Junos OS

Hello,

I have a question about QoS in JunOS (looking a replacement for CP).

I need to limit bandwidth for about a thousand PC-s to 256kbps each, in both directions. The limit must be enforced all the times, not only on congestion. PCs will reside behind one physical interface in a routed network. 

I have successfully implemented policer and CoS based limits for 1 IP in the network (see attached txt), but stuck with the other 999 hosts.. 

As I understand, to limit the bandwidth for each client on the network i need 1000 different policiers or 1000 queues if I use CoS, please correct me If I'm wrong.

I found a possible solution for my problem in JunOS documentation: 

http://www.juniper.net/techpubs/en_US/junos9.6/information-products/topic-collections/config-guide-policy/policy-configuring-multifield-classifiers-for-policing.html#id-11044236

family inet {
prefix-action per-source-policer {
policer 1Mbps-policer;
subnet-prefix-length 25;
source-prefix-length 32;

It would enable us to use one policier for each host.

But unfortunately prefix-actions are not supported on J-series and SRX routers except 3400+ (which is out of our budget) as I found out here:

http://www.techexams.net/forums/juniper-certifications/53425-srx210-vs-j2320.html

 If I think about realizing the same task in ScreenOS - the best solution I can think of, is 1000 policies with specific IP-s and traffic Shaping turned on on each of them. Which is not an elegant solution as well.

I would be grateful for any suggestions regarding this case,

Thanks in advance,

Attachment(s)

policer.txt   826 B 1 version

cos.txt   784 B 1 version

Hello there,

Apart from M-series "prefix-action", IDS on AS-PIC or MS-PIC can limit BW per source-ip, dst-ip or combination of both, in terms of PPS (packets-per-sec, not bits-per-sec!) only.

But I guess it may be out-of-your budget as well.

In absense of "prefix-action" support, only way to limit BW per-flow on Juniper kit is to write 1000 FW filter terms (JUNOS) or 1000 policies (SOS) matching on each  /32.

Or you could use dummynet on Linux/FreeBSD which is free.

HTH

Rgds

Alex

Thanks for your answer, that's exactly what I needed to know. 

I'll look into dummynet, its description looks promising. I'll also try to configure a bunch of filter terms to see how it will behave in real world.