This help contains the following topics:

·     Introduction

¡     Bandwidth management process

¡     Traffic rule

¡     Traffic profile

·     Restrictions and guidelines

·     Configure bandwidth management

¡     Configure a traffic profile

¡     Configure a traffic policy

¡     Configure interface bandwidth

Introduction

Bandwidth management provides fine-grained control over traffic that flows through the device by using information such as source and destination IP addresses and usernames.

Bandwidth management is used in the following scenarios:

·     Enterprise intranet users need far more bandwidth than the amount of bandwidth leased from an ISP. This creates a bandwidth bottleneck at the intranet egress.

·     The P2P traffic on the intranet egress consumes a majority of the bandwidth resources. As a result, bandwidth cannot be guaranteed for key services.

Bandwidth management allows you to deploy traffic policies on the network egress for different traffic types. Bandwidth management improves bandwidth efficiency and guarantees bandwidth for key services when congestion occurs.

Bandwidth management process

Bandwidth management is implemented through traffic policies. You can configure traffic profiles and traffic policies in a traffic policy. A traffic profile specifies the guaranteed bandwidth and maximum bandwidth. A traffic policy specifies match criteria to match packets and the traffic profile to apply to matching packets.

Figure 1 Bandwidth management process

 

The bandwidth management process is as follows:

1.     If a packet matches a traffic policy, the interface processes the packet according to the traffic profile (if any) specified for the traffic policy.

If no traffic profile is specified for the traffic policy, the packet is forwarded without bandwidth management.

2.     The traffic profile processes the packet according to its settings.

3.     The packet is limited by the interface bandwidth of the output interface.

Traffic rule

Multiple traffic policies can be configured. In a traffic policy, you can define the match criteria to match packets and specify the traffic profile to apply to matching packets. The device matches traffic policies in their order of appearance on the device. When a traffic policy is matched, the matching process ends and the device applies the traffic profile for the traffic policy to the traffic. If no traffic policy is matched, the device forwards the traffic.

You can configure the following match criteria in a traffic policy:

·     Source and destination security zones.

·     Source and destination IP addresses.

·     Services.

·     Applications/application groups.

·     Users/user groups.

·     DSCP priorities.

·     Time ranges.

One match criterion can contain multiple match values. For example, you can configure multiple address object groups for a source IP address match criterion. A match criterion is matched if any of its match values is matched.

Traffic policies support policy nesting, which allows a traffic policy to have a parent traffic policy. A maximum of four nesting levels are supported. The following rules apply when the device matches a traffic policy with a parent traffic policy:

·     The parent traffic policy is first matched. After the parent traffic policy is matched, the child traffic policy is matched. If the parent traffic policy is not matched, the child traffic policy is ignored and the matching process fails.

·     If both parent and child traffic policies are matched, the traffic profile for the child traffic policy is executed before the traffic profile for the parent traffic policy is executed. If both parent and child traffic policies are about the same parameter, the smaller value for an upper-limit parameter or the larger value for a lower-limit parameter is applied. If only the parent traffic policy is matched, the traffic profile for the parent traffic policy is applied.

Traffic profile

A traffic profile defines bandwidth resources that can be used by a traffic type. The interface bandwidth can be allocated among multiple traffic profiles. You can configure the following parameters in a traffic profile:

Table 1 Parameters in a traffic profile

Item	Description
Rate limit mode	You can limit the traffic rate in one of the following ways: ·     Limit the upstream bandwidth and downstream bandwidth separately. ·     Limit the upstream bandwidth and downstream bandwidth as a whole.
Reference mode	A traffic profile can be referenced by multiple traffic policies in one of the following ways: ·     Exclusive—Each rule that uses the profile can reach the bandwidth limits and connection limits specified in the profile. ·     Shared—All rules that use the profile share the bandwidth limits and connection limits specified in the profile.
Total guaranteed bandwidth	Guarantees the total minimum bandwidth for key services when congestion occurs.
Total maximum bandwidth	Controls the total maximum bandwidth for non-key services to prevent them from consuming a large amount of bandwidth.
Bandwidth allocation among IP addresses	Allocates the total maximum bandwidth dynamically and evenly among online IP addresses.
Per-IP or per-user guaranteed bandwidth	Guarantees the minimum bandwidth per IP address or per user to provide for bandwidth management at finer granularity.
Per-IP or per-user maximum bandwidth	Controls the maximum bandwidth allowed per IP address or per user to provide for bandwidth management at finer granularity.
Connection limits	Limits the total connection count, total connection rate, per-user/per-IP connection count, and per-user/per-IP connection rate.
Forwarding priority	When an interface is congested with packets of multiple traffic profiles, packets with higher priority are sent first. Packets with the same priority have the same chance of being forwarded.
DSCP marking	Modifies the DSCP value in packets. Network devices can classify traffic by using DSCP values and provide different treatment for packets according to the modified DSCP values.

 

Restrictions and guidelines

·     The maximum bandwidth for a child traffic policy must be smaller than or equal to that for its parent traffic policy.

·     The guaranteed bandwidth for a child traffic policy must be smaller than or equal to that for its parent traffic policy.

