Description

With layer2 policer configured on the MX device, it might have appeared that ipv4 and ipv6 traffic was not policed evenly.

 

Symptoms

<Topology>

IXIA ---> xe-3/0/0 MX2020 with MPC xe-3/0/1 ---> IXIA

 

In the above simple topology, IXIA sent ipv4 & v6 traffic with the same frame size & Mbps, and applied 30M policer on the egress port.

 

v4: frame size 1500Byte with 17Mbps 

v6: frame size 1500Byte with 17Mbps 

 

 

set interfaces xe-3/0/0 description input

set interfaces xe-3/0/0 vlan-tagging

set interfaces xe-3/0/0 unit 1 vlan-id 1

set interfaces xe-3/0/0 unit 1 family inet address 1.0.0.1/24

set interfaces xe-3/0/0 unit 1 family inet6 address 1::1/64

set interfaces xe-3/0/1 description output

set interfaces xe-3/0/1 vlan-tagging

set interfaces xe-3/0/1 unit 1 policer-overhead 24

set interfaces xe-3/0/1 unit 1 vlan-id 1

set interfaces xe-3/0/1 unit 1 layer2-policer output-policer Dual-Rate-Limit-30M-L1

set interfaces xe-3/0/1 unit 1 family inet mtu 1500

set interfaces xe-3/0/1 unit 1 family inet address 2.0.0.1/24

set interfaces xe-3/0/1 unit 1 family inet6 mtu 1500

set interfaces xe-3/0/1 unit 1 family inet6 address 2::1/64

 

set firewall policer Dual-Rate-Limit-30M-L1 logical-interface-policer

set firewall policer Dual-Rate-Limit-30M-L1 if-exceeding bandwidth-limit 30m

set firewall policer Dual-Rate-Limit-30M-L1 if-exceeding burst-size-limit 75k

set firewall policer Dual-Rate-Limit-30M-L1 then discard

 

 

<Ingress port>

test@mx2020-re0# run show interfaces xe-3/0/0 extensive | find "IPv4 transit statistic"

  IPv4 transit statistics:

   Input bytes :     10304972468       16748696 bps  <<<<<< ~17Mbps 

   Output bytes :          0          0 bps

   Input packets:      13142331         1416 pps

   Output packets:          0          0 pps

  IPv6 transit statistics:

   Input bytes :     10348897968       16748696 bps  <<<<<< ~17Mbps

   Output bytes :          0          0 bps

   Input packets:      13142331         1416 pps

   Output packets:          0          0 pps

 

 

<Egress port>

test@mx2020-re0# run show interfaces xe-3/0/1 extensive | find "IPv4 transit statistic"

  IPv4 transit statistics:

   Input bytes :          0          0 bps

   Output bytes :     9707536940       16689544 bps  <<<<<< ~17Mbps

   Input packets:          0          0 pps

   Output packets:      12691105         1411 pps

  IPv6 transit statistics:

   Input bytes :          0          0 bps

   Output bytes :     6714824118       12413656 bps  <<<<<< ~13Mbps

   Input packets:          0          0 pps

   Output packets:       8681631         1049 pps

 

 

As shown above, there is ~34Mbps traffic on the ingress side, and policed as 30Mbps on the egress.

Traffic statistics show that IPv6 traffic is policed more.

 

Solution

The behavior is expected.

It can not be guaranteed that even rates of the policer for both IPv4 and IPv6 scenarios, as we don't know in what order the policer block is getting the traffic. 

For such scenarios, when we want to get even rates for families, it is recommended to create policers at iff level.

Modification History

2024-08-16 : Article Created