1

I have a firewall filter below which puts the ICMP traffic to assured-forwarding class if the bandwidth threshold is not exceeded:

root@vmx> show configuration firewall filter example | display inheritance no-comments 
term policer-example {
    from {
        protocol icmp;
    }
    then {
        policer class-example;
        forwarding-class assured-forwarding;
        accept;
    }
}

root@vmx> show configuration firewall policer class-example | display inheritance no-comments
if-exceeding {
    bandwidth-limit 8k;
    burst-size-limit 1500;
}
then forwarding-class best-effort;

root@vmx> 

Firewall filter named example is set in ingress direction to ge-0/0/2 interface and I'm generating transit traffic(ICMP messages) ingressing the forwarding plane via ge-0/0/2 interface.

How can I make sure if my traffic ends up in assured-forwarding or best-effort class? The DSCP value is always 0(decimal) and commands like show interfaces forwarding-class-counters show nothing:

root@vmx> show interfaces forwarding-class-counters    

root@vmx> show interfaces forwarding-class-counters ge-0/0/2    
  Logical interface ge-0/0/2.0 (Index 343) (SNMP ifIndex 543)
      Forwarding-class statistics are not applicable to this interface.

root@vmx> 
2

To view the queue counters against each forwarding class , you have to use command

show interfaces xe-0/0/0 extensive | find "Queue counters" 

R1>show interfaces xe-0/0/0 extensive | find "Queue counters"   
  Queue counters:       Queued packets  Transmitted packets      Dropped packets
    0                       3670800337           3670800337                    0
    1                        200104217            200104217                    0
    2                         20410753             20410753                    0
    3                         27381361             27381361                    0
    4                           381678               381678                    0
    5                        399632152            399632152                    0
    6                         62819593             62819593                    0
  Queue number:         Mapped forwarding classes
    0                   best-effort
    1                   business
    2                   Video_on_Demand
    3                   Multicast
    4                   infrastructure-traffic
    5                   VoIP
    6                   Network_Control
  Active alarms  : None
  Active defects : None

This will list amount of packets that have been queued , transmitted and dropped in case of congestion.

We need to keep this thing is mind that CoS is an egress phenomena In our case the traffic is entering the network on router R1 via its interface xe-0/0/0. So to check Queue counters we need to run the above command on xe-0/0/0 to check queue statistics and to verify incoming packets are placed in respective queues before forwarding them out of egress interface i.e. xe-2/0/1 for example.

To your next query , why your DSCP value is always 0 , I think the policer 'class-example' action is putting the packets in the best-effort. Hence before junos goes to term 'assured-forwarding' packets have already been placed in best effort.

You may try below configuration :-

root@vmx> show configuration firewall filter example | display inheritance no-comments 
term policer-example {
    from {
        protocol icmp;
    }
    then {
        policer class-example;
        forwarding-class assured-forwarding;
        accept;
    }
}

root@vmx> show configuration firewall policer class-example | display inheritance no-comments
if-exceeding {
    bandwidth-limit 8k;
    burst-size-limit 1500;
}
then accept;
| improve this answer | |
  • One other thing you could add to the firewall filter is a counter/log/syslog action to the relevant terms to see it work, though you don't really need to track it that way in a production network. – Jordan Head May 21 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.