Junos Storm Control Configuration for BUM Traffic

A traffic storm happens when broadcast, multicast or unknown unicast frames feed on each other until the LAN is saturated and switches become unresponsive. Junos storm control stops this by monitoring ingress traffic levels per port and dropping the controlled traffic types when a configured level is exceeded — and it can optionally shut the port down entirely. This article explains the storm control model on EX/QFX switches and how to configure profiles, levels and actions from the CLI.

Storm Control Basics

Storm control rate-limits three BUM traffic classes: broadcast, multicast, and unknown unicast. When the combined (or per-type) traffic exceeds the configured storm control level, the switch drops the excess packets. The factory default on ELS platforms enables storm control on all interfaces at 80 percent of available bandwidth; on MX routers it is disabled by default. A very common mistake is configuring a level higher than the interface bandwidth, which silently disables protection — Junos allows it, so double-check your numbers.

Configuration: Storm Control Profile

The modern way is a named profile with an explicit bandwidth level, applied to one interface or to all interfaces:

set ethernet-switching-options storm-control profile SC-LAN level bandwidth 100m
set interfaces xe-0/0/0 unit 0 family ethernet-switching storm-control profile SC-LAN

To apply the profile to every interface instead:

set ethernet-switching-options storm-control profile SC-ALL level bandwidth 200m
set interfaces interface-range ALL-ACCESS unit 0 family ethernet-switching storm-control profile SC-ALL

Levels can be configured as a bandwidth value (kbps/mbps) or as a percentage with the older level percent syntax, which Juniper recommends phasing out. You can also enable storm control selectively per traffic type, e.g. broadcast and unknown unicast only, leaving registered multicast alone.

Port Shutdown and Autorecovery Actions

Instead of only dropping excess packets you can shut down or temporarily disable the interface when the limit is exceeded:

set ethernet-switching-options storm-control profile SC-HARD action-shutdown
set interfaces xe-0/0/1 unit 0 family ethernet-switching storm-control profile SC-HARD
set ethernet-switching-options port-error-disable recovery timeout 300

action-shutdown puts the port into an error-disabled state; the recovery timeout brings it back automatically after 300 seconds, which avoids a truck roll for a noisy access port. Without recovery configuration the port stays down until manually cleared — safer for core links, painful for access ports.

Verification and Platform Notes

show ethernet-switching storm-control
show interfaces xe-0/0/0 extensive | match storm
show interfaces xe-0/0/0 statistics

Per-platform behavior matters: on most EX/QFX switches the level applies to the aggregate of the enabled streams per port, while on QFX10000 each stream is measured independently. Storm control on an aggregated Ethernet (AE) interface applies per member interface, not to the bundle as a whole — a 20 kbps limit on a two-member AE triggers only if one member exceeds 20 kbps. Also disable storm control on FCoE VLAN ports, and remember it does not police flows destined to the Routing Engine. For the loop-caused storm symptoms, pair this with broadcast storm troubleshooting and MAC flap loop detection.

原文链接：https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/concept/rate-limiting-storm-control-understanding.html