- 产品与解决方案
- 行业解决方案
- 服务
- 支持
- 合作伙伴
- 关于我们
26-H3C VSR1000虚拟路由器流量监管典型配置举例
本章节下载： 26-H3C VSR1000虚拟路由器流量监管典型配置举例 (138.13 KB)
H3C VSR1000虚拟路由器流量监管配置举例
|
Copyright © 2014 杭州华三通信技术有限公司 版权所有，保留一切权利。 非经本公司书面许可，任何单位和个人不得擅自摘抄、复制本文档内容的部分或全部， 并不得以任何形式传播。本文档中的信息可能变动，恕不另行通知。 |
|
本文档介绍了流量监管的配置举例。
流量监管就是对流量进行控制，通过监督进入网络的流量速率，对超出部分的流量进行“惩罚”，使进入的流量被限制在一个合理的范围之内，以保护网络资源和运营商的利益。
本文档不严格与具体软件版本对应，如果使用过程中与产品实际情况有差异，请参考相关产品手册，或以设备实际情况为准。
本文档中的配置均是在实验室环境下进行的配置和验证，配置前设备的所有参数均采用出厂时的缺省配置。如果您已经对设备进行了配置，为了保证配置效果，请确认现有配置和以下举例中的配置不冲突。
本文假设您已了解流量监管特性。
如图1所示，某公司网络通过专线接入Internet，上行带宽为60Mbps，所有终端设备均以Device作为网关设备。现要求使用流量监管功能，对上行至Internet的流量进行分类限速：
· HTTP流量：总上行限速为40Mbps，其中研发部25台主机分配15Mbps上行带宽；市场部40台主机分配25Mbps上行带宽。
· 邮件服务器代理所有客户端向外网发送电子邮件，限制上行带宽为2Mbps。
· 远端分支机构可以通过Internet访问FTP服务器，限制上行的FTP的数据流量不超过10Mbps。
要实现对不同特征数据流的流量监管，主要是明确匹配各业务数据的类规则。在本例中，需要使用ACL来匹配各种协议或来源的IP报文，并将这些分类规则与不同的流量监管动作进行绑定，即可实现对不同特征的数据进行不同的速率限制。
本举例是在E0301版本上进行配置和验证的。
(1) 配置接口的IP地址
# 配置接口GigabitEthernet4/0的IP地址
[Device] interface gigabitethernet 4/0
[Device-GigabitEthernet4/0] ip address 200.1.1.2 24
[Device-GigabitEthernet4/0] quit
# 请参考上面的方法，分别配置其它接口的IP地址，具体步骤省略。
(2) 配置对研发部HTTP上行流量的限制
# 创建高级IPv4 ACL 3000，匹配研发部发送的HTTP流量（目的TCP端口80）。
[Device] acl number 3000
[Device-acl-adv-3000] rule permit tcp destination-port eq 80 source 192.168.1.0 0.0.0.255
[Device-acl-adv-3000] quit
# 创建类rd_http，匹配规则为IPv4 ACL 3000。
[Device] traffic classifier rd_http
[Device-classifier-rd_http] if-match acl 3000
[Device-classifier-rd_http] quit
# 创建流行为rd_http，动作为流量监管，承诺速率15Mbps。
[Device] traffic behavior rd_http
[Device-behavior-rd_http] car cir 15360
[Device-behavior-rd_http] quit
# 创建QoS策略rd_http。
[Device] qos policy rd_http
[Device-qospolicy-rd_http] classifier rd_http behavior rd_http
[Device-qospolicy-rd_http] quit
# 将策略应用到GigabitEthernet2/0端口的入方向。
[Device] interface gigabitethernet 2/0
[Device-GigabitEthernet2/0] qos apply policy rd_http inbound
[Device-GigabitEthernet2/0] quit
(3) 配置对市场部HTTP上行流量的限制
#创建高级IPv4 ACL3001，匹配市场部发送的HTTP流量。
[Device] acl number 3001
[Device-acl-adv-3001] rule permit tcp destination-port eq 80 source 192.168.2.0 0.0.0.255
[Device-acl-adv-3001] quit
# 创建类mkt_http，匹配规则为IPv4 ACL 3001。
[Device] traffic classifier mkt_http
[Device-classifier-mkt_http] if-match acl 3001
[Device-classifier-mkt_http] quit
# 创建流行为mkt_http，动作为流量监管，承诺速率为25Mbps。
[Device] traffic behavior mkt_http
[Device-behavior-mkt_http] car cir 25600
[Device-behavior-mkt_http] quit
# 创建QoS策略mkt_http。
[Device] qos policy mkt_http
[Device-qospolicy-mkt_http] classifier mkt_http behavior mkt_http
[Device-qospolicy-mkt_http] quit
# 将策略应用到GigabitEthernet3/0端口的入方向。
[Device] interface gigabitethernet 3/0
