On ACX7100 EVO, firewall policer rates on input/output directions are different, although the same bandwidth-limit is applied.
In below test topology, firewall input/output policer(1m) is configured on et-0/0/1. Both two IXIA ports send 13Mbps frames.
Topology :
* POLICER IXIA#1 ---- 10G ---- et-0/0/0 ACX7100 et-0/0/1 ---- 10G --- IXIA#2 <--------------------- [input police 1m] <<---------- 13Mbps 13Mbps -------------------->> [output police1m] ----------->
user@acx7100> show configuration groups |find POLICER-OPTIONS |display set
set groups POLICER-OPTIONS interfaces <*> unit <*> family inet filter input test-policer-input
set groups POLICER-OPTIONS interfaces <*> unit <*> family inet filter output test-policer-output
user@acx7100> show configuration |find app |display set
set apply-groups default
set interfaces et-0/0/0 unit 0 family inet address 192.168.10.2/30 arp 192.168.10.1 mac e8:24:a6:7f:35:d8
set interfaces et-0/0/1 unit 0 apply-groups POLICER-OPTIONS
set interfaces et-0/0/1 unit 0 family inet address 192.168.20.2/30 arp 192.168.20.1 mac e8:24:a6:7f:35:e0
set firewall family inet filter test-policer interface-specific
set firewall family inet filter test-policer term 1 then policer test-1m
set firewall family inet filter test-policer term 1 then accept
set firewall family inet filter test-policer-input interface-specific
set firewall family inet filter test-policer-input term 1 from source-address 192.168.20.0/30
set firewall family inet filter test-policer-input term 1 then policer test-1m
set firewall family inet filter test-policer-input term 1 then accept
set firewall family inet filter test-policer-input term last then accept
set firewall family inet filter test-policer-output interface-specific
set firewall family inet filter test-policer-output term 1 from source-address 192.168.10.0/30
set firewall family inet filter test-policer-output term 1 then policer test-1m
set firewall family inet filter test-policer-output term 1 then accept
set firewall family inet filter test-policer-output term last then accept
set firewall policer test-1m if-exceeding bandwidth-limit 1m
set firewall policer test-1m if-exceeding burst-size-limit 625k
set firewall policer test-1m then discard
The result is that IXIA#2 receiving rate is higher than that of IXIA#1 for all 3 test scenarios.
Test-1(IXIA rate 13Mbps with Untag/64B) :
Output rate on et-0/0/1 (policed by output policer) is 1.41Mbps <--- IXIA#2 receiving rate
Output rate on et-0/0/0 (policed by input policer) is 1.07Mbps <----- IXIA#1 receiving rate
Test-2(IXIA rate 13Mbps with Untag/96B) :
Output rate on et-0/0/1 (policed by output policer) is 1.25Mbps
Output rate on et-0/0/0 (policed by input policer) is 1.05Mbps
Test-3(IXIA rate 13Mbps with Vlan Tagged/96B) :
Output rate on et-0/0/1 (policed by output policer) is 1.31Mbps
This behavior is due to the ASIC pipeline design on ACX7100. There is no workaround to change this behavior.
While the ingress policer engine considers all the bytes of the packets, the egress policer engine considers only the packet bytes available at that stage.
For the L2 flows (switching), this will not make any difference as all headers are intact.
But for the L3 flows, the L2(MAC) headers are terminated in ingress stage, and egress policing happens before the outgoing MAC addresses are added.
The egress policing on L3 flows considers only the IP header & IP-payload as frame-size.
Test-1(IXIA rate 13Mbps with UnTag/64B) :
Length:60B (MAC_DA:6B + MAC_SA:6B + Tyep:2B + Payload:46B) *Juniper products do not count FCS(4B) in frame length.
et-0/0/1 outgoing rate = 64B(IXIA length)/46B(IP packet) x 1Mbps (output policing rate) = 1.3913Mbps
et-0/0/0 outgoing rate = 64B(IXIA length)/60B(IXIA-FCS) x 1Mbps ( input policing rate) = 1.0667Mbps
Test-2(IXIA rate 13Mbps with UnTag/96B) :
Length:92B (MAC_DA:6B + MAC_SA:6B + Tyep:2B + Payload:78B)
et-0/0/1 outgoing rate = 96B(IXIA length)/78B(IP packet) x 1Mbps (output policing rate) = 1.2308Mbps
et-0/0/0 outgoing rate = 96B(IXIA length)/92B(IXIA-FCS) x 1Mbps ( input policing rate) = 1.0435Mbps
Test-3(IXIA rate 13Mbps with Tagged/96B) :
Length:92B (MAC_DA:6B + MAC_SA:6B + Tag:4B + Tyep:2B + Payload:74B)
et-0/0/1 outgoing rate = 96B(IXIA length)/74B(IP packet) x 1Mbps (output policing rate) = 1.2973Mbps