Subinterface traffic policing using per-FC policer policies and aggregate policers (7250 IXR Gen 3)

Note: Policer policies and aggregate policers for subinterfaces are supported only on 7250 IXR Gen 3 platforms.

On 7250 IXR Gen 3 platforms, there are two levels of policers that can be applied to subinterfaces:

  • Per-FC policer policies — policies containing eight policers running the trTCM2 or trTCM2-coupled algorithm as specified under qos policer-policies
  • Aggregate subinterface policers — global policers used for aggregate policing running a one-rate-two-color or two-rate-three-color algorithm as specified under qos policers

Per-FC policer policies

Per-FC policer policies define individual policers applied at the subinterface level and their respective parameters.

Each policer in the policy operates using one of two available two-rate-three-color marker2 (trTCM2) algorithm-type options:

  • trtcm2 (default): RFC 4115 trTCM
  • trtcm2-coupled

trTCM2 (color aware)

The trtcm2 option refers to the policing algorithm defined in RFC 4115. With trtcm2, packets that are below the CIR bucket (Tc) depth are immediately colored green, without the need to evaluate the packets against the EBS bucket depth. This behavior is the principal differentiator between the RFC 4115 and RFC 2698 algorithms.

Two token buckets are used, the CBS bucket and the EBS bucket. Tokens are added to the buckets based on the CIR and EIR rates.

Figure 1. RFC 4115 (trtcm2): green packets

When a green or uncolored packet of size B bytes arrives at time t, the algorithm processes the packet as follows:

  • If C – B > 0, the packet is green (conforming), and B bytes are drained from Tc.
  • If E – B > 0, the packet is yellow (exceeding), and B bytes are drained from Te.
  • Otherwise, the packet is red (violating) and no tokens are drained from Tc or Te.

The algorithm deducts tokens from either the CBS bucket (when the algorithm identifies the packet as in-profile or green) or the EBS bucket (when the algorithm identifies the packet as out-of-profile or yellow).

For yellow packets, the token bucket operation differs as shown in the following diagram. In this case, only the EBS bucket is used.

Figure 2. RFC 4115 (trtcm2): yellow packets

When a yellow packet arrives at ingress, the algorithm deducts tokens only from the EBS bucket.

When a yellow packet of size B bytes arrives at time t, the algorithm processes the packet as follows:

  • If E – B > 0, the packet is yellow (exceeding), and B bytes are drained from Te.
  • Otherwise, the packet is red (violating) and no tokens are drained from Te.

Color aware policing

Every policer can be configured to operate in color-aware or color-blind mode. By default on 7250 IXR Gen 3 platforms, color-aware mode is disabled.

When color-aware mode is enabled, the trTCM2 algorithm processes ingress packets based on the drop probability that is previously applied to the packets by the input classifier. When color-aware mode is disabled, the trTCM2 algorithm ignores the drop probability that is previously applied by the input classifier.

trTCM2-coupled

When the trtcm2-coupled option is enabled (also referred to as TRTCM-DS-coupled mode), the operation is similar to standards-based RFC 4115 trTCM2 as described in the previous section, with one key difference: when the committed token bucket is full, any excess tokens that would otherwise fill the committed bucket are instead transferred to the excess token bucket. In this case, yellow (non-conforming) traffic can consume any excess CIR tokens. This differs from standard trTCM2, where the system replenishes the committed and excess token buckets independently. In this case, only green (conforming) traffic can consume CIR tokens, and any excess tokens are discarded.

The following figure shows the operation of the bandwidth profile algorithm for sharing excess bandwidth in trTCM2-coupled mode, which enables the coupling flag (CF).

Figure 3. Bandwidth profile algorithm for sharing excess bandwidth in trTCM2-coupled mode

Policer policy settings

When a custom-defined policer policy is created, all eight policers are implicitly assigned and set to the maximum rate, regardless of the number of policers explicitly defined within the policer policy. The explicit policer definitions can then overrule these parameters. The actual rates are displayed in state for specified policer instances.

Within each policy, policers are defined by algorithm type, CIR, EIR, CBS, and EBS values. However, the violate action for red packets is not policy-specific, but is defined globally instead. For more information see Policer drop setting for red packets.

CIR vs EIR bucket sizes

A packet can be non-conforming to an EIR bucket, while still conforming to a CIR bucket. This seemingly contradictory condition can occur when the CBS is quite large relative to EBS, while the difference between CIR and EIR is very small (or for example, when CIR = EIR).

Single-rate emulation

Per-FC policer policies provide no explicit CLI option to configure srTCM; however, the srTCM policer algorithm can be emulated by defining only a single rate (for example, CIR only). However, be aware that the smallest possible value for CIR or EIR is 64 kb/s.

