O'Reilly logo

JUNOS Cookbook by Aviva Garrett

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

9.16. Rate-Limiting Traffic Flow to the Routing Engine

Problem

You need to ensure the availability of the Routing Engine during times of heavy traffic.

Solution

Configure policers to use with the firewall filter that you apply to the Routing Engine. First, create policers for control and low-priority traffic. The first policer is for SSH connections to the Routing Engine:

	[edit firewall]
	aviva@RouterF# set policer ssh if-exceeding bandwidth-limit 1m
	aviva@RouterF# set policer ssh if-exceeding burst-size-limit 100k
	aviva@RouterF# set policer ssh then discard

Two additional policers limit ICMP and TCP traffic:

	[edit firewall]
	aviva@RouterF# set policer icmp if-exceeding bandwidth-limit 1m
	aviva@RouterF# set policer icmp if-exceeding burst-size-limit 100k
	aviva@RouterF# set policer icmp then discard
	aviva@RouterF# set policer tcp if-exceeding bandwidth-limit 1m
	aviva@RouterF# set policer tcp if-exceeding burst-size-limit 100k
	aviva@RouterF# set policer tcp then discard

A final policer affects various background applications, including SNMP, NTP, and RADIUS:

	[edit firewall]
	aviva@RouterF# set policer utility if-exceeding bandwidth-limit 3m
	aviva@RouterF# set policer utility if-exceeding burst-size-limit 300k
	aviva@RouterF# set policer utility then discard

Then, apply the policers in the then clause of the firewall terms that affect TCP, SSH, ICMP, SNMP, NTP, and RADIUS packets:

	[edit firewall filter protect-RE2]
	aviva@RouterF# set term tcp from source-prefix-list ssh-prefixes aviva@RouterF# ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required