This article shows an example of how to shape traffic with different rates according to its destination subnet address, while the destination subnet addresses are routed to an IPsec tunnel interface (st0.x).
Topology:
Goal:
SRX220A is the gateway connected to a remote location via an IPsec tunnel. The IP address of the external interface of SRX220A is assigned by Point-to-Point Protocol over Ethernet (PPPoE). The requirement is to shape traffic destined for subnet 10.1.2.0/24 and 10.1.3.0/24 with different rates.
Two approaches are introduced below:
Method 1: With a Policer
set interfaces ge-0/0/0 unit 0 family inet filter input FF2 set firewall filter FF2 term 15m from destination-address 10.1.3.0/24 set firewall filter FF2 term 15m then policer police15m set firewall filter FF2 term 15m then accept set firewall filter FF2 term 80m from destination-address 10.1.2.0/24 set firewall filter FF2 term 80m then policer police80m set firewall filter FF2 term 80m then accept set firewall filter FF2 term last then accept set firewall policer police15m if-exceeding bandwidth-limit 15m set firewall policer police15m if-exceeding burst-size-limit 625k set firewall policer police15m then discard set firewall policer police80m if-exceeding bandwidth-limit 80m set firewall policer police80m if-exceeding burst-size-limit 625k set firewall policer police80m then discard
Result: => For 10.1.2.0/24, shaped with police80m => iperf -u -c 10.1.2.11 -l 1300 -b 100M -t 500 -i 5 ------------ root@srx220H-A-client> show interfaces ge-0/0/0 | grep rate Input rate : 102111088 bps (9611 pps) Output rate : 0 bps (0 pps) ------------ root@srx220H-A-client> show interfaces pp0 | grep rate Input rate : 0 bps (0 pps) Output rate : 83351688 bps (7528 pps) ------------ root@srx220H-A-client> show interfaces st0 | grep rate Input rate : 0 bps (0 pps) Output rate : 79995736 bps (7529 pps) ------------ root@srx220H-A-client> show interfaces queue ge-0/0/4 | grep Bytes Bytes : 74087701243 84822816 bps Bytes : 29261980627 84822816 bps ------------ root@srx220H-B-server> show interfaces queue ge-0/0/1 | grep Bytes Bytes : 10405568780 80873576 bps Bytes : 10405568780 80873576 bps ====================================== => For 10.1.3.0/24, shaped with police15m => iperf -u -c 10.1.3.10 -l 1300 -b 100M -t 500 -i 5 ------------ root@srx220H-A-client> show interfaces ge-0/0/0 | grep rate Input rate : 102155880 bps (9615 pps) Output rate : 0 bps (0 pps) ------------ root@srx220H-A-client> show interfaces pp0 | grep rate Input rate : 0 bps (0 pps) Output rate : 15634632 bps (1412 pps) ------------ root@srx220H-A-client> show interfaces st0 | grep rate Input rate : 0 bps (0 pps) Output rate : 15004208 bps (1412 pps) ------------ root@srx220H-A-client> show interfaces queue ge-0/0/4 | grep Bytes Bytes : 74872474203 15894032 bps Bytes : 30046753587 15894032 bps ------------ root@srx220H-B-server> show interfaces queue ge-0/0/0 | grep Bytes Bytes : 16217103541 15173112 bps Bytes : 16217103541 15173112 bps
=> For 10.1.2.0/24, shaped with police80m => iperf -u -c 10.1.2.11 -l 1300 -b 100M -t 500 -i 5 ------------ root@srx220H-A-client> show interfaces ge-0/0/0 | grep rate Input rate : 102111088 bps (9611 pps) Output rate : 0 bps (0 pps) ------------ root@srx220H-A-client> show interfaces pp0 | grep rate Input rate : 0 bps (0 pps) Output rate : 83351688 bps (7528 pps) ------------ root@srx220H-A-client> show interfaces st0 | grep rate Input rate : 0 bps (0 pps) Output rate : 79995736 bps (7529 pps) ------------ root@srx220H-A-client> show interfaces queue ge-0/0/4 | grep Bytes Bytes : 74087701243 84822816 bps Bytes : 29261980627 84822816 bps ------------ root@srx220H-B-server> show