This article discusses rate limiting on SRX devices operating in transparent mode.

Ideally, firewall policers are used on Junos OS platforms; however, transparent mode firewalls do not support policers. Class of service must be used to achieve rate limiting on transparent mode devices. This article provides a sample configuration that can be used to rate-limit the traffic in transparent mode.

Firewall policers are not supported in transparent mode.

In this example we have an input of 10 Mbps and we are rate-limiting to 5 Mbps.

This can be done using one of two methods:

• Apply separate schedulers for different traffic classes and rate-limit based on traffic class
• Rate-limit everything

Method 1 ( Rate-limiting based on traffic class):

1. Define a scheduler with a shaping rate of 5m:

   set class-of-service schedulers Rate-limit-5m shaping-rate 5m

2. Create a scheduler map to associate the scheduler with the forwarding class. In this case, we are rate-limiting traffic in the best-effort queue.

   set class-of-service scheduler-maps Policer forwarding-class best-effort scheduler Rate-limit-5m

3. Apply the scheduler map to the interface:

   set class-of-service interfaces ge-0/0/7 unit 0 scheduler-map Policer

4. Apply a per unit scheduler on the interface:

   set interfaces ge-0/0/7 per-unit-scheduler

Method 2 (Rate-limiting everything):

1. Specify the shaping rate under the class-of-service hierarchy.

2. Apply a per unit scheduler on the interface:

   set interfaces ge-0/0/7 per-unit-scheduler

Screen capture from lab showing before and after applying rate limiting:

Before rate-limiting:

After rate-limiting:

• Class of Service Functions in Transparent Mode Overview