> For the complete documentation index, see [llms.txt](https://jncia-workbook.gitbook.io/workbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jncia-workbook.gitbook.io/workbook/junos-firewall-filters/7-rate-limiting.md).
# 7) Rate Limiting
### Pre-Work
Load the config called **ospf.configured.cfg** using the **load\_config\_on\_nodes.py** script.
```
python3 load_config_on_nodes.py --lab_dir three-routers --config_filename ospf.configured.cfg
```
### Lab
On R2, configure a firewall filter for IPv4 that rate-limits ICMP hitting the RE to 32kbps, with a burst size of 64k. All other traffic should be accepted.
### Answer
Expand to reveal
```
set firewall policer 32kbps if-exceeding bandwidth-limit 32k
set firewall policer 32kbps if-exceeding burst-size-limit 64k
set firewall policer 32kbps then discard
edit firewall family inet filter control_plane_v4
set term rate_limit_icmp from protocol icmp
set term rate_limit_icmp then policer 32kbps
set term allow_all then accept
top
set interfaces lo0.0 family inet filter input control_plane_v4
```
### Explanation
Expand to reveal
On Junos, policers are configured under the `firewall` configuration. You create a `firewall policer` policy that defines the CIR/PIR/burst/etc values. You can then police on a "per-class" basis by using the policer inside a firewall filter. The policer is the `then` action.
```
admin@R2> show configuration firewall
family inet {
filter control_plane_v4 {
term rate_limit_icmp {
from {
protocol icmp;
}
then policer 32kbps;
}
term allow_all {
then accept;
}
}
}
policer 32kbps {
if-exceeding {
bandwidth-limit 32k;
burst-size-limit 64k;
}
then discard;
}
```
\
You can also apply firewall policers directly to an interface if you want to police all traffic in total:
```
set interfaces ge-0/0/0.0 family inet policer input|output
```
\
It seems that shapers are configured under `class-of-service`, not under the `firewall` config. This is out-of-scope for the JNCIA, though.
\
If we run a rapid ping with max size (1472) from R1, we should see that every other packet is dropped due to exceeding the policer rate:
```
admin@R1> ping 10.1.2.2 size 1472 rapid count 10
PING 10.1.2.2 (10.1.2.2): 1472 data bytes
!.!.!.!.!.
--- 10.1.2.2 ping statistics ---
10 packets transmitted, 5 packets received, 50% packet loss
round-trip min/avg/max/stddev = 1.724/1.847/2.022/0.137 ms
```
\
The command `show firewall filter ` shows us policer statistics. The name in this output seems to be a combination of the policer name (`32kbps`) and the term name (`rate_limit_icmp`) making `32kbps-rate_limit_icmp`. After sending the 10 pings above, 5 got dropped, and that is shown in the last line:
```
admin@R2> show firewall filter control_plane_v4
Filter: control_plane_v4
Policers:
Name Bytes Packets
32kbps-rate_limit_icmp 7500 5
```
\
As a side note, when you apply a firewall filter containing a policer to multiple interfaces, the aggregate throughput of those interfaces will be policed. The policer is shared among those interfaces. For example, if the policer is set to 32kbps for ICMP traffic and the firewall filter is applied to two interfaces, the throughput of ICMP in total among both interfaces will be capped at 32kbps. To avoid this and do 32kbps on each individual interface, you can use the `interface-specific` configuration knob:
```
set firewall family inet filter NAME interface-specific
```
### Further Reading