interfaces queue ge-0/0/1 | grep Bytes Bytes : 10405568780 80873576 bps Bytes : 10405568780 80873576 bps ====================================== => For 10.1.3.0/24, shaped with police15m => iperf -u -c 10.1.3.10 -l 1300 -b 100M -t 500 -i 5 ------------ root@srx220H-A-client> show interfaces ge-0/0/0 | grep rate Input rate : 102155880 bps (9615 pps) Output rate : 0 bps (0 pps) ------------ root@srx220H-A-client> show interfaces pp0 | grep rate Input rate : 0 bps (0 pps) Output rate : 15634632 bps (1412 pps) ------------ root@srx220H-A-client> show interfaces st0 | grep rate Input rate : 0 bps (0 pps) Output rate : 15004208 bps (1412 pps) ------------ root@srx220H-A-client> show interfaces queue ge-0/0/4 | grep Bytes Bytes : 74872474203 15894032 bps Bytes : 30046753587 15894032 bps ------------ root@srx220H-B-server> show interfaces queue ge-0/0/0 | grep Bytes Bytes : 16217103541 15173112 bps Bytes : 16217103541 15173112 bps
Method 2: With a Virtual Channel
set interfaces ge-0/0/0 unit 0 family inet filter input FF3 set class-of-service virtual-channel-groups vc-shaping vc12m scheduler-map sch-map-simple set class-of-service virtual-channel-groups vc-shaping vc12m shaping-rate 12m set class-of-service virtual-channel-groups vc-shaping vc48m scheduler-map sch-map-simple set class-of-service virtual-channel-groups vc-shaping vc48m shaping-rate 48m set class-of-service virtual-channel-groups vc-shaping vc-default scheduler-map sch-map-simple set class-of-service virtual-channel-groups vc-shaping vc-default default set class-of-service interfaces ge-0/0/4 unit 0 virtual-channel-group vc-shaping set firewall filter FF3 term 1 from destination-address 10.1.2.0/24 set firewall filter FF3 term 1 then virtual-channel vc12m set firewall filter FF3 term 1 then accept set firewall filter FF3 term 2 from destination-address 10.1.3.0/24 set firewall filter FF3 term 2 then virtual-channel vc48m set firewall filter FF3 term 2 then accept set firewall filter FF3 term last then accept
Result:
=> For 10.1.2.0/24, shaped with 12m iperf -u -c 10.1.2.11 -l 1300 -b 100M -t 500 -i 5 ------------ root@srx220H-A-client> show interfaces ge-0/0/0 | grep rate Input rate : 102313056 bps (9630 pps) Output rate : 0 bps (0 pps) ------------ root@srx220H-A-client> show interfaces pp0 | grep rate Input rate : 232 bps (0 pps) Output rate : 11612904 bps (1048 pps) ------------ root@srx220H-A-client> show interfaces st0 | grep rate Input rate : 0 bps (0 pps) Output rate : 102131416 bps (9613 pps) ------------- root@srx220H-A-client> show interfaces queue ge-0/0/4 | grep Bytes <<< Source SRX Bytes : 60938914377 108287256 bps Bytes : 22030129643 11814888 bps ------------ root@srx220H-B-server> show interfaces queue ge-0/0/1 | grep Bytes <<< Destination SRX Bytes : 7363489794 11294272 bps Bytes : 7363489794 11294272 bps ----------- => For 10.1.3.0/24, shaped with 48m iperf -u -c 10.1.3.10 -l 1300 -b 100M -t 500 -i 5 ------------ root@srx220H-A-client> show interfaces ge-0/0/0 | grep rate Input rate : 103610240 bps (9752 pps) Output rate : 0 bps (0 pps) ------------ root@srx220H-A-client> show interfaces pp0 | grep rate Input rate : 232 bps (0 pps) Output rate : 46451616 bps (4195 pps) ------------ root@srx220H-A-client> show interfaces st0 | grep rate Input rate : 0 bps (0 pps) Output rate : 100991488 bps (9505 pps) ------------ root@srx220H-A-client> show interfaces queue ge-0/0/4 | grep Bytes <<< Source SRX Bytes : 61882535811 108260592 bps Bytes : 22146241341 47239352 bps ------------ root@srx220H-B-server> show interfaces queue ge-0/0/0 | grep Bytes <<< Destination SRX Bytes : 12088770921 45199416 bps Bytes : 12088770921 45199416 bps ------------