Figure 1-1
Network diagram for rate limiting and traffic
policing configuration
A company uses a switch (an S5500-EI switch
in this example) for interconnection. The network is described as follows:
l
Host A with IP address 192.168.1.2 and the
server with IP address 192.168.1.1 access the switch through GigabitEthernet
1/0/1.
l
Host B with IP address 192.168.2.1 accesses the
switch through GigabitEthernet 1/0/2.
Configure rate limiting and traffic policing
to satisfy the following requirements:
l
Limit the rate of traffic from the switch to the
Internet to 640 kbps and drop the exceeding traffic.
l
Limit the outgoing traffic rate of Host A to 320
kbps and drop the exceeding traffic.
l
Limit the rate of traffic between Host B and the
server to 64 kbps and drop the exceeding traffic.
|
Product series
|
Software version
|
Hardware version
|
|
S3610 Series Ethernet Switches
|
Release 5301
|
All versions
|
|
S5510 Series Ethernet Switches
|
Release 5301
|
All versions
|
|
S5500-SI
Series Ethernet Switches
|
Release
1207
|
All
versions except S5500-20TP-SI
|
|
Release
1301
|
S5500-20TP-SI
|
|
S5500-EI Series Ethernet Switches
|
Release 2102
|
All versions
|
|
S7500E Series Ethernet Switches
|
Release 6100
|
All versions
|
1)
Configure rate limiting on the switch
# Limit the outgoing traffic rate of
GigabitEthernet 1/0/3 to 640 kbps.
<Switch>
system-view
[Switch] interface
GigabitEthernet 1/0/3
[Switch-GigabitEthernet1/0/3]
qos lr outbound cir 640
[Switch-GigabitEthernet1/0/3]
quit
2)
Configure traffic policing for Host A
# Create basic ACL 2000 to match the
packets with the source IP address 192.168.1.2.
[Switch] acl
number 2000
[Switch-acl-basic-2000]
rule permit source 192.168.1.2 0
[Switch-acl-basic-2000]
quit
# Create a class classifier_hostA
and reference ACL 2000 in it.
[Switch] traffic
classifier classifier_hostA
[Switch-classifier-classifier_hostA]
if-match acl 2000
[Switch-classifier-classifier_hostA]
quit
# Create a traffic behavior behavior_hostA
and configure the action of limiting the traffic rate to 320 kbps for it.
[Switch] traffic
behavior behavior_hostA
[Switch-behavior-behavior_hostA]
car cir 320
[Switch-behavior-behavior_hostA]
quit
# Create a policy policy_hostA and
associate the class classifier_hostA with the traffic behavior behavior_hostA
in the policy.
[Switch] qos
policy policy_hostA
[Switch-qospolicy-policy_hostA]
classifier classifier_hostA behavior behavior_hostA
[Switch-qospolicy-policy_hostA]
quit
# Apply the policy policy_hostA to
the inbound direction of GigabitEthernet 1/0/1.
[Switch] interface
GigabitEthernet 1/0/1
[Switch-GigabitEthernet1/0/1]
qos apply policy policy_hostA inbound
[Switch-GigabitEthernet1/0/1]
quit
3)
Configure traffic policing for the traffic
between Host B and the server
# Create basic ACL 3001 to match the
packets with source IP address 192.168.2.1 and destination IP address
192.168.1.1.
[Switch] acl
number 3001
[Switch-acl-adv-3001]
rule permit ip source 192.168.2.1 0 destination 192.168.1.1 0
[Switch-acl-adv-3001]
quit
# Create basic ACL 3002 to match the
packets with source IP address 192.168.1.1 and destination IP address
192.168.2.1.
[Switch] acl
number 3002
[Switch-acl-adv-3002]
rule permit ip source 192.168.1.1 0 destination 192.168.2.1 0
[Switch-acl-adv-3002]
quit
# Create a class classifier_hostB
and reference ACL 3001 in it.
[Switch] traffic
classifier classifier_hostB
[Switch-classifier-classifier_hostB]
if-match acl 3001
[Switch-classifier-classifier_hostB]
quit
# Create a class classifier_Server
and reference ACL 3002 in it.
[Switch] traffic
classifier classifier_Server
[Switch-classifier-classifier_Server]
if-match acl 3002
[Switch-classifier-classifier_Server]
quit
# Create a traffic behavior behavior_hostB
and configure the action of limiting the traffic rate to 64 kbps for it.
[Switch] traffic
behavior behavior_hostB
[Switch-behavior-behavior_hostB]
car cir 64
[Switch-behavior-behavior_hostB]
quit
# Create a traffic behavior behavior_Server
and configure the action of limiting the traffic rate to 64 kbps for it.
