Description

Users may find that copying files from remote servers to devices that run Junos OS by using secure copying (SCP) is taking a long time. As indicated in this article, this may be due to a protect-RE filter and policer that may be configured in the device to rate-limit SSH traffic.

Symptoms

Copying files from remote servers to devices that run Junos OS takes a long time.

Solution

The delay in secure copying files may be due to a protect-RE filter that may be in place. In some customer templates, a policer may be defined for rate-limiting SSH traffic. Since SCP uses an SSH connection for file transfer, SCP is also rate-limited, resulting in slow copy of files.

A sample template is given as follows: 

filter protect-re {
...
term SSH_accept {
from {
source-prefix-list {
ssh-list;
}
protocol tcp;
port [ ssh 830 ];
}
then {
policer ssh-policer;
accept;
}
}
policer ssh-policer {
if-exceeding {
bandwidth-limit 1m;
burst-size-limit 15k;
}
then discard;
}
}

To improve copying speed, modify the SCP policer rate based on requirements: 

policer ssh-policer {
if-exceeding {
bandwidth-limit 1m;     <<< Modify the rate as per requirement. 
burst-size-limit 15k;
}
then discard;
}

Caution: Modifying the protect-RE filters or using non-standard protect-RE templates can cause unauthorized access and resource depletion. Hence ensure that these filters/policers meet all security compliance requirements even after modification.