May 1 '17 at 13:02
  • I really should have caught that, haha. Well, I'm glad you got it working, and thank you very much for the follow up. – Jordan Head May 3 '17 at 12:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.