Juniper EX9200 Series, Features Manual

Page: 128 / 278

source-address {
10.10.10.0/24;
10.11.0.0/16 ;
}
}
then prefix-action psa-1Mbps-per-source-24-32-256;
}
}
}
}
interfaces {
so-0/0/2 {
unit 0 {
family inet {
filter {
input limit-source-two-24-16;
}
address 10.39.1.1/16;
}
}
}
}
Scenario 2: Subnet Prefix Is Longer Than the Prefix in the Filter Match Condition
The complete example, “Example: Configuring Prefix-Specific Counting and Policing” on
page 100 , shows the simplest case of prefix-specific actions, in which the single-term
firewall filter matches on one address with a prefix length that is the same as the subnet
prefix length specified in the prefix-specific action. Unlike the example, this scenario
describes a configuration in which the prefix-specific action defines a subnet prefix length
that is longer than the prefix of the source address matched by the firewall filter. In this
case, the prefix-specific action defines a subnet-prefix value of
25 , while the firewall filter
matches on a source address in the /24 subnet.
NOTE: The firewall filter passes the prefix-specific action packets with source
addresses that range from 10.10.10.0 through 10.10.10.255 , while the
prefix-specific action specifies a set of only 128 counters and policers,
numbered from 0 through 127.
The filter-matched packets that are passed to the prefix-specific action index into the
counter and policer set in such a way that the counting and policing instances are shared
by packets that contain either of two source addresses within the
10.10.10.0/24 subnet:
•
The first counter and policer in the set are indexed by packets with source addresses
10.10.10.0 and 10.10.10.128 .
• The second counter and policer in the set are indexed by packets with source addresses
10.10.10.1 and 10.10.10.129 .
• The 128th (last) counter and policer in the set are indexed by packets with source
addresses
10.10.10.127
and
10.10.10.255
.
Copyright © 2016, Juniper Networks, Inc. 110
Traffic Policers Feature Guide for EX9200 Switches