1

How can I set the Juniper EX3300 Switch's Interface traffic speed?

Before asking this question I have attempted many methods, all fail.

first of all, set the Interface traffic speed is not the interfaces speed doc, because this only can set 10m, 100m, 1g.

I want to let the ge-0/0/0 input and output can limit speed to 23m.

My device is EX3300, how can I set it?

Now my configurations is this:

firewall

firewall {
    family ethernet-switching {
        filter lnterface-Police {
            term Police {
                from {
                    source-address {
                        0.0.0.0/0;
                    }
                }
                then policer limit-50m;
            }
            term Permit-ALL-Other {
                then accept;
            }
        }
    }
    policer limit-50m {
        if-exceeding {
            bandwidth-limit 20m;
            burst-size-limit 1500;
        }
        then discard;
    }
}

ge-0/0/5

ge-0/0/5 {
    unit 0 {
        family ethernet-switching {
            filter {
                input lnterface-Police;
                output lnterface-Police;
            }
        }
    }
}

but when I use commit check, there gets bellow error:

admin# commit check
[edit interfaces ge-0/0/10 unit 0 family ethernet-switching]
  'filter'
    Referenced filter 'lnterface-Police' can not be used as policer not supported on egress
error: configuration check-out failed
Improve this question

2 Answers 2

Reset to default
2

You cannot use L3/L4 ACL options in L2 ACL's, and also EGRESS policing is not supported.

Here working example for you:

[edit interfaces ge-5/0/46 unit 0 family ethernet-switching]
       filter {
           input interface-police;
       }

[edit firewall]
    family ethernet-switching {
        filter interface-police {
            term limit-50m {
                then policer limit-50m;
            }
        }
    }

[edit firewall]
   policer limit-50m {
       filter-specific;
       if-exceeding {
           bandwidth-limit 50m;
           burst-size-limit 15k;
       }
       then discard;
   }

In this case policer will only limit INGRESS traffic. To limit also EGRESS traffic add this section:

[edit]
  class-of-service {
      interfaces {
          ge-5/0/46 {
              shaping-rate 50m;
          }
      }
  }

Update

I was wrong. CoS applied only for interface output, so CoS shaping and input policing should be both applied.

Improve this answer
9
  • You write the shaping-rate 50m; but you set policer limit-50m . do you mean we can write the 50m directly which mean 50 M bits? or you write wrong there?
    – aircraft
    Commented Sep 20, 2018 at 10:50
  • @aircraft, In CoS for shaping you specifying exact number of bits you need. In this case 50m equals to 50000000 bits/s. You can shrink values, yes. Policer and CoS is a for different things.
    – Andrey Prokhorov
    Commented Sep 20, 2018 at 11:06
  • I have a question now, how can I know the limit configuration works? Is there a tool for checking bandwidth? or is there a property of switch port to show the bandwidth?
    – aircraft
    Commented Oct 5, 2018 at 5:33
  • If you have internet access from station connected to that port, you can simply run speedtest. Other option is to transfer some data between two stations in your network. You can track current load on interface with show interface ge-0/0/0 extensive
    – Andrey Prokhorov
    Commented Oct 5, 2018 at 5:59
  • I have connected to that port, can you explain speedtest more? or give a link for its usage.
    – aircraft
    Commented Oct 5, 2018 at 6:01
1

Try shaping your egress traffic - you can't police it.

add this to shape your egress traffic:

[edit class-of-service interfaces]
ge-0/0/5 {
    shaping-rate 23m;
}

remove output lnterface-Police; from your ge-0/0/5 interface config.

and try committing again.

Improve this answer
5
  • Do you mean I do not care the firewall's configuration, set the shaping-rate xxm directly in the class-of-service interfaces ge-0/0/5?
    – aircraft
    Commented Sep 20, 2018 at 10:52
  • I'm assuming you want 23 Mb/s in and out - you need to police ingress, and shape egress. i.e. ge-0/0/5 { unit 0 { family ethernet-switching { filter { input lnterface-Police; output lnterface-Police; } } } } must be ge-0/0/5 { unit 0 { family ethernet-switching { filter { input lnterface-Police; } } } } and add the class-of-service stanza.
    – Discus
    Commented Sep 20, 2018 at 10:56
  • @Discus, my apologies. Made edit to my post.
    – Andrey Prokhorov
    Commented Sep 20, 2018 at 11:03
  • @Discus Hi, Discus, I follow those steps to limit a Switch port, it works when I limit one or two ports, but if limit more than 5 , then the ports who limited the speed will have packet loss problem.
    – aircraft
    Commented Oct 12, 2018 at 3:56
  • Packet loss is ultimately how shaping works... Once you go over rate X for beyond the burst limit time, packets must be lost. If you increase the limits, does the packet loss resolve? It should be done in PFE, iirc, but check that it's not CPU bound as well.
    – Discus
    Commented Oct 12, 2018 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.