Nothing looks out of sorts. For the sake of testing, if you give the input direction a different policer, does it show any hits on 'show policer' output?
Eg; set firewall family inet filter customer-ZZZ-out term default then policer policer-20m-TEST set firewall policer policer-20m-TEST if-exceeding bandwidth-limit 22m ... -----Original Message----- From: Chris Lee [mailto:[email protected]] Sent: Wednesday, October 14, 2020 7:05 PM To: [email protected] Subject: Traffic shaping on SRX340 Hi, We're running an SRX340 in packet mode as a router for customer internet access on campus, generally providing smaller speed links around 5/10/20/50Mbps symmetric. We apply a filter to the customers interface on the input and output, with a policer policy to discard traffic when exceeding the defined bandwidth limit. So in the example configuration below, I find that when running a speed test on the customers IP that the download traffic to them is shaped nicely, spot on 22Mbps as in the example below, however on the upload test it's as if the filter as no impact whatsoever and they get 60-70Mbps. Anyone have any ideas on what I might be doing wrong? JunOS is 18.2R3-S3 in this case, however this router was previously running a 15 release and we had the same issue with the filters only seeming to work on the download and not the upload traffic. set interfaces ge-0/0/4 unit 3623 description "CUST-INTERNET-ZZZ Internet" set interfaces ge-0/0/4 unit 3623 vlan-id 3623 set interfaces ge-0/0/4 unit 3623 family inet filter input customer-ZZZ-in set interfaces ge-0/0/4 unit 3623 family inet filter output customer-ZZZ-out set interfaces ge-0/0/4 unit 3623 family inet address 192.0.2.133/30 set firewall family inet filter customer-ZZZ-in term allow-icmp from protocol icmp set firewall family inet filter customer-ZZZ-in term allow-icmp then accept set firewall family inet filter customer-ZZZ-in term default then policer policer-20m set firewall family inet filter customer-ZZZ-in term default then accept set firewall family inet filter customer-ZZZ-out term allow-icmp from protocol icmp set firewall family inet filter customer-ZZZ-out term allow-icmp then accept set firewall family inet filter customer-ZZZ-out term default then policer policer-20m set firewall family inet filter customer-ZZZ-out term default then accept set firewall policer policer-20m if-exceeding bandwidth-limit 22m set firewall policer policer-20m if-exceeding burst-size-limit 625k set firewall policer policer-20m then discard Thanks, Chris _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
