Description

Virtual channel, a feature of class of service (CoS), can be configured together with a firewall filter to shape specified packets with a limited transmit rate. This article explains how to accomplish this on an SRX device having PPPoE as external interface and gateway for IPsec VPN.

Symptoms

Topology

                             10.1.1.0/24                     2.2.2.254                 10.2.2.100/24
|Clients|--|SRX220A| <ge-0/0/4.0> ---|PPPoE Server|--|INTERNET|---|SRX220-HQ|--|FTP-server|
                                           <PPPoE - pp0.0>
                             <====================IPSec VPN aggressive mode==============>

Requirements

  • Traffic from client's site connected to FTP server via IPsec tunnel interface, with limit transmit rate at 20 Mbps.

  • Traffic from client's site connected to Internet directly via PPPoE interface pp0.0 without rate limit.

Problem

Refer to the following articles for information on rate-limiting on IPsec tunnel interfaces. However, rate limiting is not accomplished over a PPPoE connection.

Solution

A PPPoE interface pp0.0 is utilized as the gateway of IPsec. Per the current implementation of Junos OS code, interface pp0.x does not support per-unit scheduler  or out queues , which are needed for the CoS virtual channel feature.

Instead of the PPPoE interface pp0.0, its underlying interface (e.g., ge-0/0/4.0) must be configured for both virtual-channel-group and per-unit-scheduler .

Problematic configuration:

set class-of-service interfaces pp0 unit 0 virtual-channel-group vc-group
set interfaces pp0 per-unit-scheduler

Good configuration:

set class-of-service interfaces ge-0/0/4 unit 0 virtual-channel-group vc-group
set interfaces ge-0/0/4 per-unit-scheduler

A condition-specified firewall filter must be added as an output filter at the logical interface pp0.0:

set interfaces pp0 unit 0 family inet filter output FF1

Example configuration: 

/* One virtual-channel with shaping-rate 20 Mbps, another default virtual-channel
set class-of-service virtual-channels vc-esp
set class-of-service virtual-channels vc-default
set class-of-service virtual-channel-groups vc-group vc-esp scheduler-map sch-map-simple
set class-of-service virtual-channel-groups vc-group vc-esp shaping-rate 20m
set class-of-service virtual-channel-groups vc-group vc-default scheduler-map sch-map-simple
set class-of-service virtual-channel-groups vc-group vc-default default
/* Important(1)! The virtual-channel-group and per-unit-scheduler must be configured for the "underlying interface"
set class-of-service interfaces ge-0/0/4 unit 0 virtual-channel-group vc-group
set interfaces ge-0/0/4 per-unit-scheduler

/* Important(2)! Firewall filter FF1 located at output of pp0.0
set interfaces pp0 unit 0 family inet filter output FF1
set firewall filter FF1 term 1 from protocol esp
set firewall filter FF1 term 1 then virtual-channel vc-esp
set firewall filter FF1 term 1 then accept
set firewall filter FF1 term 2 then virtual-channel vc-default
set firewall filter FF1 term 2 then accept

/* A sheduler-maps is required for virtual-channels. Here is an example referred from - http://www.juniper.net/documentation/en_US/junos12.1x47/topics/reference/general/cos-scheduler-default-security-setting.html
set class-of-service scheduler-maps sch-map-simple forwarding-class best-effort scheduler best-effort
set class-of-service scheduler-maps sch-map-simple forwarding-class network-control scheduler network-control
set class-of-service schedulers network-control transmit-rate percent 5
set class-of-service schedulers network-control buffer-size percent 5
set class-of-service schedulers network-control priority low
set class-of-service schedulers network-control drop-profile-map loss-priority any protocol any drop-profile terminal
set class-of-service schedulers best-effort transmit-rate percent 95
set class-of-service schedulers best-effort buffer-size percent 95
set class-of-service schedulers best-effort priority low
set class-of-service schedulers best-effort drop-profile-map loss-priority any protocol any drop-profile terminal
set class-of-service drop-profiles terminal fill-level 100 drop-probability 100

