3

In my gateway Juniper Switch:

...
irb {
    unit 0 {
        family inet;
    }
    unit 2 {
        family inet {
            address 10.10.10.254/24;
        }
    }
    unit 9 {
        family inet {
            address 40.224.224.14/29;
        }
    }

  ...

I want to limit the IP 40.224.224.1's traffic in my gateway device, how to realize this?

I hear about use filter can do it, but I am not sure of this.

my gateway switch is: Juniper EX4300.


EDIT-01

thanks Vink's response, but my attempt seems go wrong:

I write a filter:

admin@C1-A# show firewall family inet filter Egress-SVI-filter
term Limit-traffic {
    from {
        source-address {
            40.224.224.1/32;
            40.224.224.2/32;
        }
    }
    then policer Limit-200m;
}

and apply it to a SVI:

admin@C1-A# show interfaces irb unit 96
family inet {
    filter {
        output Egress-SVI-filter;
    }
    address 40.224.224.6/29;
}

but the 40.224.224.1-2 will be uncommunicative right now.

My policer:

admin@C1-A# show firewall policer Limit-200m
filter-specific;
if-exceeding {
    bandwidth-limit 200m;
    burst-size-limit 40m;
}
then discard;

EDIT-02

I tried change the term to like this:

admin@C1-A# show firewall family inet filter Egress-SVI-filter
term Limit-traffic {
    from {
        source-address {
            40.224.224.1/32;
            40.224.224.2/32;
        }
    }
    then {
        policer Limit-200m;
        accept;
    }
}

but still will cause the network uncommunicate.


Edit-03

enter image description here

  • I think you need to provide a bit more context on what you're trying to achieve and the setup you're using if you want a more detailed answer. – Teun Vink May 31 at 20:35
  • @TeunVink i want to limit 40.224.224.1and 2 egress traffic to 200m. – aircraft Jun 1 at 0:58
  • As @RobinG mentioned you need an explicit permit policy at the end of your filter. – Teun Vink Jun 1 at 5:39
  • @TeunVink See my EDIT-02, friend. it still not work. – aircraft Jun 1 at 7:48
  • You're talking about an egress filter but are matching source adresses on an output filter, either that doesn't make sense and you should be matching destination addresses or I don't understand your topology and exactly what you're filtering. – Teun Vink Jun 1 at 11:34
7

You can apply a filter to an interface in the interface:

irb {
    unit 9 {
        family inet {
            address 40.224.224.14/29;
            filter input my-filter;
        }
    }
}

And then define that filter under firewall family inet:

firewall {
    family inet {
        filter my-filter {
            term one {
                # filter criteria and actions
            }
            term two {
                # some more criteria and actions
            }
        }
    }
}

You can read more on how to configure this filters in this free Juniper ebook: Day One: Configuring Junos Policies and Firewall Filters.

  • can you give me an example of how to judge a special IP(40.224.224.1) then limit its traffic to 200m? – aircraft May 31 at 16:41
  • I tried, but seems get wrong . – aircraft May 31 at 19:12
  • 1
    Do not forget to add a term at the end accepting all other traffic, the default action for a filter is drop. – RobinG May 31 at 19:54
4

Adjust your filter to allow all other traffic - at the moment, you are blocking everything except the two IP addresses in question.

term Limit-traffic {
    from {
        source-address {
            40.224.224.1/32;
            40.224.224.2/32;
        }
    }
    then {
        policer Limit-200m;
        accept;
    }
}
term Permit-All-Else {      <---- Add an allow-all term 
    then accept;
}
  • give you the upvote, thanks for the detail answer. – aircraft Jun 3 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.