Description

This article provides information about the implementation of the kernel firewall policer.

Symptoms

  • When you apply a policer under a firewall filter in Junos, it will evaluate the fw and place a kernel version of the policer as a term action.
  • In this case, the policer check occurs on the kernel; instead of the ASIC. So, you will see a drop in the counter increment.
  • However, when you apply a family policer directly on the interface (not via the firewall filter), it does not show up as firewall object. As a result, the kernel will not implement the policer; so, all the packets originated from the RE will bypass the ASIC lookup and you will not see any drop there.

Solution

 

Check the following examples, for the difference between the Interface Policer and Interface Firewall filter with policer:

In the following topology, R1 applied the Policers on the egress interface. You can see that the ICMP request traffic goes through this policer condition; without any packet discard.


Topology - 1 :

10.3R1.9 policer
R1(M10) ge-0/0/0------------- R2(150.0.0.2)
ICMP request --->

R1(M10) - Apply a family policer on the interface :
interfaces {
     ge-0/0/0 {
         unit 0 {
             family inet {
                 policer {
                     output out-policer;
                 }
address 150.0.0.1/30;
             }
         }
     }
}
firewall {
     policer out-policer {
         if-exceeding {
             bandwidth-limit 32k;
             burst-size-limit 1500;
         }
then discard;
     }
}


lab@R1> ping 150.0.0.2 rapid count 99999 size 1500
PING 150.0.0.2 (150.0.0.2): 1500 data bytes
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

lab@m10> show policer
Policers:
Name Packets
__default_arp_policer__ 0
out-policer-ge-0/0/0.0-inet-o 0 <--- No counter increment
__policer_tmpl__-term 0
In the following topology, R1 applies the Firewall Filter on the egress interface. The firewall filter is configured with the policer term action:

Topology - 2 :
10.3R1.9 policer
R1(M10) ge-0/0/0------------- R2(150.0.0.2)
ICMP request --->

R1(M10) - Apply a policer under a fw :
interfaces {
     ge-0/0/0 {
         unit 0 {
             family inet {
                 filter {
                     output test;
                 }
address 150.0.0.1/30;
             }
         }
     }
}
firewall {
     family inet {
         filter test {
             term 1 {
                 then policer out-policer;
             }
         }
     }
policer out-policer {
    if-exceeding {
        bandwidth-limit 32k;
        burst-size-limit 1500;
    }
then discard;
}
}


lab@R1> ping 150.0.0.2 rapid count 99999 size 1500
PING 150.0.0.2 (150.0.0.2): 1500 data bytes
ping: sendto: Operation canceled
.ping: sendto: Operation canceled


lab@R1> show firewall

Filter: __default_bpdu_filter__

Filter: test
Policers:
Name Packets
out-policer-1 372 <--- Counters are incremented.

lab@R1>