/* Other needed configuration; interface, ike, ipsec, routing, zones, and policy (some is omitted)
set interfaces ge-0/0/4 unit 0 encapsulation ppp-over-ether
set interfaces pp0 unit 0 ppp-options chap default-chap-secret "$9$8mzx-woJDmfzYgfz36u0LxNdABCDEFGFIJK"
set interfaces pp0 unit 0 ppp-options chap local-name "[email protected]"
set interfaces pp0 unit 0 ppp-options chap passive
set interfaces pp0 unit 0 pppoe-options underlying-interface ge-0/0/4.0
set interfaces pp0 unit 0 pppoe-options auto-reconnect 10
set interfaces pp0 unit 0 pppoe-options client
set interfaces pp0 unit 0 family inet mtu 1454
set interfaces pp0 unit 0 family inet negotiate-address
set interfaces st0 unit 0 family inet
set security ike policy ike-pol1 mode aggressive
set security ike policy ike-pol1 proposal-set basic
set security ike policy ike-pol1 pre-shared-key ascii-text "$9$jykmT69pRhrz3hrev7ABCDEFGHIJK"
set security ike gateway ike-gate1 ike-policy ike-pol1
set security ike gateway ike-gate1 address 2.2.2.254
set security ike gateway ike-gate1 local-identity user-at-hostname "jtac@juniper"
set security ike gateway ike-gate1 external-interface pp0.0
set security ipsec policy ipsec-pol1 proposal-set basic
set security ipsec vpn vpn1 bind-interface st0.0
set security ipsec vpn vpn1 ike gateway ike-gate1
set security ipsec vpn vpn1 ike ipsec-policy ipsec-pol1
set security ipsec vpn vpn1 establish-tunnels immediately
set routing-options static route 10.2.2.0/24 next-hop st0.0
set routing-options static route 0.0.0.0/0 next-hop pp0.0
<snip>

Test method:

  1. Run iperf on both the client and server host.
  2. On a server host, run iperf -u -s
  3. On a client host,  run iperf -u -c 10.2.2.100 -l 1300 -b 100M -t 500 -i 5  
    (Send 1300 bytes packet at 100 Mbps rate, for 500 seconds, and display output every 5 seconds.)

Test results

Issue the following command on the operation console:

root@srx220H-A-client> show interfaces queue ge-0/0/4
Physical interface: ge-0/0/4, Enabled, Physical link is Up
Interface index: 138, SNMP ifIndex: 513
Forwarding classes: 8 supported, 4 in use
Egress queues: 8 supported, 4 in use
Queue: 0, Forwarding classes: best-effort
Queued:
Packets : 13685413 9622 pps
Bytes : 17237410161 108231128 bps   <<<< Input traffic rate 100 Mbps
Transmitted:
Packets : 2981648 1749 pps
Bytes : 3467343027 19678384 bps   <<<< vc-esp shaping-rate 20m
<snip>
root@srx220H-A-client> show interfaces extensive pp0 | grep Output
Output bytes : 33483492 19351160 bps    <<<< vc-esp shaping-rate 20m
<snip>

root@srx220H-A-client> show class-of-service virtual-channel
Virtual channel: vc-default, Index: 1
Virtual channel: vc-esp, Index: 2


root@srx220H-A-client> show class-of-service virtual-channel-group
Virtual channel group: vc-group, Index: 11568
Virtual channel: vc-default
Scheduler map : sch-map-simple
Virtual channel: vc-esp
Scheduler map : sch-map-simple
Shaping rate : 20000000 bps

root@srx220H-A-client> show class-of-service interface pp0
Physical interface: pp0, Index: 128
Queues supported: 8, Queues in use: 4
Scheduler map: <default> , Index: 2
Congestion-notification: Disabled

Logical interface: pp0.0, Index: 72
Object Name Type Index
Scheduler-map <default> Output 2
Classifier ipprec-compatibility ip 13

root@srx220H-A-client> show class-of-service interface ge-0/0/4   << The underlying interface
Physical interface: ge-0/0/4, Index: 138
Queues supported: 8, Queues in use: 4
Scheduler map: <default> , Index: 2
Congestion-notification: Disabled

Logical interface: ge-0/0/4.0, Index: 71
Object Name Type Index
Virtual-channel-group vc-group 11568     << Configured virtual-channel-group "vc-group"