[Device-GigabitEthernet3/0] qos apply policy mkt_http inbound
[Device-GigabitEthernet3/0] quit
(4) 配置对邮件服务器发送电子邮件流量的限制
# 创建高级IPv4 ACL 3002，匹配邮件服务器向外发送邮件的数据。
[Device] acl number 3002
[Device-acl-adv-3002] rule permit tcp destination-port eq smtp source 192.168.10.1 0.0.0.0
[Device-acl-adv-3002] quit
# 创建类email，匹配规则为IPv4 ACL 3002。
[Device] traffic classifier email
[Device-classifier-email] if-match acl 3002
[Device-classifier-email] quit
# 创建流行为email，动作为流量监管，承诺速率为2Mbps。
[Device] traffic behavior email
[Device-behavior-email] car cir 2048
[Device-behavior-email] quit
# 创建QoS策略email&ftp。
[Device] qos policy email&ftp
[Device-qospolicy-email&ftp] classifier email behavior email
[Device-qospolicy-email&ftp] quit
(5) 配置对分支机构的FTP流量的限制
# 创建基本IPv4 ACL 2001，匹配FTP服务器发送的报文。
[Device] acl number 2001
[Device-acl-basic-2001] rule permit source 192.168.10.2 0.0.0.0
[Device-acl-basic-2001] quit
# 创建类ftp，匹配规则为IPv4 ACL 2001。
[Device] traffic classifier ftp
[Device-classifier-ftp] if-match acl 2001
[Device-classifier-ftp] quit
# 创建流行为ftp，动作为流量监管，承诺速率为10Mbps。
[Device] traffic behavior ftp
[Device-behavior-ftp] car cir 10240
[Device-behavior-ftp] quit
# 在QoS策略email&ftp中为类ftp指定流行为ftp。
[Device] qos policy email&ftp
[Device-qospolicy-email&ftp] classifier ftp behavior ftp
[Device-qospolicy-email&ftp] quit
# 将策略应用到GigabitEthernet4/0端口的出方向。
[Device] interface gigabitethernet 4/0
[Device-GigabitEthernet4/0] qos apply policy email&ftp outbound
[Device-GigabitEthernet4/0] quit
# 执行display qos policy interface命令查看端口上QoS策略的应用状态。
[Device] display qos policy interface
Interface: GigabitEthernet2/0
Direction: Inbound
Policy: rd_http
Classifier: default-class
Matched : 313 (Packets) 29916 (Bytes)
5-minute statistics:
Forwarded: 0/719 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match any
Behavior: be
-none-
Classifier: rd_http
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match acl 3000
Behavior: rd_http
Committed Access Rate:
CIR 15360 (kbps), CBS 960000 (Bytes), EBS 0 (Bytes)
Green action : pass
Yellow action : pass
Red action : discard
Green packets : 0 (Packets) 0 (Bytes)
Yellow packets: 0 (Packets) 0 (Bytes)
Red packets : 0 (Packets) 0 (Bytes)
Interface: GigabitEthernet3/0
Direction: Inbound
Policy: mkt_http
Classifier: default-class
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match any
Behavior: be
-none-
Classifier: mkt_http
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match acl 3001
Behavior: mkt_http
Committed Access Rate:
CIR 25600 (kbps), CBS 1600000 (Bytes), EBS 0 (Bytes)
Green action : pass
Yellow action : pass
Red action : discard
Green packets : 0 (Packets) 0 (Bytes)
Yellow packets: 0 (Packets) 0 (Bytes)