[Switch] traffic
behavior behavior_Server
[Switch-behavior-behavior_Server]
car cir 64
[Switch-behavior-behavior_Server]
quit
# Create a policy policy_hostB and
associate the class classifier_hostB with the traffic behavior behavior_hostB
in the policy.
[Switch] qos
policy policy_hostB
[Switch-qospolicy-policy_hostB]
classifier classifier_hostB behavior behavior_hostB
[Switch-qospolicy-policy_hostB]
quit
# Create a policy policy_Server and
associate the class classifier_Server with the traffic behavior behavior_Server
in the policy.
[Switch] qos
policy policy_Server
[Switch-qospolicy-policy_Server]
classifier classifier_Server behavior behavior_Server
[Switch-qospolicy-policy_Server]
quit
# Apply the policy policy_hostB to
the inbound direction of GigabitEthernet 1/0/2 and the policy policy_Server
to the outbound direction of GigabitEthernet 1/0/2.
[Switch] interface
GigabitEthernet 1/0/2
[Switch-GigabitEthernet1/0/2]
qos apply policy policy_hostB inbound
[Switch-GigabitEthernet1/0/2]
qos apply policy policy_Server outbound
#
traffic
classifier classifier_hostA operator and
if-match
acl 2000
traffic
classifier classifier_hostB operator and
if-match
acl 3001
traffic
classifier classifier_Server operator and
if-match
acl 3002
#
traffic
behavior behavior_Server
car cir
64 cbs 4000 ebs 4000 green pass red discard yellow pass
traffic
behavior behavior_hostA
car cir
320 cbs 4000 ebs 4000 green pass red discard yellow pass
traffic
behavior behavior_hostB
car cir
64 cbs 4000 ebs 4000 green pass red discard yellow pass
#
qos policy
policy_hostA
classifier
classifier_hostA behavior behavior_hostA
qos policy
policy_hostB
classifier
classifier_hostB behavior behavior_hostB
qos policy
policy_Server
classifier
classifier_Server behavior behavior_Server
#
acl number
2000
rule 0
permit source 192.168.1.2 0
#
acl number
3001
rule 0
permit ip source 192.168.2.1 0 destination 192.168.1.1 0
acl number
3002
rule 0
permit ip source 192.168.1.1 0 destination 192.168.2.1 0
#
interface
GigabitEthernet1/0/1
qos apply
policy policy_hostA inbound
#
interface
GigabitEthernet1/0/2
qos apply
policy policy_hostB inbound
qos apply
policy policy_Server outbound
#
interface
GigabitEthernet1/0/3
qos lr
outbound cir 640 cbs 40000
#
Note that:
l
You can apply a policy to multiple ports.
However, you can apply only one policy in one direction (inbound or outbound)
of a port.
l
The S3610 and the S5510 series switches do not
support rate limiting. On them, you can use the qos gts command to
achieve the same effect.
l
On the S3610 and the S5510 series switches, you
can configure the qos car command on a port or port group to satisfy the
traffic policing requirement mentioned above.
l
On an S5500-EI switch, whether a policy can be
successfully applied to the inbound or outbound direction depends on the
actions configured in its traffic behaviors, as shown in Table 1-1.
Table 1-1 Actions that can be applied in
the inbound or outbound direction
|
Action
|
inbound
|
outbound
|
|
Traffic accounting
|
Supported
|
Supported
|
|
CAR
|
Supported
|
Supported
|
|
Traffic filtering
|
Supported
|
Supported
|
|
Traffic mirroring
|
Supported
|
Supported
|
|
Tagging outer VLAN tags
|
Supported
|
Not supported
|
|
Traffic redirecting
|
Supported
|
Not supported
|
|
CVLAN re-marking
|
Not supported
|
Supported
|
|
802.1p precedence re-marking
|
Supported
|
Supported
|
|
Drop precedence re-marking
|
Supported
|
Not supported
|
|
DSCP re-marking
|
Supported
|
Supported
|
|
IP precedence re-marking
|
Supported
|
Supported
|
|
Local precedence re-marking
|
Supported
|
Not supported
|
|
SVLAN re-marking
|
Supported
|
Supported
|
Caution:
For a QoS policy to
be applied successfully on an S5500-EI switch, follow these guidelines when
configuring traffic behaviors:
l
The nest action can coexist with only the
filter action and the remark dot1p action in a traffic behavior.
In addition, if the nest action is configured, before applying the
policy to a port or port group, make sure that you have enabled basic QinQ on
the port/port group.
l
If you want to apply the policy to the inbound
direction, do not configure the remark service-vlan-id action together
with any other actions except filter and remark dot1p in the same
traffic behavior.
l
If you want to apply the policy to the outbound
direction, do not configure the mirror-to action together with any other
actions in the same traffic behavior.
l
On an S7500E switch, you can apply a QoS policy
to a port, to a port group, to a VLAN, or globally. Whether a QoS policy can be
applied successfully in the inbound or outbound direction depends on the
actions configured in the QoS policy and the type of the board where the QoS
policy is to be applied, as shown in Table 1-2. For more information about
board types, refer to the installation manual.
