Switching

Is there a way to limit port speed to 50 Mbps on EX4200?

For rate limiting you will use the "Firewall Filter" feature.  These are not stateful firewall but  similar to Cisco access lists to block or permit access at the packet level.  They also implement policers for bandwidth limiiting.

The documentation examples for firewall filters are here.

http://www.juniper.net/techpubs/en_US/junos10.4/topics/example/firewall-filter-ex-series-configuring.html

http://www.juniper.net/techpubs/en_US/junos10.4/topics/task/configuration/firewall-filter-ex-series-cli.html


The specific filter for rate limiting is outlined in kb14250 as an example to copy.  Just apply this to your physical interface instead of the Routed VLAN interface.

http://kb.juniper.net/InfoCenter/index?page=content&id=KB14250

use firewall policer under interface level:

=============================

show interfaces ge-10/1/7

unit 0 {    family inet {      

policer {           

input 50m;           

output 50m;       

}

}

show firewall policer 50m

if-exceeding {

bandwidth-limit 50m;

 burst-size-limit 31k

}

then discard;

==============================

Is there a rule for calculating burst-limit? What needs to be considered? Is there a standard burst -size that can be applied?

The burst size is the number of bytes that can exceed the bandwidth constraints - to allow bursts on a Fast Ethernet link for 5 milliseconds use the following calculation:

burst size = bandwidth (100,000,000 bits per sec.) x allowable burst time (5/1000s)

Gives you burst size of 500,000 bits. Divide by 8 to get bytes = 62500 bytes.

Theres some good info in this thread. However, how would you limit a layer 2 switch port? access mode and one member vlan?

You cannot set the sped to 50m or 500m. There are three speeds available.

10m, 100m and 1g. However you you can rate limit traffic that is is allowed to come into the interface or leave the interface using policer and shapers.

You use a firewall filter to call up the policer then apply the firealll filter to the iterface or to the vlan.

set vlans vlan-200 filter input <firewall_filter_name>

set interfaces ge-0/0/9.0 family ethernet-switching filter input <firewall_filter_name>