Global policers (7250 IXR Gen 3)
7250 IXR Gen 3 platforms support global policers that are applied using forwarding policy match-action rules. Global policers can support different use cases where granular policing is required. Within a match-action rule, each policer action is a reference to a global policer configured using the qos policers policer command. The global policers are applied only to those packets that match the rules in the forwarding policy. A referenced global policer must already exist for the match-action rule to be accepted in the forwarding policy.
Global policers can be configured as one of two types:
- one-rate-two-color
- two-rate-three-color
When a global policer is configured under qos policers policer, it is immediately instantiated on all cores, even if there are currently no match-action rules referencing the policer. The parameters of each policer are copied directly to all the per-core hardware instances.
Global policer statistics
Statistics can be collected for every global policer.
For one-rate-two-color global policers the following statistics are available:
- conforming packets (number of green packets)
- conforming octets (number of bytes in green packets, including Layer 2 overhead)
- violating packets (number of red packets that were dropped)
- violating octets (number of bytes in red packets that were dropped, including Layer 2 overhead)
For two-rate-three-color global policers the following statistics are available:
- conforming packets (number of green packets)
- conforming octets (number of bytes in green packets, including Layer 2 overhead)
- exceeding packets (number of yellow packets)
- exceeding octets (number of bytes in yellow packets, including Layer 2 overhead)
- violating packets (number of red packets that were dropped)
- violating octets (number of bytes in red packets that were dropped, including Layer 2 overhead)
For each policer, the system collects the relevant statistics from all linecards, complexes, and cores with an instance of the policer and displays the sum of the numbers under the info from state qos policers tree. No statistics breakdown by interface, core, complex or linecard is available.
Policer statistics
The following example shows statistics for one-rate-two-color Policer1 and two-rate-three-color Policer2.
--{ + running }--[ qos policers ]--
# info from state with-context
qos {
policers {
discard-all-high-drop-probability true
policer Policer1 {
type one-rate-two-color
color-aware-mode false
last-clear "2026-10-09T22:14:26.117Z (11 minutes ago)"
one-rate-two-color {
committed-rate 199805
committed-burst-size 1125
conform-action {
conforming-packets 19982
conforming-octets 19982000
}
violate-action {
violating-packets 80018
violating-octets 80018000
}
}
}
policer Policer2 {
type two-rate-three-color
color-aware-mode false
last-clear "2026-10-09T22:14:26.193Z (11 minutes ago)"
two-rate-three-color {
committed-rate 99902
committed-burst-size 39875
peak-rate 300000
excess-burst-size 39875
conform-action {
conforming-packets 10031
conforming-octets 10031000
}
exceed-action {
exceeding-packets 20011
exceeding-octets 20011000
}
violate-action {
violating-packets 69958
violating-octets 69958000
}
}
}
}
}Policer resource allocation
The operation of global policers requires the allocation of counter banks to the parent-policers application. By default, no counter banks are assigned to this application. On 7250 IXR Gen 3 platforms, the counter banks used by policers must be allocated in pairs. A minimum resource reservation that provides 32K policers requires one 12K bank (bank ID X) and one 24K bank (bank ID X+12). You must specify both banks in your configuration; a commit error blocks the addition or deletion of a bank tied to the parent-policers application if this results in an unpaired configuration or does not meet the bank ID X+12 criteria.
In the following example, 12k bank ID 13 (X) and 24k bank ID 25 (X+12) are assigned to the parent-policers application.
--{ candidate shared default }--[ platform resource-management counter-banks forwarding-complex-type Gen3 application parent-policers ]--
# info with-context
platform {
resource-management {
counter-banks {
forwarding-complex-type Gen3 {
application parent-policers {
bank-allocation 13 {
}
bank-allocation 25 {
}
}
}
}
}
}
Policer statistics resource allocation
Policer statistics require a separate allocation of counter banks to the parent-policer-stats application. Three counter resources are needed for each global policer. For example, to support 8K global policers (the most that can be targeted by match-action rules) a single 24K counter-bank, two 12K counter banks or four 6K counter banks must be assigned to parent-policer-stats.
In the following example, 12k bank IDs 14 and 15 are assigned to the parent-policers application.
--{ * candidate shared default }--[ platform resource-management counter-banks forwarding-complex-type Gen3 appl
ication parent-policer-stats ]--
# info with-context
platform {
resource-management {
counter-banks {
forwarding-complex-type Gen3 {
application parent-policer-stats {
bank-allocation 23 {
}
bank-allocation 24 {
}
}
}
}
}
}
For information about allocating counter banks, see "Flexible counter bank allocation" in the SR Linux Configuration Basics Guide.
Clearing statistics
To return all statistics associated with a specific policer to zero and restart counting, use the tools qos policers policer clear-stats command.
Policer drop setting for red packets
SR Linux supports three different drop probability colors per packet:
- green — low drop probability
- yellow — medium drop probability
- red — high drop probability
These colors can be configured using classifier policy actions (for example, assigning DSCP 14 a drop probability of high) or using policer templates.
