Juniper Dynamic Subscriber Management – Traffic Policing

juniperjuniper-junospolicing

I've managed to get QinQ subscriber management working. Now I want to shape / police both VLAN connections. As a test I have configured this:

DYNINTF-STACKED-KANTOOR-TEST {
    interfaces {
        "$junos-interface-ifd-name" {
            unit "$junos-interface-unit" {
                proxy-arp restricted;
                vlan-tags outer "$junos-stacked-vlan-id" inner "$junos-vlan-id";
                filter {
                    input "$junos-input-filter";
                    output "$junos-output-filter";
                }
                family inet {
                    unnumbered-address lo0.0 preferred-source-address 10.110.110.1;
                }
            }
        }
    }

}

The filter:

show firewall filter 17Mb 
term test {
    then policer 17Mb-policer;
}

And at last, the policer:

policer 17Mb-policer {
    if-exceeding {
        bandwidth-limit 17m;
        burst-size-limit 1m;
    }
    then discard;
}

If I for example configure police-17M on both input and output filter hierarchy in the dynamic profile then it works fine:

IPv4 Input Filter Name: police-17M-ge-1/1/4.1073936801-in
IPv4 Output Filter Name: police-17M-ge-1/1/4.1073936801-out

But this is not the way it should be..

UPDATE

This is what I now receive on the Juniper:

Apr  7 12:16:58.908497 radius-access-accept: Ingress-Policy-Name (Juniper-ERX-VSA) received: police-17M
Apr  7 12:16:58.908552 radius-access-accept: Egress-Policy-Name (Juniper-ERX-VSA) received: police-17M

However, showing this subscriber in extensive mode, I don't see it being applied to the dynamic interface. Any idea why?

Best Answer

So you need two dynamic profiles. A VLAN and an IP profile. The VLAN profile is for creating dynamic profiles and the IP profile is for applying filters to them.

Notice the use of $junos-underlhing-interface-unit which is basically the dynamically created unit by the VLAN profile.

VLAN profile:

DYNINTF-VLAN-DHCP-INET-KPN {
    interfaces {
        "$junos-interface-ifd-name" {
            unit "$junos-interface-unit" {
                proxy-arp restricted;
                vlan-id "$junos-vlan-id";
                family inet {
                    unnumbered-address lo0.0 preferred-source-address 10.110.110.1;
                }
            }
        }
    }
 }

IP profile:

 DYNSUB-IP-PROFILE-KPN {
    interfaces {
        "$junos-interface-ifd-name" {
            unit "$junos-underlying-interface-unit" {
                family inet {
                    filter {
                        input "$junos-input-filter";
                        output "$junos-output-filter";
                    }
                }
            }
        }
    }
}

--

In my situation, i have two VLAN profiles. One for single and one for stacked VLAN customers. The IP profile is configured under the DHCP group for the whole interface while only the stacked VLAN profiles should use them. If anyone got an idea for this, I'm happy to hear you out :-)

Related Topic