Table 1-2 Actions that can be applied in
the inbound or outbound direction
|
Board type
|
SC board
|
SA board
|
EA board
|
|
Action
|
Inbound
|
Outbound
|
Inbound
|
Outbound
|
Inbound
|
Outbound
|
|
Traffic accounting
|
Supported
|
Supported
|
Supported
|
Not supported
|
Supported
|
Not supported
|
|
CAR
|
Supported
|
Supported
|
Supported
|
Not supported
|
Supported
|
Not supported
|
|
Traffic filtering
|
Supported
|
Supported
|
Supported
|
Not supported
|
Supported
|
Not supported
|
|
Traffic mirroring
|
Supported
|
Supported
|
Supported
|
Not supported
|
Supported
|
Not supported
|
|
Tagging outer VLAN tags
|
Supported
|
Not supported
|
Supported
|
Not supported
|
Supported
|
Not supported
|
|
Traffic redirecting
|
Supported
|
Not supported
|
Supported
|
Not supported
|
Supported
|
Not supported
|
|
CVLAN re-marking
|
Not supported
|
Supported
|
Not supported
|
Not supported
|
Not supported
|
Not supported
|
|
802.1p precedence re-marking
|
Supported
|
Supported
|
Supported
|
Not supported
|
Supported
|
Not supported
|
|
Drop precedence re-marking
|
Supported
|
Not supported
|
Supported
|
Not supported
|
Supported
|
Not supported
|
|
DSCP re-marking
|
Supported
|
Supported
|
Supported
|
Not supported
|
Supported
|
Not supported
|
|
IP precedence re-marking
|
Supported
|
Supported
|
Supported
|
Not supported
|
Supported
|
Not supported
|
|
Local precedence re-marking
|
Supported
|
Not supported
|
Supported
|
Not supported
|
Supported
|
Not supported
|
|
SVLAN re-marking
|
Supported
|
Supported
|
Supported
|
Not supported
|
Supported
|
Not supported
|
Caution:
For a QoS policy to be applied successfully on an S7500E series
switch, follow these guidelines:
l
A policy configured with the nest, remark
customer-vlan-id, or remark service-vlan-id action cannot be applied
to a VLAN or globally.
l
The nest action can coexist with only the
filter action and the remark dot1p action in a traffic behavior.
In addition, if the nest action is configured, before applying the
policy to a port or port group, make sure that you have enabled basic QinQ on
the port/port group.
l
If you want to apply the policy to the inbound
direction, do not configure the remark service-vlan-id action
together with any other actions except filter and remark dot1p in
the same traffic behavior.
l
If you want to apply the policy to the outbound
direction, do not configure the mirror-to action together with any other
actions in the same traffic behavior.
l
To use the QoS policy for implementing
one-to-one VLAN mapping in the outbound direction of a port on an SA or EA
board, you must use only the if-match customer-vlan-id command
for traffic classification, configure only the remark customer-vlan-id
command (or the remark customer-vlan-id and remark dot1p
commands) in the traffic behaviors, enable basic QinQ on the port, and then
apply the QoS policy to the outbound direction of the port.
Figure 1-2 Network diagram for priority re-marking and queue scheduling
configuration
A company uses a switch (an S5500-EI switch
in this example) for interconnection. As shown in Figure 1-2,
l
Host A and Host B are connected to GigabitEthernet
1/0/1 of the switch.
l
Host C is connected to GigabitEthernet 1/0/2 of
the switch.
l
The database server, the mail server, and the
file server are connected to GigabitEthernet 1/0/3 of the switch.
Configure priority re-marking and queue
scheduling to satisfy the following requirements:
l
When Host A and Host B access the servers, the
switch processes the traffic from Host A and Host B to the database server,
mail server, and file server in the descending priority order.
l
When Host C accesses the Internet or servers,
the switch always processes the traffic from Host C preferentially.
|
Product series
|
Software version
|
Hardware version
|
|
S3610 Series Ethernet Switches
|
Release 5301
|
All versions
|
|
S5510 Series Ethernet Switches
|
Release 5301
|
All versions
|
|
S5500-SI Series Ethernet Switches
|
Release 1207
|
All versions except S5500-20TP-SI
|
|
Release 1301
|
S5500-20TP-SI
|
|
S5500-EI Series Ethernet Switches
|
Release 2102
|
All versions
|
|
S7500E Series Ethernet Switches
|
Release 6100
|
All versions
|
1)
Configuration for the traffic from Host A and
Host B
# Create an advanced ACL 3000 to match the
packets with destination IP address 192.168.0.1.
