This article explains why IPv4 Multicast packets do not hit the Policer when they are applied in the egress direction on Ichip-based platforms.
+-----+ +-------+ |ixia1|------>(xe-1/1/0)M320(ge-7/0/4)----------------MX-480----|IXIA 2 | +-----+ M320 E3-FPC Type2 (Ichip) +-------+
The ge-7/0/4 interface is on the FPC7 (the Ichip):
lab@m320> show chassis hardware | match "fpc 7" FPC 7 REV 07 710-016170 WL2586 M320 E3-FPC Type 2
set firewall policer 512k if-exceeding bandwidth-limit 512k set firewall policer 512k if-exceeding burst-size-limit 10k set firewall policer 512k then discard
set interfaces ge-7/0/4 unit 0 family inet policer output 512k set interfaces ge-7/0/4 unit 0 family inet address 10.254.1.214/30
The input interface (xe-1/1/0) is receiving 3004800 bps unicast packets:
lab@m320# run show interfaces xe-1/1/0 | match "Input rate"Input rate : 3004800 bps (313 pps)
The output interface (ge-7/0/4 ) is sending 512 Kbps of unicast traffic. For unicast traffic, the Policer is being hit and policing at the rate of 512K :
lab@m320# run show interfaces ge-7/0/4 | match Output Output rate : 518400 bps (54 pps) Output packets: 34429 lab@m320# run show interfaces ge-7/0/4 | match Output Output rate : 528000 bps (55 pps) Output packets: 34538
The command output below shows that 512000 bps are able to be sent:
lab@m320# run show interfaces queue ge-7/0/4 egress | match "Trans|Byte" Bytes : 22861195143 520672 bps Transmitted: Packets : 45002579 54 pps Bytes : 22861195143 520672 bps RED-dropped bytes : 0 0 bps Bytes : 0 0 bps Transmitted:0 0 bps
The traffic is now changed to multicast:
lab@m320# run show interfaces xe-1/1/0 | match "Input rate" Input rate : 3004800 bps (313 pps) {MASTER}[edit] lab@m320# run show interfaces xe-1/1/0 | match "Input rate" Input rate : 2995200 bps (312 pps) Input rate is 3 Mbps on xe-1/1/0 ( Incoming interface ).
lab@m320# run show interfaces ge-7/0/4 | match Output Output rate : 2995200 bps (312 pps) Output packets: 112213 lab@m320# run show interfaces ge-7/0/4 | match Output Output rate : 2995200 bps (312 pps) Output packets: 113463
lab@m320# run show interfaces queue ge-7/0/4 egress | match "Trans|Byte" Bytes : 22946720839 3000000 bps Transmitted: Packets : 45073860 312 pps Bytes : 22946720839 3000000 bps RED-dropped bytes : 0 0 bps Bytes : 0 0 bps
The packet count in the policer output is zero:
lab@m320# run show policer 512k-ge-7/0/4.0-inet-o Policers: Name Bytes Packets 512k-ge-7/0/4.0-inet-o 0 {MASTER}[edit] lab@m320# run show policer 512k-ge-7/0/4.0-inet-o Policers: Name Bytes Packets 512k-ge-7/0/4.0-inet-o 0
For Multicast traffic, the policer is not being hit. The input rate is 3 Mbps, and the output interface is passing with the same rate without filtering.
The PFE output shows that the policer is programmed correctly:
% cprod -A fpc7 -c "show filter index 17009 program" Program Filters: --------------- Index Dir Cnt Text Bss Name -------- ------ ------ ------ ------ -------- 17009 52 0 4 4 512k-ge-7/0/4.0-inet-o Firewall program version 18 magic fed2beef Name: "512k-ge-7/0/4.0-inet-o" Protocol: ip Flags: 0x01 Implicit Filter: No Hash: 5ed725379bed25bf7b20ef4e04ab78dd Action directory: 1 entry (52 bytes) Policer directory: 1 entry (176 bytes) Text: 1 instruction word (4 bytes) BSS: 10 next hop words (40 bytes) Action directory: 1 entry (52 bytes) 0: accept policer 0 -> 0: Policer directory: 1 entry (176 bytes) 0: Policer name "512k-ge-7/0/4.0-inet-o": 1 referenceBandwidth Limit: 64000 bytes/sec.Burst Size: 10000 bytes.discard Program instructions: 1 word 0: terminate -> action index 0 % For Ichip Policer is not getting hit for multicast traffic in outbound direction.
+-----+ +-------+ |ixia2|------>( xe-2/1/0)MX480(ge-2/3/8)-------------M-320--- --|IXIA 1 | +-----+ MPCE Type 2 3D Q (Trio) +-------+
The Policer configuration here is the same as the Policer configuration for the M320 E3-FPC Type 2 (Ichip), above. The ge-2/3/8 interface is on the FPC2 (the MPC):
lab@MX-480-1-RE1# run show chassis hardware | match "FPC 2" FPC 2 REV 09 750-038493 CAAF7653 MPCE Type 2 3D Q
The input rate on the Input interface (xe-2/1/0) is 2156200 bps:
[edit] lab@MX-480# run show interfaces xe-2/1/0 | match "Input rate" Input rate : 2156056 bps (5858 pps)
The outbound interface (ge-3/1/0) is sending 1022728 bps:
ab@MX-480# run show interfaces ge-2/3/8 | match Output Output rate : 511344 bps (1389 pps) Output packets: 7382158
[edit] lab@MX-480# run show interfaces ge-2/3/8 | match Output Output rate : 511536 bps (1389 pps) Output packets: 7384921
[edit] lab@MX-480# run show interfaces ge-2/3/8 | match Output Output rate : 513016 bps (1394 pps) Output packets: 7387693
Interface: ge-2/3/8, Enabled, Link is Up Encapsulation: Ethernet, Speed: 1000mbps Traffic statistics: Current delta Input bytes: 542837602 (0 bps) [0] Output bytes: 342039430 (513760 bps) [636092] Input packets: 459714 (0 pps) [0] Output packets: 7434806 (1395 pps) [13827]
The Drop count in the Policer is incrementing:
[edit] lab@MX-480# run show policer 512k-ge-2/3/8.0-inet-o Policers: Name Bytes Packets 512k-ge-2/3/8.0-inet-o 37618570 817795
[edit] lab@MX-480# run show policer 512k-ge-2/3/8.0-inet-o Policers: Name Bytes Packets 512k-ge-2/3/8.0-inet-o 37618570 817795 [edit] lab@MX-480# run show policer 512k-ge-2/3/8.0-inet-o Policers: Name Bytes Packets 512k-ge-2/3/8.0-inet-o 38027464 826684
% cprod -A fpc2 -c "show filter index 17001 program" Filter index = 17001 Optimization flag: 0x0 Filter notify host id = 0 Filter properties: None Filter state = CONSISTENT term default term priority 0 then accept policer template 512k policer 512k-ge-2/3/8.0-inet-oapp_type 0bandwidth-limit 512000 bits/secburst-size-limit 10000 bytesdiscard %
The Policer works for Multicast traffic on the Modular Port Concentrator (MPC) in the output direction.