Description

On EX series switch such as EX4400, a per unit policer doesn't work under flexible-vlan-tagging. This KB explain it with sample config and solution.

Symptoms

On EX4400, per unit policer doesn't work on EP style config under flexible-vlan-tagging.
Here is the sample config: 
set interfaces ae1 flexible-vlan-tagging
set interfaces ae1 encapsulation flexible-ethernet-services
set interfaces ae1 unit 100 family ethernet-switching interface-mode trunk
set interfaces ae1 unit 100 family ethernet-switching vlan members 100
set interfaces ae1 unit 200 family ethernet-switching interface-mode trunk
set interfaces ae1 unit 200 family ethernet-switching vlan members 200
set interfaces ae1 unit 200 family ethernet-switching filter input ae1-vlan200
set interfaces ae1 unit 200 family ethernet-switching filter output ae1-vlan200
set firewall family ethernet-switching filter ae1-vlan200 term 1 then policer 100m-limit
set firewall policer 100m-limit if-exceeding bandwidth-limit 100m
set firewall policer 100m-limit if-exceeding burst-size-limit 128k
set firewall policer 100m-limit then discard
set vlans vlan100 vlan-id 100
set vlans vlan200 vlan-id 200
When generating traffic, the policer applied to unit 200 will be effective to unit 100 as well.

Solution

Adding user-vlan-id stanza in firewall filter will resolve the issue. 
set firewall family ethernet-switching filter ae1-vlan200 term 1 from user-vlan-id 200
set firewall family ethernet-switching filter ae1-vlan200 term 1 then policer 100m-limit
set firewall family ethernet-switching filter ae1-vlan200 term 999 then accept

Modification History

2024-08-23 : Article Created