Red packets : 0 (Packets) 0 (Bytes)
Interface: GigabitEthernet4/0
Direction: Outbound
Policy: email&ftp
Classifier: default-class
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match any
Behavior: be
-none-
Classifier: email
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match acl 3002
Behavior: email
Committed Access Rate:
CIR 2048 (kbps), CBS 128000 (Bytes), EBS 0 (Bytes)
Green action : pass
Yellow action : pass
Red action : discard
Green packets : 0 (Packets) 0 (Bytes)
Yellow packets: 0 (Packets) 0 (Bytes)
Red packets : 0 (Packets) 0 (Bytes)
Classifier: ftp
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match acl 2001
Behavior: ftp
Committed Access Rate:
CIR 10240 (kbps), CBS 640000 (Bytes), EBS 0 (Bytes)
Green action : pass
Yellow action : pass
Red action : discard
Green packets : 0 (Packets) 0 (Bytes)
Yellow packets: 0 (Packets) 0 (Bytes)
Red packets : 0 (Packets) 0 (Bytes)
#
traffic classifier email operator and
if-match acl 3002
#
traffic classifier ftp operator and
if-match acl 2001
#
traffic classifier mkt_http operator and
if-match acl 3001
#
traffic classifier rd_http operator and
if-match acl 3000
#
traffic behavior email
car cir 2048 cbs 128000 ebs 0 green pass red discard yellow pass
#
traffic behavior ftp
car cir 10240 cbs 640000 ebs 0 green pass red discard yellow pass
#
traffic behavior mkt_http
car cir 25600 cbs 1600000 ebs 0 green pass red discard yellow pass
#
traffic behavior rd_http
car cir 15360 cbs 960000 ebs 0 green pass red discard yellow pass
#
qos policy email&ftp
classifier email behavior email
classifier ftp behavior ftp
#
qos policy mkt_http
classifier mkt_http behavior mkt_http
#
qos policy rd_http
classifier rd_http behavior rd_http
#
interface GigabitEthernet1/0
port link-mode route
ip address 192.168.10.254 255.255.255.0
#
interface GigabitEthernet2/0
port link-mode route
ip address 192.168.1.1 255.255.255.0
qos apply policy rd_http inbound
#
interface GigabitEthernet3/0
port link-mode route
ip address 192.168.2.1 255.255.255.0
qos apply policy mkt_http inbound
#
interface GigabitEthernet4/0
port link-mode route
ip address 200.1.1.2 255.255.255.0
qos apply policy email&ftp outbound
#
acl number 2001
rule 0 permit source 192.168.10.2 0
#
acl number 3000
rule 0 permit tcp source 192.168.1.0 0.0.0.255 destination-port eq www
#
acl number 3001
rule 0 permit tcp source 192.168.2.0 0.0.0.255 destination-port eq www
#
acl number 3002
rule 0 permit tcp source 192.168.10.1 0 destination-port eq smtp
· 《H3C VSR1000虚拟路由器配置指导》中的“ACL和QoS配置指导”
· 《H3C VSR1000虚拟路由器命令参考》中的“ACL和QoS命令参考”
不同款型规格的资料略有差异, 详细信息请向具体销售和400咨询。H3C保留在没有任何通知或提示的情况下对资料内容进行修改的权利!
支持
