Extreme SLX-OS QoS and Traffic Management Configuration Guide, 20.2.2a

Egress rate limit supports packets that are received at a physical port but transmitted on a different physical port. If the packets are received and transmitted on the same physical port, you should deploy ingress rate limit.

If the multiple VLANs are on the same ingress port belonging to the same bridge domain and egress ACL rate limiting is configured to rate limit one of the VLANs, the traffic of all VLANs is rate limited. As a workaround, add a matching source or destination MAC address with the VLAN in the ACL.

Ingress ACL rate limit and egress ACL rate limit do not work together on the same flow of traffic.

To redirect traffic that requires egress rate limit to new sets of VOQ, the devices uses PMF and VOQ resources that limits the number of supported policies.

The following system scale numbers are based on the limitation of VOQ connector and PMF entries:

Table 1. Scale numbers
Device type	Maximum RL class per tower	Maximum RL class per system
SLX 9540	2,000	2, 000

The PMF is configured to filter the certain types of Layer 2 or VPLS traffic and reroute them to the VOQs for egress rate limiting.

Table 2. PMF filter keys
Filter key	Description
Port	Egress port of the Layer 2 packets.
VLAN	VLAN-based rate limit: The VLAN in which the port participates.
Bridge Domain	Bridge domain-based rate limit: The bridge domain in which the port's logical interface participates.
VLAN Tag	ACL-based rate limit: The configuration of either the single tag or the double tags of the traffics on the egress port is required with the following match: For a VLAN, the single tag must match the VLAN to which the port participates. For a bridge domain, the associated logical interface must exist first.
Ethernet Type	ACL-based rate limit: Ethernet type of Layer 2 packets. It is optional, but assists in restricting packets for egress rate limiting.
Source MAC	ACL-based rate limit: Source MAC address of Layer 2 packets. It is optional, but assists in restricting packets for egress rate limiting.
Destination MAC	ACL-based rate limit: Destination MAC address of Layer 2 packets. It is optional, but assists in restricting packets for egress rate limiting.

For egress rate limiting, enable the L2-Egress-RateLimit TCAM profile and then reboot the device after making this configuration change. A maximum of 2,048 egress rate limiting is supported system wide.

SLX 9740

SLX 9740 supports policing on the egress side and Egress TCAM helps to identify the flow. Egress RL supports CBS, EIR and EBS configurations on SXL 9740.

The Maximum value for the CBS is 255MB.

Egress TCAM has support for only 1024 entries for egress ACL lookup which is also shared with Security ACL. This limits the maximum scale number supported on Flow based Egress Rate-limiting to 1024.

Conformed and Violated counters are not supported for Flow based Egress RL, only hit counters are supported.

Egress Rate limiting cannot be used along with BD configuration. Rate limiting at egress works for known unicast and BUM traffic. But due to hardware issue, BUM traffic gets corrupted. if BUM traffic hits the Egress RL, the vlan ID of the out going frame will be replaced with Bridge Domain ID.

Egress metering doesn‘t consider IFG/IPG in SLX 9740. This is a hardware limitation of the Broadcom chip BCM88690. Hence there is deviation seen between the operational CIR and the on-wire rate. This deviation is more for smaller sized packets. For packets with size more than 1024 bytes, the deviation is less than 3%.

Egress Rate limiting is supported on default TCAM profile.

Supported functionality includes the following:

Per port egress rate limit
Per flow egress rate limit for Layer 2 VLAN, bridge domain, and ACL
Per flow egress strict priority for Layer 2 VLAN, bridge domain, and ACL
VPLS ingress direction

Unsupported functionality includes the following:

WFQ
Per-priority shaping
VPLS egress direction
VXLAN (in and out direction)
Layer 3 traffic

Egress ACL Rate Limiting Considerations