LAG operation

If policer policies are applied to LAG subinterfaces, a single policer per-complex and per-subinterface is allocated with the configured rates. If any of the LAG members are in different forwarding complexes, the subinterface is allocated the bandwidth multiplied by the number of member forwarding complexes.

Policer profile marking

The following tables describe the color-aware operation of the trTCM2 and trTCM2-coupled policers.

trtcm2 (colour-aware)

Input drop-probability CIR conform EIR conform Output drop-probability CIR bucket decrement EIR bucket decrement
low conform N/A low true false
non-conform conform medium false true
medium conform N/A medium true false
non-conform conform medium false true

trtcm2-coupled (color-aware)

Input drop-probability CIR conform EIR conform Output drop-probability CIR bucket decrement EIR bucket decrement
low conform n/a low true false
non-conform conform medium false true
medium conform conform medium false true
non-conform conform high false true

Policer and policer statistics resource allocation

The operation of per-FC policers requires the allocation of counter banks to the fc-policers application. Similarly, policer statistics require a separate allocation of counter banks to the fc-policer-stats application. By default, no counter banks are assigned to these applications. For more information, see Global policers (7250 IXR Gen 3).

Configuring a per-FC policer policy

To configure a per-FC subinterface policer policy, use the qos policer-policies policer-policy command. To configure the global violate action for red packets, use the qos policers discard-all-high-drop-probability command. (See Configuring policer drop setting for red packets.)

Note: If per-FC policers and aggregate subinterface policers are attached to the same subinterface, both policers must be set to operate in the same color-aware-mode: either true (color-aware) or false (color-blind). However, SR Linux does not check or enforce this configuration.

Configure a subinterface policer policy

--{ candidate shared default }--[ ]--
# info with-context qos policer-policies
    qos {
        policer-policies {
            policer-policy sub-if-policer-policy-name {
                policer 0 {
                    algorithm-type trtcm2-coupled
                    color-aware-mode true
                    committed-rate-kbps 64
                    excess-rate-kbps 96
                    committed-burst-size 40000
                    excess-burst-size 60000
                    adaptation-rules {
                        committed-rate closest
                        excess-rate closest
                    }
                }
            }
        }

--{ candidate shared default }--[  ]--
# info with-context qos policers discard-all-high-drop-probability
    qos {
        policers {
            discard-all-high-drop-probability false
        }
    }
Table 1. Parameters for qos policer-policies
Parameter Definition
policer-policy <name> Assigns a name to the policer policy.
policer <sequence-id> Assigns the sequence ID for the policer.
algorithm-type [trtcm2 | trtcm2-coupled] Specifies the algorithm type for the policer: trTCM2 or trTCM2-coupled.
color-aware-mode [true | false] Specifies whether the policer operates in color-aware mode (true) or color-blind mode (false).
committed-rate-kbps <64 to 2700000000> Sets CIR in kb/s.
excess-rate-kbps <0 to 2700000000> Sets EIR in kb/s.
committed-burst-size <64 to 4161536> Sets CBS in bytes.
excess-burst-size <64 to 4161536> Sets EBS in bytes.
adaptation-rules committed-rate [closest | higher | lower]

Sets the adaptation rule defining how configured values for CIR are mapped to hardware values.

The actual rate is displayed in state under info from state qos interfaces interface input policer-policies policer committed-rate-kbps.
adaptation-rules excess-rate [closest | higher | lower]

Sets the adaptation rule defining how configured values for EIR are mapped to hardware values.

The actual rate is displayed in state under info from state qos interfaces interface input policer-policies policer excess-rate-kbps.

Applying a per-FC policer policy to a subinterface

Apply an ingress policer policy to a subinterface using the policer-policies policer-policy commands.

Apply ingress policer policies to a subinterface

--{ candidate shared default }--[  ]--
# info with-context qos interfaces interface eth-1/1.1 input
    qos {
        interfaces {
            interface eth-1/1.1 {
                input {
                    policer-policies {
                        policer-policy sub-if-policer-policy-name
                    }
                }
            }
        }
    }

Configuring per-FC policer policy statistics

By default, per-FC policer statistics are enabled on subinterfaces that have policer policies applied, provided that the required counter banks are assigned for the FC policer statistics. You can disable the statistics as required for each subinterface. For any specified subinterface, statistics are enabled or disabled for all per-FC policers.

Note: Configuration of policer statistics is supported only for per-FC policer policies. For aggregate subinterface policers, statistics resources are automatically assigned and enabled.

To manage available per-FC policer statistics resources, you can choose which interfaces have policer statistics enabled or disabled using the qos interfaces interface input policer-policies enable-policer-statistics command.