<Switch>
system-view
[Switch] acl
number 3000
[Switch-acl-adv-3000]
rule permit ip destination 192.168.0.1 0
[Switch-acl-adv-3000]
quit
# Create an advanced ACL 3001 to match the
packets with destination IP address 192.168.0.2.
<Switch>
system-view
[Switch] acl
number 3001
[Switch-acl-adv-3001]
rule permit ip destination 192.168.0.2 0
[Switch-acl-adv-3001]
quit
# Create an advanced ACL 3002 to match the
packets with destination IP address 192.168.0.3.
<Switch>
system-view
[Switch] acl
number 3002
[Switch-acl-adv-3002]
rule permit ip destination 192.168.0.3 0
[Switch-acl-adv-3002]
quit
# Create a class classifier_dbserver
and reference ACL 3000 in it.
[Switch] traffic
classifier classifier_dbserver
[Switch-classifier-classifier_dbserver]
if-match acl 3000
[Switch-classifier-classifier_dbserver]
quit
# Create a class classifier_mserver and
reference ACL 3001 in it.
[Switch] traffic
classifier classifier_mserver
[Switch-classifier-classifier_mserver]
if-match acl 3001
[Switch-classifier-classifier_mserver]
quit
# Create a class classifier_fserver and
reference ACL 3002 in it.
[Switch] traffic
classifier classifier_fserver
[Switch-classifier-classifier_fserver]
if-match acl 3002
[Switch-classifier-classifier_fserver]
quit
# Create a traffic behavior behavior_dbserver
and configure the action of setting the local precedence to 4 for it.
[Switch] traffic
behavior behavior_dbserver
[Switch-behavior-behavior_dbserver]
remark local-precedence 4
[Switch-behavior-behavior_dbserver]
quit
# Create a traffic behavior behavior_mserver
and configure the action of setting the local precedence to 3 for it.
[Switch] traffic
behavior behavior_mserver
[Switch-behavior-behavior_mserver]
remark local-precedence 3
[Switch-behavior-behavior_mserver]
quit
# Create a traffic behavior behavior_fserver
and configure the action of setting the local precedence to 2 for it.
[Switch] traffic
behavior behavior_fserver
[Switch-behavior-behavior_fserver]
remark local-precedence 2
[Switch-behavior-behavior_fserver]
quit
# Create a policy policy_server and
associate each class with the corresponding behavior in the policy.
[Switch] qos
policy policy_server
[Switch-qospolicy-policy_server]
classifier classifier_dbserver behavior behavior_dbserver
[Switch-qospolicy-policy_server]
classifier classifier_mserver behavior behavior_mserver
[Switch-qospolicy-policy_server]
classifier classifier_fserver behavior behavior_fserver
[Switch-qospolicy-policy_server]
quit
# Apply the policy policy_server to
the inbound direction of GigabitEthernet 1/0/1.
[Switch] interface
GigabitEthernet 1/0/1
[Switch-GigabitEthernet1/0/1]
qos apply policy policy_server inbound
[Switch-GigabitEthernet1/0/1]
quit
# Enable strict priority (SP) queue
scheduling on GigabitEthernet 1/0/3.
[Switch] interface
GigabitEthernet 1/0/3
[Switch-GigabitEthernet1/0/3]
qos sp
[Switch-GigabitEthernet1/0/3]
quit
2)
Configuration for the traffic from Host C
# Configure to trust the port priority on
GigabitEthernet 1/0/2 and set the port priority of GigabitEthernet 1/0/2 to 5.
Note that a port trusts its port priority by default.
[Switch] interface
GigabitEthernet 1/0/2
[Switch-GigabitEthernet1/0/2]
qos priority 5
#
traffic
classifier classifier_fserver operator and
if-match
acl 3002
traffic
classifier classifier_dbserver operator and
if-match
acl 3000
traffic
classifier classifier_mserver operator and
if-match
acl 3001
#
traffic
behavior behavior_fserver
remark
local-precedence 2
traffic
behavior behavior_dbserver
remark
local-precedence 4
traffic
behavior behavior_mserver
remark
local-precedence 3
#
qos policy
policy_server
classifier
classifier_dbserver behavior behavior_dbserver
classifier
classifier_mserver behavior behavior_mserver
classifier
classifier_fserver behavior behavior_fserver
#
acl number
3000
rule 0
permit ip destination 192.168.0.1 0
acl number
3001
rule 0
permit ip destination 192.168.0.2 0
acl number
3002
rule 0
permit ip destination 192.168.0.3 0
#
interface
GigabitEthernet1/0/1
qos apply
policy policy_server inbound
#
interface
GigabitEthernet1/0/2
qos
priority 5
#
interface
GigabitEthernet1/0/3