·     The traffic profiles cannot be the same for the child and parent traffic policies.

·     An interface with small default expected bandwidth might experience traffic loss if the following conditions exist:

¡     There is a large amount of traffic on the interface.

¡     The interface uses the default expected bandwidth.

To avoid traffic loss, implicitly set the expected bandwidth to a large value for such an interface. For example, you can set the expected bandwidth of a tunnel interface to a value greater than 64 kbps (the default) if there is a large amount of traffic on the interface.

·     If a traffic policy to be copied has child traffic policies, only the parent traffic policy is copied.

·     The traffic policy created by copying a traffic policy is placed next to the copied traffic policy.

·     You can specify a parent traffic policy only when creating a traffic policy. You cannot add or modify a parent traffic policy for an existing traffic policy.

·     The rate limit modes of the child and parent traffic policies must be the same.

·     A parent traffic policy does not support dynamic and even allocation for maximum bandwidth.

·     The all-OSI-layer protocol flow control function takes effect only on IPv6 packets.

·     After the all-OSI-layer protocol flow control function is disabled, bandwidth management is performed on traffic of Layer 4 protocols and upper layer protocols.

Configure bandwidth management

Figure 2 shows the configuration procedure for bandwidth management.

Figure 2 Bandwidth management configuration procedure

 

Before configuring bandwidth management, configure security policies to allow traffic to flow through the device. For information about configuring security policies, see "Security Policy Help."

Configure a traffic profile

1.     Select Policies > Bandwidth Management > Traffic Profiles.

2.     Click Create on the Traffic Profile page.

3.     Create a traffic profile.

Table 2 Traffic profile configuration items

Item	Description
Name	Enter a name for the traffic profile.
Rate limit mode	Select Limit uplink and downlink separately or Limit uplink and downlink.
Reference mode	Select Exclusive or Shared.
Total uplink maximum bandwidth	Set the total uplink maximum bandwidth.
Total uplink guaranteed bandwidth	Set the total uplink guaranteed bandwidth.
Total downlink maximum bandwidth	Set the total downlink maximum bandwidth.
Total downlink guaranteed bandwidth	Set the total downlink guaranteed bandwidth.
Forwarding priority	Set the forwarding priority. A greater priority value means a higher priority.
Bandwidth allocation among IP addresses	Select this option to allocate the total maximum bandwidth dynamically and evenly among online IP addresses.
Per-IP uplink maximum bandwidth	Set the per-IP uplink maximum bandwidth.
Per-IP downlink maximum bandwidth	Set the per-IP downlink maximum bandwidth.
Per-user uplink maximum bandwidth	Set the per-user uplink maximum bandwidth.
Per-user downlink maximum bandwidth	Set the per-user downlink maximum bandwidth.
Total connection count	Set the total connection count.
Per-IP/Per-user connection count	Set the per-IP/per-user connection count.
Total connection rate	Set the total connection rate.
Per-IP/Per-user connection rate	Set the per-IP/per-user connection rate.
Mark DSCP priority	Set the DSCP priority to be marked for packets.

 

4.     Click OK. The new traffic profile appears on the Traffic Profile page.

Configure a traffic policy

1.     Select Policies > Bandwidth Management > Traffic Policies.

2.     Click Create on the Traffic Policy page.

3.     Create a traffic policy.

Table 3 Traffic policy configuration items

Item	Description
Name	Enter a name for the traffic policy.
Parent policy	Specify a parent policy.
Source security zone	Specify a source security zone as a match criterion.
Destination security zone	Specify a destination security zone as a match criterion.
Source IP address	Specify a source IP address object group as a match criterion.
Destination IP address	Specify a destination IP address object group as a match criterion.
User	Specify an identity user or user group as a match criterion.
Application	Specify an application or application group as a match criterion.
Service	Specify a service object group as a match criterion.
Time range	Specify a time range during which the policy is in effect.
DSCP priority	Specify a DSCP priority as a match criterion.
IPv6 flow label	Specify an IPv6 flow label as a match criterion.
IPv6 extension header	Specify an IPv6 extension header as a match criterion.
Action	Specify an action for the policy: ·     Rate limit—Limits the rate of matching packets by referencing a traffic profile. ·     Not rate limit—Does not limit the rate of matching packets. ·     Block—Blocks matching packets.
Traffic profile	Specify a traffic profile.

 

4.     Click OK. The new traffic policy appears on the Traffic Policy page.

5.     To perform bandwidth management on traffic of Layer 3 protocols and upper layer protocols, enable All-OSI-layer protocol flow control at the upper right corner of the page. By default, bandwidth management is performed on traffic of Layer 4 protocols and upper layer protocols.

Configure interface bandwidth

1.     Select Policies > Bandwidth Management > Interface Bandwidth.

2.     Click Create on the Interface Bandwidth List page.

3.     Create an interface bandwidth entry.

Table 4 Interface bandwidth configuration items

Item	Description
Interface name	Select an interface.
Expected bandwidth	Specify the expected bandwidth value.

 

4.     Click OK. The new interface bandwidth entry appears on the Interface Bandwidth List page.