Description

After appling a rate-limit to a specific VLAN on an EX4650 switch, actually affected all VLANs on the interface instead of just the intended VLAN.


Symptoms

Applying traffic speed limits for a different VLANs created an unexpected problem. 

The limits slowed down both the incoming and outgoing traffic, instead of just one direction.


In this scenario, it can be seen that the term (accept-all) is missing, it caused the traffic is dropped.


set firewall family ethernet-switching filter rate-limit-50mbps term term1 then count rate-limit-counter

set firewall family ethernet-switching filter rate-limit-50mbps term term1 then policer policer-50mbps

set firewall family ethernet-switching filter rate-limit-50mbps term accept-all then accept

set firewall policer policer-50mbps if-exceeding bandwidth-limit 50m

set firewall policer policer-50mbps if-exceeding burst-size-limit 70m

set firewall policer policer-50mbps then discard


Solution

As per there is an implicit deny, "accept all" term needs to be configured to avoid causing traffic issues.


"set firewall family ethernet-switching filter rate-limit-50mbps term accept-all then accept"


Modification History

2026-07-14 : Article Created

Related Information

https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/example/firewall-filter-stateless-example-rate-limits-based-on-destination-class.html


https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/example/firewall-filter-stateless-example-count-accepted-and-rejected-packets.html