EVPN-VXLAN: Firewall filtering and policing

You can configure firewall filters and policers on VXLAN traffic in an EVPN topology. Firewall filters provide rules that define whether to accept or discard packets that are transiting an interface. Policing, or rate limiting, lets you control the amount of traffic that enters the switch and determines the actions to take when the traffic exceeds the defined limit. You configure firewall filters at the [edit firewall] hierarchy level. For each firewall filter that you apply to a VXLAN, you can specify family ethernet-switching to filter Layer 2 (Ethernet) packets or family inet to filter on IRB interfaces. The IRB interface acts as a Layer 3 routing interface to connect the XVLANs in collapsed or non-collapsed IP fabric topologies. You can only apply firewall filters and policers on CE-facing interfaces in the ingress direction (traffic entering the XVLAN). For IRB interfaces, you can only apply filtering at the ingress point of a non-encapsulated frame routed through the IRB interface.