Considerations for Layer 2 ACL-based Rate Limiting

• ACL-based rate limiting is applicable for ingress traffic only. Egress traffic is blocked by the SLX-OS device.
• Layer 2 ACL rate limiting takes precedence over BUM rate limiting.
• You can create a policy map with the class-map types of default, VLAN or bridge domain, Layer 2 ACL, and Layer 3 ACL rate limiting.
• There is one policer for each ACL, and it applies to all rules for that ACL.
• Control protocols are rate limited if they match the configured ACL clause.
• ACL-based, storm-control, and port-based rate limiting can coexist on the same interface. ACL-based rate limiting has the highest priority, followed by storm-control rate limiting, and then port-based rate limiting.
• Packet drops caused by any action other than ACL rate limiting are included in the policer counters.
• Traffic that matches deny or hard-drop rules is not subject to rate limiting.
• Metering is performed on the packet size as received on the wire (including IPG, Preamble and SOF, and ignoring FCS and CRC).
• A policy map can be applied to a physical port and to LAG interfaces.
• Multiple class maps with user-defined ACLs can be added in a policy map. However, after a matching ACL clause is found, the device does not evaluate subsequent ACL clauses and subsequently rate limits those ACLs.
• The configured rate in bits per second (bps) is rounded up to the next achievable rate.
• Statistics display only two colors. Conform includes Green and Yellow color packets. Violated includes dropped or a RED color packet.
• You cannot delete a policy map that is active on the interface.
• You cannot delete a class map from a policy map when the policy map is active on the interface.
• If a policy map is applied to an interface and no policer attributes are present in this policy map, then ingress and egress packets on this interface are marked as green (conforming).
• A policy map can be bound to multiple interfaces.
• A policy map cannot be bound to interface if a class map is not associated with this policy map.
• When ACL rate limiting is applied to a LAG logical port, the maximum rate on this port is the number of towers in this LAG * CIR. For example, if Ethernet 1/1, 1/2 , 2/1, and 3/1 are LAG member ports, then the maximum rate is 3 * CIR.
• Layer 2 ACL rate limiting can be configured at the interface or system level. Interface ACL rate limiting has a higher priority than global ACL rate limiting. The TCAM is shared between the interface and global ACL rate limiting. When a policy map is bound for interface and global ACL rate limiting, the TCAM can accommodate the following maximum number of class maps:
  • Layer 3 ACL rate limiting = 2K class maps
  • Layer 3 ACL global rate limiting = 512 class maps
  • Layer 2 ACL rate limiting = 512 class maps
  • Layer 2 ACL global rate limiting = 256 class maps
• There is a software restriction of 32 class maps per policy map. The TCAM maximum number of class maps is inside a policy map whose ACL rules would be programmed to the TCAM. This number is derived based on the priority ranges as described in Precedence for the ACL and Rate Limiting Features.
• The number of ACL entries is limited by the TCAM size. For more information, see the scalability numbers in the release notes.
• Layer 2 ACL rate limiting can be configured on a VPLS or VLL endpoint when the default TCAM profile is enabled. Configure the Layer 2 ACL filter parameters to match outer-vlan, vlan-tag-format, and inner-vlan based on the traffic received on a LIF for which rate limiting is required.
  

  Important

  Layer 2 ACL-based rate limiting on VPLS endpoints is not supported on SLX 9150.
• To disable the learning of MAC addresses for stream matching of the ACL-based rate limiting entries, change the CIR and EIR values to 0.

  The MAC address entries in the MAC-address table that are already learned are not flushed when you configure the CIR or EIR value as 0. Use the clear mac-address-table dynamic command to explicitly clear the entries in the MAC-address table.