I want to apply rate limit on Main Aggregated Interface (AE) without applying on unit level. We have a customer connected with our Juniper MX480 via 100G Interface. The single 100G interface is a part of bundle link ae23. There are 2 x sub interfaces (units) configured on that bundle link. We want to apply 50G rate limit on the main interface.

We can use class of service scheduler to apply rate limit on the main interface. But we want to avoid it as of now. Is it possible that we could apply rate limit on the main interface without using the class of service scheduler?

Will really appreciate if someone could help on this.

Many Thanks !!!!

Below are the configuration at our end.

R1> show lacp interfaces ae23 
Aggregated interface: ae23
    LACP state:       Role   Exp   Def  Dist  Col  Syn  Aggr  Timeout  Activity
      et-4/1/5       Actor    No    No   Yes  Yes  Yes   Yes     Fast    Active
      et-4/1/5     Partner    No    No   Yes  Yes  Yes   Yes     Slow    Active
    LACP protocol:        Receive State  Transmit State          Mux State 
      et-4/1/5                  Current   Slow periodic Collecting distributing

R1> show interfaces et-4/1/5 descriptions 
Interface       Admin Link Description
et-4/1/5        up    up   Customer_Link_100G

R1> show configuration interfaces ae23 
apply-groups xge-if-parameters;
aggregated-ether-options {
    lacp {
unit 100 {
    description Customer_Internet_Traffic;
    vlan-id 100;
    family inet {
unit 200 {
    description Customer_Office_Traffic;
    vlan-id 200;
    family inet {

R1> show interfaces et-4/1/5 | match Speed 
  Link-level type: Flexible-Ethernet, MTU: 9192, MRU: 9200, Speed: 100Gbps, BPDU Error: None, Loopback: Disabled, Source filtering: Disabled,

2 Answers 2


It's a bit complicated. :) To apply a filter to the physical interface you need to apply a "physical interface policer" to all units of the ae. This can only be done via a firewall filter. You can avoid configuring this on all units by using apply-groups. Here is the step-by-step:

Configure the policer

[edit firewall]
policer shared-phy-policer-50g {
    if-exceeding {
        bandwidth-limit 50g;
        burst-size-limit 6250000;
    then discard;

This policer has two special options. physical-interface-policer says that all instances of this policer are to be aggregated at the physical interface level. shared-bandwidth-policer makes the policer apply correctly over multiple PFEs so that bandwidth is shared between PFEs (otherwise each PFE would get the full 50G bandwidth).

Configure the firewall filter

[edit firewall family inet]
      filter shared-phy-filter-50g-inet {
          term policer {
              then policer shared-phy-policer-50g;

The policer needs to be applied via a firewall filter. This filter is not very complicated, the only special option is pyhsical-interface-filter which only means that you can use physical interface policers in this filter.

If you have IPv6 (or VPLS or any other family) as well you can configure an additional filter under firewall family ipv6 (or vpls, ...) which references the same policer.

Create the apply group

[edit groups]
   shared-phy-filter-50g {
       interfaces {
           <ae*> {
               unit <*> {
                   family inet {
                       filter {
                           input shared-phy-filter-50g-inet;
                           output shared-phy-filter-50g-inet;

The group will apply the policer to all units under family inet. Please be aware that when you apply this group to an ae there will be a "family inet" created for every unit which might not work if you have mixed services on the ae (like VPLS). In that case you need to apply it by hand to every inet unit.

Apply the group

set interfaces ae23 apply-groups shared-phy-filter-50g

And that should be it. You're now policing traffic and should see something like that:

> show firewall filter shared-phy-filter-50g-inet-ae23-i detail    
Filter: shared-phy-filter-50g-inet-ae23-i                
Name                                                Bytes              Packets
shared-phy-filter-50g-inet-ae23-i                   0                  0

There is a filter with -i at the end for incoming traffic and -o at the end for outgoing traffic.

  • Thank you very very much for the detailed reply.I personally recognize your professional skills. You truly are an amazing guy. I wish I could give you as many votes as I could. Have a nice day :)
    – Nabeel
    Commented Apr 5, 2019 at 5:12
  • So by applying "apply-groups shared-phy-filter-50g" , firewall filter will keep the traffic on whole ae23 interface under or equal to 50G. It is possible that one sub interface will be at 40G and other sub-interface at 10G this will work. In case total traffic for both sub-interfaces exceeds from 50G , it will be discarded. Please correct me If am wrong. This is what I understood from your reply.
    – Nabeel
    Commented Apr 5, 2019 at 5:32
  • @NABEELNASIR yes the filter will keep the whole interface under 50G by combining traffic from all units it is applied to. Mind you this only works for family inet in my example. If you have other families you need a new firewall filter for that family. But as long as you always use the same policer it will be capped at 50G on the physical interface. Commented Apr 5, 2019 at 7:16
  • Sir , I guess the burst value you mentioned for 50G rate-limit on 100G interface is 6250000 (4 zeros). If we calculate the burst value from it is recommended by Juniper that 'the burst-size limit is equal to the amount of traffic forwarded by the interface in 5 milliseconds" , this comes out to be 62500000 (5 zeros). I guess this will be typo mistake from your end which is not a big deal. Just want to correct for anyone who sees this post. Thank you
    – Nabeel
    Commented Apr 9, 2019 at 12:33

The actual size i believe is 67108864 not 62500000. Remember bits are calculated in 1024 factors and not 1000. so 1 kbit is 1024 bits. And to get that value in bytes you divide by 8. The 62500000 is because the interface was converted x 1000. So 100gbits/sec interface is 107,374,182,400 bits a sec and not 100,000,000,000 a sec. So doing the maths with a 5ms limit:

107,374,182,400 x 0.005 = 536,870,912

then x / 8 to convert to bytes 536,870,912 / 8 = 67,108,864

so burst size for 100gbit is 67108864


100,000,000,000 x 0.005 = 500,000,000

then x / 8 to convert to bytes 500,000,000 / 8 = 62,500,000

Im just being picky. Hope this helps

  • "Remember bits are calculated in 1024 factors and not 1000" No, bit rates are not like RAM, and they are not powers of 2. A 1 Gbps bandwidth is literally 1,000,000,000 bps.
    – Ron Maupin
    Commented May 12, 2022 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.