Rate Limit on Main Aggregated Interface (AE) without applying on Unit Level in Juniper MX

Question

I want to apply rate limit on Main Aggregated Interface (AE) without applying on unit level. We have a customer connected with our Juniper MX480 via 100G Interface. The single 100G interface is a part of bundle link ae23. There are 2 x sub interfaces (units) configured on that bundle link. We want to apply 50G rate limit on the main interface.

We can use class of service scheduler to apply rate limit on the main interface. But we want to avoid it as of now. Is it possible that we could apply rate limit on the main interface without using the class of service scheduler?

Will really appreciate if someone could help on this.

Many Thanks !!!!

Below are the configuration at our end.

R1> show lacp interfaces ae23 
Aggregated interface: ae23
    LACP state:       Role   Exp   Def  Dist  Col  Syn  Aggr  Timeout  Activity
      et-4/1/5       Actor    No    No   Yes  Yes  Yes   Yes     Fast    Active
      et-4/1/5     Partner    No    No   Yes  Yes  Yes   Yes     Slow    Active
    LACP protocol:        Receive State  Transmit State          Mux State 
      et-4/1/5                  Current   Slow periodic Collecting distributing


R1> show interfaces et-4/1/5 descriptions 
Interface       Admin Link Description
et-4/1/5        up    up   Customer_Link_100G

R1> show configuration interfaces ae23 
apply-groups xge-if-parameters;
aggregated-ether-options {
    lacp {
        active;
    }
}
unit 100 {
    description Customer_Internet_Traffic;
    vlan-id 100;
    family inet {
        address 172.16.1.1/30;
    }
}
unit 200 {
    description Customer_Office_Traffic;
    vlan-id 200;
    family inet {
        address 172.16.2.1/30;
    }
}

R1> show interfaces et-4/1/5 | match Speed 
  Link-level type: Flexible-Ethernet, MTU: 9192, MRU: 9200, Speed: 100Gbps, BPDU Error: None, Loopback: Disabled, Source filtering: Disabled,

Answer 1

It's a bit complicated. :) To apply a filter to the physical interface you need to apply a "physical interface policer" to all units of the ae. This can only be done via a firewall filter. You can avoid configuring this on all units by using apply-groups. Here is the step-by-step:

---

Configure the policer

[edit firewall]
policer shared-phy-policer-50g {
    physical-interface-policer;
    shared-bandwidth-policer;
    if-exceeding {
        bandwidth-limit 50g;
        burst-size-limit 6250000;
    }
    then discard;
}

This policer has two special options. physical-interface-policer says that all instances of this policer are to be aggregated at the physical interface level. shared-bandwidth-policer makes the policer apply correctly over multiple PFEs so that bandwidth is shared between PFEs (otherwise each PFE would get the full 50G bandwidth).

Configure the firewall filter

[edit firewall family inet]
      filter shared-phy-filter-50g-inet {
          physical-interface-filter;
          term policer {
              then policer shared-phy-policer-50g;
          }
      }

The policer needs to be applied via a firewall filter. This filter is not very complicated, the only special option is pyhsical-interface-filter which only means that you can use physical interface policers in this filter.

If you have IPv6 (or VPLS or any other family) as well you can configure an additional filter under firewall family ipv6 (or vpls, ...) which references the same policer.

Create the apply group

[edit groups]
   shared-phy-filter-50g {
       interfaces {
           <ae*> {
               unit <*> {
                   family inet {
                       filter {
                           input shared-phy-filter-50g-inet;
                           output shared-phy-filter-50g-inet;
                       }
                   }
               }
           }
       }
   }

The group will apply the policer to all units under family inet. Please be aware that when you apply this group to an ae there will be a "family inet" created for every unit which might not work if you have mixed services on the ae (like VPLS). In that case you need to apply it by hand to every inet unit.

Apply the group

set interfaces ae23 apply-groups shared-phy-filter-50g

And that should be it. You're now policing traffic and should see something like that:

> show firewall filter shared-phy-filter-50g-inet-ae23-i detail    
Filter: shared-phy-filter-50g-inet-ae23-i                
Policers:
Name                                                Bytes              Packets
shared-phy-filter-50g-inet-ae23-i                   0                  0

There is a filter with -i at the end for incoming traffic and -o at the end for outgoing traffic.