Premium IP Filter

A firewall filter is applied to the input interface(s) to a customer. It accepts, drops or retags the Premium IP packets based on the criteria listed below.

• The in-profile packets are classified in the expedited-forwarding queue (i.e. re-writing of the interface classification). If the Premium IP DSCP value varies between the two domains, the packets must be tagged with the new DSCP value.
  
  
• The out-of-profile packets must be discarded.
  
  
• The "errant" packets (i.e. those wrongly using the Premium IP tagging) must be re-tagged as Best Effort.

The criteria to accept the Premium IP packets are as follows.

1. If the upstream network is Premium IP-compliant (no errant Premium IP packets coming from this network)

• DSCP value  
• Destination IP address

[edit firewall]

filter customer1-in {
       policer pol-cust1-cust2 {         -- policer definition for PIP
              if-exceeding {             -- traffic from customer 1 to
               bandwidth-limit 2m;       -- customer 2
               burst-size-limit 22350;
           }
           then discard;                 -- discard excess traffic
       }
       policer pol-cust1-cust3 {         -- policer definition for PIP
           if-exceeding {                -- traffic from customer 1 to
               bandwidth-limit 2m;       -- customer 3
               burst-size-limit 22350;
           }
           then discard;
       }
[...]
       term rl-IPP-cust1-cust2 {
    from {
               destination-prefix-list { -- the destination prefix list
                   pref-list-cust2;      -- is the one of the customer 2
               }
               dscp 46;                  -- rate-limitation dscp 46 
                                         -- (Premium IP)
           }
           then {
 count IPP-cust1-cust2;                  -- monitor the amount of PIP 
                                         -- between cust1 and cust2
 policer pol-cust1-cust2;                -- rate-limit the amount of PIP 
                                         -- between cust1 and cust2
                                         -- and drop the excess
 loss-priority low;                      -- set the loss priority (for the 
                                         -- RED drop profile - optional
                                         -- in this configuration)
 forwarding-class expedited-forwarding;  -- re-write the classification 
                                         -- done by the classifier, 
                                         -- send the packet into 
                                         -- the Premium IP queue
                                         -- (expedited-forwarding class)
 accept;                                 -- accept the other packets
                  }            
       term rl-IPP-cust1-cust3 {         -- the same but between 
                                         -- customer 1 and customer 2
           from { 
               destination-prefix-list { -- the destination prefix list
                   pref-list-cust3;      -- is the one of customer 3
               }
               dscp 46;
           }
           then {
 count IPP-cust1-cust3;
 policer pol-cust1-cust3;   
 loss-priority low; 
 forwarding-class expedited-forwarding; 
 accept;
}
[...]
       term default {                     -- do not forget this one ;-)
           then {
               accept;
           }
       }
   }

2. On the first router of a Premium IP compliant section (part of a network supporting Premium IP)

• Source destination IP address 
• Destination destination IP address 
• DSCP value

[edit firewall]

filter customer1-in {
       policer pol-cust1-cust2 {            -- policer definition for PIP
              if-exceeding {                -- traffic from customer 1 to
               bandwidth-limit 2m;          -- customer 2
               burst-size-limit 22350;
           }
           then discard;                    -- discard excess traffic
       }
       policer pol-cust1-cust3 {            -- policer definition for PIP
           if-exceeding {                   -- traffic from customer 1 to
               bandwidth-limit 2m;          -- customer 3
               burst-size-limit 22350;
           }
           then discard;
       }
[...]
       term rl-IPP-cust1-cust2 {
           from {               
 source-prefix-list {                       -- rate-limitation based on
     pref-list-cust1;                       -- the source prefix list
 }
               destination-prefix-list {    -- rate-limitation based on
                   pref-list-cust2;         -- the destination prefix list
               }
               dscp 46;                     -- dscp 46 (Premium IP)
           }
           then {
 count IPP-cust1-cust2;                   -- monitor the amount of PIP between 
                                          -- cust1 and cust2
 policer pol-cust1-cust2;                 -- rate-limit the amount of PIP between 
                                          -- cust1 and cust2 and drop the excess
loss-priority low;                        -- set the loss priority (for the RED drop 
                                          -- profile - optional in this configuration)
forwarding-class expedited-forwarding;    -- re-write the classification 
                                          -- done by the classifier 
                                          -- send the packet into 
                                          -- the Premium IP queue
                                          -- (expedited-forwarding class)
accept;                                   -- accept the other packets 
           }
     term rl-IPP-cust1-cust3 {            -- the same but between 
                                          -- customer 1 and customer 3
           from {               
 source-prefix-list {   
     pref-list-cust1;    
 }
               destination-prefix-list {   -- the destination prefix list
                  pref-list-cust3;         -- is the one of customer 3
               }
               dscp 46; 
           }
           then {
 count IPP-cust1-cust3; 
 policer pol-cust1-cust3;    
 loss-priority low;  
 forwarding-class expedited-forwarding;  
 accept;
}
[...]
       term default {                        -- do not forget this one
           then {
               accept;
           }
      }
   }