Enable policer statistics

--{ candidate shared default }--[ qos ]--
# info with-context interfaces interface eth-1/1.1 input policer-policies enable-policer-statistics
    qos {
        interfaces {
            interface eth-1/1.1 {
                input {
                    policer-policies {
                        enable-policer-statistics true
                    }
                }
            }
        }
    }

Aggregate subinterface policing

SR Linux also supports the configuration of per-subinterface aggregate policing policies using the qos interfaces interface input policer-policies interface-policer command. This command assigns the subinterface a global policer created using the qos policers command. For more information about global policers, see Global policers (7250 IXR Gen 3).

The following restrictions apply when global policers are applied to subinterfaces:

  • If you apply a global policer to a subinterface as an aggregate policer, no match-action policer policy can be associated with that global policer. However, SR Linux does not enforce or block this configuration.
  • The names configured for global policers must be unique for each subinterface.

The global policer is defined by algorithm type, color-aware mode, and CIR, EIR, CBS, and EBS values.

Configuring aggregate subinterface policing

To apply a global policer to a subinterface for aggregate policing, use the qos interfaces interface input policer-policies policer-policy command. To configure the global violate action for red packets, use the qos policers discard-all-high-drop-probability command. (See Configuring policer drop setting for red packets.)

Note: If per-FC policers and aggregate subinterface policers are attached to the same subinterface, both policers must be set to operate in the same color-aware mode. However, SR Linux does not enforce this configuration.

Configure aggregate subinterface policing

The following example shows a global policer applied to a subinterface for aggregate policing. An example global policer configuration is also included. 

--{ candidate shared default }--[  ]--
# info with-context qos interfaces interface eth-1/1.1 input policer-policies
    qos {
        interfaces {
            interface eth-1/1.1 {
                interface-ref {
                    interface ethernet-1/1
                    subinterface 1
                }
                input {
                    policer-policies {
                        interface-policy global-policer-policy-name
                    }
                }
            }
        }
    }

--{ candidate shared default }--[  ]--
# info with-context qos policers
    qos {
        policers {
            discard-all-high-drop-probability false
            policer global-policer-name {
                color-aware-mode true
                two-rate-three-color {
                    committed-rate 100000
                    committed-burst-size 1000000
                }
            }
        }
    }

Displaying policer statistics

Aggregate policer statistics are collected for the per-FC policer policies and the subinterface aggregate policer.

The following statistics are supported:

  • accepted-packets
  • accepted-octets
  • accepted-in-packets
  • accepted-in-octets
  • accepted-out-packets
  • accepted-out-octets
  • exceed-packets
  • exceed-octets

To display policer statistics, use the info from state qos interfaces interface input policer-policies policer policer-statistics command.

Display policer policy statistics

--{ state }--[  ]--
# info from state qos interfaces interface ethernet-1/1.1 input policer-policies policer 0 policer-statistics
    policer-statistics {
        aggregate-statistics {
            accepted-in-packets 132558
            accepted-in-octets 8483712
            accepted-out-packets 265108
            accepted-out-octets 16966912
            exceed-packets 1009638735
            exceed-octets 64616879040
        }
    }

Display LAG member statistics

The following example displays LAG policer statistics, including per-LAG member statistics. 

--{ state }--[  ]--
# info from state qos interfaces interface lag1.1 input policer-policies policer 0 policer-statistics
    policer-statistics {
        aggregate-statistics {
            accepted-in-packets 100406
            accepted-in-octets 6425984
            accepted-out-packets 200812
            accepted-out-octets 12851968
            exceed-packets 764747433
            exceed-octets 48943835712
        }
        per-lag-member-statistics {
            linecard 1 {
                forwarding-complex 0 {
                    accepted-in-packets 100406
                    accepted-in-octets 6425984
                    accepted-out-packets 200812
                    accepted-out-octets 12851968
                    exceed-packets 764747433
                    exceed-octets 48943835712
                }
            }
        }
    }

Displaying pending resource allocation for policer policies and statistics

To display per-FC policer polices and statistics that are pending resource allocation, use the info from state qos interfaces interface input policer-policies policer-policy-allocation-pending command.

Display pending resource allocation for per-FC policer

--{ state }--[  ]--
# info from state qos interfaces interface ethernet-1/1.1 input policer-policies policer-policy-allocation-pending
    policer [
        forwarding-complex-1/0
    ]
    policer-statistics [
        forwarding-complex-1/0
    ]

Display pending resource allocation for aggregate subinterface policer

To display pending resource allocation for aggregate subinterface policers, use the info from state qos policers policer allocation-pending command. 

--{ state }--[  ]--
# info from state qos policers policer * allocation-pending
    policer 1 {
        allocation-pending {
            policer [
                forwarding-complex-1/0
            ]
            policer-statistics [
                forwarding-complex-1/0
            ]
        }
    }