Juniper Dynamic Subscriber Management Traffic Policing

Question

I've managed to get QinQ subscriber management working. Now I want to shape / police both VLAN connections. As a test I have configured this:

DYNINTF-STACKED-KANTOOR-TEST {
    interfaces {
        "$junos-interface-ifd-name" {
            unit "$junos-interface-unit" {
                proxy-arp restricted;
                vlan-tags outer "$junos-stacked-vlan-id" inner "$junos-vlan-id";
                filter {
                    input "$junos-input-filter";
                    output "$junos-output-filter";
                }
                family inet {
                    unnumbered-address lo0.0 preferred-source-address 10.110.110.1;
                }
            }
        }
    }

}

The filter:

show firewall filter 17Mb 
term test {
    then policer 17Mb-policer;
}

And at last, the policer:

policer 17Mb-policer {
    if-exceeding {
        bandwidth-limit 17m;
        burst-size-limit 1m;
    }
    then discard;
}

If I for example configure police-17M on both input and output filter hierarchy in the dynamic profile then it works fine:

IPv4 Input Filter Name: police-17M-ge-1/1/4.1073936801-in
IPv4 Output Filter Name: police-17M-ge-1/1/4.1073936801-out

But this is not the way it should be..

UPDATE

This is what I now receive on the Juniper:

Apr  7 12:16:58.908497 radius-access-accept: Ingress-Policy-Name (Juniper-ERX-VSA) received: police-17M
Apr  7 12:16:58.908552 radius-access-accept: Egress-Policy-Name (Juniper-ERX-VSA) received: police-17M

However, showing this subscriber in extensive mode, I don't see it being applied to the dynamic interface. Any idea why?

Answer 1

So you need two dynamic profiles. A VLAN and an IP profile. The VLAN profile is for creating dynamic profiles and the IP profile is for applying filters to them.

Notice the use of $junos-underlhing-interface-unit which is basically the dynamically created unit by the VLAN profile.

VLAN profile:

DYNINTF-VLAN-DHCP-INET-KPN {
    interfaces {
        "$junos-interface-ifd-name" {
            unit "$junos-interface-unit" {
                proxy-arp restricted;
                vlan-id "$junos-vlan-id";
                family inet {
                    unnumbered-address lo0.0 preferred-source-address 10.110.110.1;
                }
            }
        }
    }
 }

IP profile:

 DYNSUB-IP-PROFILE-KPN {
    interfaces {
        "$junos-interface-ifd-name" {
            unit "$junos-underlying-interface-unit" {
                family inet {
                    filter {
                        input "$junos-input-filter";
                        output "$junos-output-filter";
                    }
                }
            }
        }
    }
}

--

In my situation, i have two VLAN profiles. One for single and one for stacked VLAN customers. The IP profile is configured under the DHCP group for the whole interface while only the stacked VLAN profiles should use them. If anyone got an idea for this, I'm happy to hear you out :-)

Answer 2

You can check if the counters of the policer are increasing:

show policer | match interface "ge-1/1/4"

Answer 3

I'm going to go out on a limb here, please let me know if this isn't what you're after. I think you might be getting bitten by what is basically a syntax issue.

both [edit firewall filter] and [edit firewall family inet filter] are valid configuration hierarchies. the [edit firewall filter] configuration section was left over from much earlier releases of JUNOS, and while can still be valid in some scenarios, it's a lot more clear to use family inet (it's also best practice).

DYNINTF-STACKED-KANTOOR-TEST {
    interfaces {
        "$junos-interface-ifd-name" {
            unit "$junos-interface-unit" {
                proxy-arp restricted;
                vlan-tags outer "$junos-stacked-vlan-id" inner "$junos-vlan-id";
                filter {
                    input "$junos-input-filter";
                    output "$junos-output-filter";
                }
                family inet {
                    unnumbered-address lo0.0 preferred-source-address 10.110.110.1;
                }
            }
        }
    }
}

What you should likely have is this:

DYNINTF-STACKED-KANTOOR-TEST {
    interfaces {
        "$junos-interface-ifd-name" {
            unit "$junos-interface-unit" {
                proxy-arp restricted;
                vlan-tags outer "$junos-stacked-vlan-id" inner "$junos-vlan-id";
                family inet {
                    filter {
                        input "$junos-input-filter";
                        output "$junos-output-filter";
                    }                    
                    unnumbered-address lo0.0 preferred-source-address 10.110.110.1;
                }
            }
        }
    }
}

So, basically, you're not defining the filter as "inet" in your dynamic-profile.

OR

It could be your filter itself that you're not defining as "inet".

jhead@lab01# show firewall family inet filter 17Mb
term test {
    then policer 17Mb-policer;
}

jhead@lab# show firewall policer 17Mb-policer
if-exceeding {
    bandwidth-limit 17m;
    burst-size-limit 1m;
}
then discard;

Or it could be both.