Egress ACL Rate Limiting Considerations

Important

The egress ACL rate limiting feature is not supported on SLX 9150.

Consider the following when you configure egress ACL rate limiting:

• Egress rate limit supports packets that are received at a physical port but transmitted on a different physical port. If the packets are received and transmitted on the same physical port, you should deploy ingress rate limit.
• If the multiple VLANs are on the same ingress port belonging to the same bridge domain and egress ACL rate limiting is configured to rate limit one of the VLANs, the traffic of all VLANs is rate limited. As a workaround, add a matching source or destination MAC address with the VLAN in the ACL.
• Ingress ACL rate limit and egress ACL rate limit do not work together on the same flow of traffic.
• To redirect traffic that requires egress rate limit to new sets of VOQ, the devices uses PMF and VOQ resources that limits the number of supported policies.
  • The following system scale numbers are based on the limitation of VOQ connector and PMF entries:

    Table 1. Scale numbers

    Device type	Maximum RL class per tower	Maximum RL class per system
    SLX 9540	2,000	2, 000

  • The PMF is configured to filter the certain types of Layer 2 or VPLS traffic and reroute them to the VOQs for egress rate limiting.

    Table 2. PFM filter keys

    Filter key	Description
    Port	Egress port of the Layer 2 packets.
    VLAN	VLAN-based rate limit: The VLAN in which the port participates.
    Bridge Domain	Bridge domain-based rate limit: The bridge domain in which the port's logical interface participates.
    VLAN Tag	ACL-based rate limit: The configuration of either the single tag or the double tags of the traffics on the egress port is required with the following match: For a VLAN, the single tag must match the VLAN to which the port participates. For a bridge domain, the associated logical interface must exist first.
    Ethernet Type	ACL-based rate limit: Ethernet type of Layer 2 packets. It is optional, but assists in restricting packets for egress rate limiting.
    Source MAC	ACL-based rate limit: Source MAC address of Layer 2 packets. It is optional, but assists in restricting packets for egress rate limiting.
    Destination MAC	ACL-based rate limit: Destination MAC address of Layer 2 packets. It is optional, but assists in restricting packets for egress rate limiting.

• For egress rate limiting, enable the L2-Egress-RateLimit TCAM profile and then reboot the device after making this configuration change. A maximum of 2,048 egress rate limiting is supported system wide.
• Supported functionality includes the following:
  • Per port egress rate limit
  • Per flow egress rate limit for Layer 2 VLAN, bridge domain, and ACL
  • Per flow egress strict priority for Layer 2 VLAN, bridge domain, and ACL
  • VPLS ingress direction
• Unsupported functionality includes the following:
  • WFQ
  • Per-priority shaping
  • VPLS egress direction
  • VXLAN (in and out direction)
  • Layer 3 traffic