By default, global policers are color blind, which means that regardless of the drop probability set by the ingress classifier policy, the packet color is determined completely by the global policer metering. For example, for global two-rate, three-color marking, if the CBS bucket has enough tokens for the packet, the new color is green. If the CBS bucket does not have enough tokens, but the EBS bucket has enough tokens, the new color is yellow. And if neither the CBS nor the EBS bucket has enough tokens, the new color is red.
When color-aware mode is enabled, the policer algorithm processes ingress packets based on the drop probability that is previously applied to the packets by the input classifier.
On 7250 IXR platforms, red packets must be handled uniformly: either they are always eligible for forwarding (with possible remarking) or they are not eligible for forwarding and must be dropped as soon as they are deemed to be high drop probability.
By default, SR Linux implements the first option, meaning that a red packet can be transmitted as long as the egress queue congestion is moderate. However, 7250 IXR Gen 3 platforms also support a policer drop setting (qos policers discard-all-high-drop-probability) that modifies the default behavior for all global and subinterface-level policers so that all red packets are discarded immediately rather than forwarded. When this feature is enabled:
- All single-rate, two-color and two-rate, three-color global policers drop all red packets (an implicit setting of violate-action drop true).
- Any configured subinterface policer policies also drop all red packets.
- The default DSCP classifier policy (used by all subinterfaces without an explicit dscp-policy) is changed so that any DSCP values that map to drop-probability high are changed to drop-probability medium. The updated policy can be viewed using the info from state dscp-policy default command.
The updated default DSCP policy is shown in the following table, with the revised drop probabilities in bold.
| DSCP values | Included DSCP names | Forwarding class | Drop probability |
|---|---|---|---|
| 0, 2 to 7 | CS0/BE | fc0 | Low |
| 1 | LE | fc0 | Medium |
| 8 to 11 | CS1, AF11 | fc1 | Low |
| 12 to 13 | AF12 | fc1 | Medium |
| 14 to 15 | AF13 | fc1 | Medium |
| 16 to 19 | CS2, AF21 | fc2 | Low |
| 20 to 21 | AF22 | fc2 | Medium |
| 22 to 23 | AF23 | fc2 | Medium |
| 24 to 27 | CS3, AF31 | fc3 | Low |
| 28 to 29 | AF32 | fc3 | Medium |
| 30 to 31 | AF33 | fc3 | Medium |
| 32 to 35 | CS4, AF41 | fc4 | Low |
| 36 to 37 | AF42 | fc4 | Medium |
| 38 to 39 | AF43 | fc4 | Medium |
| 40 to 47 | CS5, EF | fc5 | Low |
| 48 to 55 | CS6/NC1 | fc6 | Low |
| 56 to 63 | CS7/NC2 | fc7 | Low |
When the discard-all-high-drop-probability setting is false, the default behavior remains unchanged:
- The default DSCP classifier policy is unchanged.
- All global policers and subinterface policers can transmit red packets if the egress queue is not congested (implicit setting of violate-action drop false).
Configuring global policers
To configure global policers, use the qos policers command, specifying the policer type (one-rate-two-color or two-rate-three-color) and related parameters. To configure color-aware policing, set the color-aware-mode parameter to true (enabled) or false (disabled, the default value).
Configure global policers
--{ * candidate shared default }--[ ]--
# info with-context qos policers
qos {
policers {
policer global-policer-name {
type one-rate-two-color
color-aware-mode false
one-rate-two-color {
committed-rate 100000
committed-burst 10000
}
two-rate-three-color {
committed-rate 100000
committed-burst 10000
peak-rate 300000
excess-burst 200000
}
}
}
}
Each one-rate-two-color policer supports the following configurable parameters:
- committed-rate (in kilobits per second) — specifies the rate at which tokens are added to the token bucket
- committed-burst-size (in bytes) — specifies the depth of the token bucket
Each two-rate-three-color policer supports the following configurable parameters:
- committed-rate (in kilobits per second) — specifies the rate at which tokens are added to the primary bucket
- committed-burst-size (in bytes) — specifies the depth of the primary bucket
- peak-rate (in kilobits per second) — specifies the rate at which tokens are added to the secondary bucket
- excess-burst-size (bytes) — specifies the depth of the secondary bucket
Reference a global policer in a match-action policy
To reference the global policer in a match-action policy, specify the policer name using the network-instance policy-forwarding policy rule action policer command.
--{ candidate shared default }--[ ]--
# info with-context network-instance default policy-forwarding policy match-action-policy-name rule 10
network-instance default {
policy-forwarding {
policy match-action-policy-name {
rule 10 {
action {
policer global-policer-name
}
match {
ipv4 {
destination-ip {
prefix 10.10.0.1/32
}
}
}
}
}
}
}
For more information about forwarding policy match-action policies, see the SR Linux ACL and Traffic Steering Guide.
Configuring policer drop setting for red packets
To enable all global policers and subinterface policers to drop all red packets, use the system-level qos policers discard-all-drop-high-probability true command. Changing the setting (true to false or false to true) takes effect immediately, without a need for a chassis or linecard reset.
Configure global policer drop setting for red packets
--{ candidate shared default }--[ ]--
# info with-context qos policers discard-all-high-drop-probability
qos {
policers {
discard-all-high-drop-probability true
}
}