I'm reading DDoS Prevention in MX series - 2nd. As mentioned in book "you can also configure whether an individual policer type should bypass that group’s aggregate policer"

=> I don't understand that mention. Please healp me! is mean the router-alert policer will match and the aggregate policer will be bypass although it has config bw limit 10k?

protocols {
    ip-options {
        aggregate {
            bandwidth 10000;
            burst 500;
        unclassified {
            priority medium;
        router-alert {
            bandwidth 5000;
            recover-time 150;
            priority high;

1 Answer 1


You could e.g. limit bandwidth from the Internet in general, but override the limit for your company's cloud server.

An individual policer has higher priority than a general policer, so the former can 'bypass' a rule that would be in place otherwise.

  • I still stuck. I'm understanding about packet-type policer will match before aggregate policer, but I don't understand about "bypass " as mentioned in book. Commented Sep 10, 2021 at 18:15
  • That is limit bandwidth 10k at aggregate policer = none? Just limit bandwidth 5k is using? Commented Sep 10, 2021 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.