Traffic Shaping / Bandwidth limit per address

[tbjornli]

First of all, I've tried to search the forum bu I can't seem to find any good examples.

We're currently setting up our two SRX3400 (cluster active/passive) but I can't quite figure out how to configure traffic shaping. We need to be able to limit bandwidth per IP-adress and I've tried with both COS and policier.

reth0 is configured as internet and reth1 is configured as localnet. On the localnet we've got 192.168.1.0/24 and every single IP (server) has it's own policy. We now need to be able to set an bandwidth-policy for every IP.

Can anyone provide me with an example how to configure a basic bandwidth policy for each IP?

192.168.1.2 = 1 Mbit incoming / 1 Mbit outgoing

192.168.1.3 = 2 Mbit incoming / 2 Mbit outgoing

If further information is needed please let me know and I will update this post.

Thanks in advance.

--

Tom

[rasmus]

please try

set firewall policer policer-1m if-exceeding bandwidth-limit 1m

set firewall policer policer-1m if-exceeding burst-size-limit 15k

set firewall policer policer-1m then discard

set firewall policer policer-2m if-exceeding bandwidth-limit 2m

set firewall policer policer-2m if-exceeding burst-size-limit 15k

set firewall policer policer-2m then discard

set firewall family ethernet-switching filter input-limit term 1 from source-address 192.168.1.2/24
set firewall family ethernet-switching filter input-limit term 1 then policer policer-1m

set firewall family ethernet-switching filter input-limit term 1 then accept

set firewall family ethernet-switching filter input-limit term 2 from source-address 192.168.1.3/24
set firewall family ethernet-switching filter input-limit term 2 then policer policer-2m

set firewall family ethernet-switching filter input-limit term 2 then accept

set firewall family ethernet-switching filter input-limit term 3 then accept

set firewall family ethernet-switching filter output-limit term 1 from source-address 192.168.1.2/24
set firewall family ethernet-switching filter output-limit term 1 then policer policer-1m

set firewall family ethernet-switching filter output-limit term 1 then accept

set firewall family ethernet-switching filter output-limit term 2 from source-address 192.168.1.3/24
set firewall family ethernet-switching filter output-limit term 2 then policer policer-2m

set firewall family ethernet-switching filter output-limit term 2 then accept

set firewall family ethernet-switching filter output-limit term 3 then accept

set interfaces ge-0/0/x unit 0 family inet source-address 192.168.1.1/24 filter input input-limit

set interfaces ge-0/0/x unit 0 family inet source-address 192.168.1.1/24 filter output output-limit

regards

[tbjornli]

Thank you for your quick reply, however not all of those commands are available on our SRX 3400 which runs Junos 10.2S7

set firewall policer policer-1m if-exceeding bandwidth-limit 1m
set firewall policer policer-1m if-exceeding burst-size-limit 15k
set firewall policer policer-1m then discard

Works fine

set firewall family ethernet-switching filter input-limit term 1 from source-address 192.168.1.2/24

ethernet-switching is not available, the only possible options are any, bridge, inet, inet6

I tried using inet: set firewall family inet filter input-filter term 1 then policier policier-1m but then policier statement isn't available. After som research I found that the then policier however works with simple-filter so the following commands works fine (I don't know if I can use simple-filter tho')

set firewall family inet simple-filter input-limit term 1 from source-address 192.168.1.2
set firewall family inet simple-filter input-limit term 1 then policer policier-1m
set firewall family inet simple-filter input-limit term 1 then accept
set firewall family inet simple-filter input-limit term 2 then accept

The source-address is not an option for the set interface-statement.

I've looked through the options for set interfarce reth0 unit 0 family inet (also tried ge-0/0/x) but I can't seem to find a way to define source-address and filter as you did in your example.

Any ideas?

[tbjornli]

bump

[motd]

On the SRX3K you will indeed have to use the simple-filter. The config looks good so far, all that needs to be done is applying it on an interface:

set interface rethX unit Y family inet simple-filter input <filter name>