This article explains the limitations and working conditions for a policer on EX4300 platform.
When firewall based policer is applied to loopback (lo0) interface of EX4300 switch, it works for all CPU pruned traffic. However, when it is applied on an IRB interface, it works only for transit traffic. Note: Junos OS 14.1X53-D40 and later is needed for loopback policer work. Example configuration: This configuration can be used to police the traffic. In this example, it is applied to the xe-0/2/3 interface.
set firewall family inet filter test-icmp-policer term icmp from protocol icmp set firewall family inet filter test-icmp-policer term icmp then policer 64k set firewall family inet filter test-icmp-policer term icmp then count juniper1 set firewall family inet filter test-icmp-policer term icmp then log set firewall family inet filter test-icmp-policer term icmp then accept set firewall family ethernet-switching filter test-samp term t1 then accept set firewall family ethernet-switching filter test-samp term t1 then count c1 set firewall family ethernet-switching filter test-samp term t1 then policer 64k set firewall policer 64k filter-specific set firewall policer 64k if-exceeding bandwidth-limit 32k set firewall policer 64k if-exceeding burst-size-limit 1500 set firewall policer 64k then discard
{master:0}[edit] root@LAB-EX4300-02# run show interfaces xe-0/2/3 | match rate Input rate : 783998464 bps (70000 pps) Output rate : 32192 bps (3 pps) <--- limited to 32K
Loopback interface policer loss-priority with discard is not supported.
Refer to PR1219946 - EX4300 loopback policer not working.
There are limitations with the firewall based policer on loopback and IRB interfaces: