Bandwidth management configuration examples

 

The following information provides bandwidth management configuration examples.

Bandwidth management provides fine-grained control over traffic that flows through the device by using the following information:

·     Source and destination security zones.

·     Source and destination IP addresses.

·     Users and user groups.

·     Applications and application groups.

·     DSCP priorities.

·     Time ranges.

·     Prerequisites

This document is not restricted to specific software or hardware versions. Procedures and information in the examples might be slightly different depending on the software or hardware version of the device.

The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of bandwidth management.

 

When you configure bandwidth management, follow these restrictions and guidelines:

·     Traffic policies support nesting, and can be nested for up to four levels.

·     The maximum bandwidth for a child traffic policy must be smaller than or equal to that for its parent traffic policy.

·     The guaranteed bandwidth for a child traffic policy must be smaller than or equal to that for its parent traffic policy.

·     The traffic profiles cannot be the same for the child and parent traffic policies.

·     An interface with small default expected bandwidth might experience traffic loss if the following conditions exist:

○          There is a large amount of traffic on the interface.

○          The interface uses the default expected bandwidth.

To avoid traffic loss, implicitly set the expected bandwidth to a large value for such an interface. For example, you can set the expected bandwidth of a tunnel interface to a value greater than 64 kbps (the default) if there is a large amount of traffic on the interface.

·     If a traffic policy to be copied has child traffic policies, only the parent traffic policy is copied.

Network configuration

As shown in Figure 1, configure bandwidth management on the device to meet the following requirements:

·     The maximum bandwidth is limited to 30 Mbps for both upstream and downstream iQiYiPPS application traffic of the host in the intranet.

·     The guaranteed bandwidth is 30 Mbps for both upstream and downstream FTP traffic of the host .

·     The bandwidth of the interface to the Internet is limited to 100 Mbps.

Figure 1 Network diagram

 

Software versions used

This configuration example was created and verified on F9345 of the F1060 device.

Procedure

1.     Assign IP addresses to interfaces and add the interfaces to security zones.

# On the top navigation bar, click Network.

# From the navigation pane, select Interface Configuration > Interfaces.

# Click the Edit icon for GE 1/0/1.

# In the dialog box that opens, configure the interface:

¡     Select the Trust security zone.

¡     On the IPv4 Address tab, enter the IP address and mask of the interface. In this example, enter 10.1.1.1/24.

¡     Use the default settings for other parameters.

¡     Click OK.

# Add GE 1/0/2 to the Untrust security zone and set its IP address to 20.1.1.1./24 in the same way you configure GE 1/0/1.

2.     Configure security policies.

# On the top navigation bar, click Policies.

# From the navigation pane, select Security Policies > Security Policies.

# Click Create.

# In the dialog box that opens, configure a security policy:

¡     Enter policy name Trust-Untrust.

¡     Select source zone Trust.

¡     Select destination zone Untrust.

¡     Enter source IPv4 address 10.1.1.2/24.

¡     Select action Permit.

¡     Use the default settings for other parameters.

¡     Click OK.

3.     Configure traffic profiles.

# On the top navigation bar, click Policies.

# From the navigation pane, select Bandwidth Management > Traffic Profiles.

# Click Create.

# In the dialog box that opens, create a traffic profile named aiqiyi as shown in Figure 2.

Figure 2 Creating a traffic profile named aiqiyi

 

# Click OK.

# Create a traffic profile named profileftp in the same way you create traffic profile aiqiyi, as shown in Figure 3.

Figure 3 Creating a traffic profile named profileftp

 

# Click OK.

4.     Configure traffic policies.

# On the top navigation bar, click Policies.

# From the navigation pane, select Bandwidth Management > Traffic Policies.

# Click Create.

# In the dialog box that opens, create a traffic policy named aiqiyi, as shown in Figure 4.

Figure 4 Creating a traffic policy named aiqiyi

 

Figure 5 Creating a traffic policy named aiqiyi (continued)

 

# Click OK.

# After creating the traffic policy, select the policy and click Enable to enable the policy.

# Create a traffic policy FTP in the same way you create traffic policy aiqiyi, as shown in Figure 6.

Figure 6 Creating a traffic policy named FTP

 

 

# Click OK.

# After creating the traffic policy, select the policy and click Enable to enable the policy.

5.     Configure interface bandwidth.

# On the top navigation bar, click Policies.

# From the navigation pane, select Bandwidth Management > Interface Bandwidth.

# Click Create.

# In the dialog box that opens, configure interface bandwidth as shown in Figure 7.

Figure 7 Configuring interface bandwidth

 

# Click OK.

Verifying the configuration

# Verify that the iQiYiPPS application traffic rate cannot exceed 30 Mbps and the FTP traffic rate can reach a minimum of 30 Mbps when the total traffic rate on GigabitEthernet 1/0/2 reaches 100 Mbps.

Network configuration

As shown in Figure 8, configure bandwidth management on the device to meet the following requirements:

·     The maximum bandwidth is limited to 30 Mbps for both upstream and downstream iQiYiPPS application traffic of the host in the intranet.

·     The guaranteed bandwidth is 30 Mbps for both upstream and downstream FTP traffic of the host .

·     The total traffic rate of the host is limited to 50 Mbps.

Figure 8 Network diagram

 

Software versions used

This configuration example was created and verified on F9345 of the F1060 device.

Procedure

1.     Assign IP addresses to interfaces and add the interfaces to security zones.

# On the top navigation bar, click Network.

# From the navigation pane, select Interface Configuration > Interfaces.

# Click the Edit icon for GE 1/0/1.

# In the dialog box that opens, configure the interface:

a.     Select the Trust security zone.

b.     On the IPv4 Address tab, enter the IP address and mask of the interface. In this example, enter 10.1.1.1/24.

c.     Click OK.

# Add GE 1/0/2 to the Untrust security zone and set its IP address to 20.1.1.1./24 in the same way you configure GE 1/0/1.

2.     Configure security policies.

# On the top navigation bar, click Policies.

# From the navigation pane, select Security Policies > Security Policies.

# Click Create.

# In the dialog box that opens, configure a security policy:

¡     Enter policy name Trust-Untrust.

¡     Select source zone Trust.

¡     Select destination zone Untrust.

¡     Select action Permit.

¡     Enter source IPv4 address 10.1.1.2/24.

# Click OK.

3.     Configure traffic profiles.

# On the top navigation bar, click Policies.

# From the navigation pane, select Bandwidth Management > Traffic Profiles.

# Click Create.

# In the dialog box that opens, configure a traffic profile as shown in Figure 9.

Figure 9 Creating a traffic profile named profile

 

# Click OK.

# Create a traffic profile named aiqiyi in the same way you create the traffic profile named profile, as shown in Figure 10.

Figure 10 Creating a traffic profile named aiqiyi

 

# Click OK.

# Create a traffic profile named profileftp in the same way you create the traffic profile named profile, as shown in Figure 11.

Figure 11 Creating a traffic profile named profileftp

 

# Click OK.

4.     Configure the parent traffic policy.

# On the top navigation bar, click Policies.

# From the navigation pane, select Bandwidth Management > Traffic Policies.

# Click Create.

# In the dialog box that opens, create a traffic policy named policy as shown in Figure 12.

Figure 12 Creating a traffic policy named policy

 

Figure 13 Creating a traffic policy named policy (continued)

 

# Click OK.

# After creating the traffic policy, select the policy and click Enable to enable the policy.

5.     Configure child traffic policies.

# On the top navigation bar, click Policies.

# From the navigation pane, select Bandwidth Management > Traffic Policies.

# Click Create.

# In the dialog box that opens, create a traffic policy named aiqiyi as shown in Figure 14.

Figure 14 Creating a traffic policy named aiqiyi

 

Figure 15 Creating a traffic policy named aiqiyi (continued)

 

# Click OK.

# After creating the traffic policy, select the policy and click Enable to enable the policy.

# Create a traffic policy named FTP in the same way you create the traffic policy named policy, as shown in Figure 16.

Figure 16 Creating a traffic policy named FTP

 

Figure 17 Creating a traffic policy named FTP (continued)

 

# Click OK.

# After creating the traffic policy, select the policy and click Enable to enable the policy.

Verifying the configuration

# Verify that the total traffic rate of the host is limited to 50 Mbps, and that the iQiYiPPS application traffic rate is limited to 30 Mbps. When congestion occurs, bandwidth of 30 Mbps is guaranteed for FTP traffic.

Network configuration

As shown in Figure 18, an intranet has two user groups: a teacher group with two teachers and a student group with five students.

Configure per-user bandwidth management on the device to meet the following requirements:

·     The bandwidth is limited to 10 Mbps for each teacher in both the upstream and downstream directions, and the bandwidth is limited to 2 Mbps for each student in both the upstream and downstream directions.

·     The total connection count limit is limited to 100000 for teachers. The total connection count limit is limited to 40000 for students and the connection count limit is limited to 10000 for each student.

·     Teachers have higher priority over students to access the Internet.

Figure 18 Network diagram

 

Software versions used

This configuration example was created and verified on F9345 of the F1060 device.

Procedure

1.     Assign IP addresses to interfaces and add the interfaces to security zones.

# On the top navigation bar, click Network.

# From the navigation pane, select Interface Configuration > Interfaces.

# Click the Edit icon for GE 1/0/1.

# In the dialog box that opens, configure the interface:

a.     Select the Trust security zone.

b.     On the IPv4 Address tab, enter the IP address and mask of the interface. In this example, enter 10.1.1.1/24.

c.     Click OK.

# Add GE 1/0/2 to the Untrust security zone and set its IP address to 20.1.1.1./24 in the same way you configure GE 1/0/1.

2.     Configure security policies.

# On the top navigation bar, click Policies.

# From the navigation pane, select Security Policies > Security Policies.

# Click Create.

# In the dialog box that opens, configure a security policy:

¡     Enter policy name Trust-Untrust.

¡     Select source zone Trust.

¡     Select destination zone Untrust.

¡     Enter source IPv4 address 10.1.1.0/24.

¡     Select action Permit.

# Click OK.

3.     Create identity users.

# On the top navigation bar, click Objects.

# From the navigation pane, select User > User Management > Local Users.

# On the User tab, click Create.

# In the dialog box that opens, configure the username as student1.

# Click OK.

# Create users student2, student3, student4, student5, teacher1, and teacher2 in the same way the user student1 is created.

# On the top navigation bar, click Objects.

# From the navigation pane, select User > User Management > Local Users.

# On the User Group tab, click Create.

# In the dialog box that opens, configure the group name as student and configure identity users student1, student2, student3, student4, and student5 for the group.

# Click OK.

# Create a group named teacher and configure identity users teacher1 and teacher2 for the group in the same way the group student is configured.

# On the top navigation bar, click Objects.

# From the navigation pane, select User > User Management > Online Users.

# On the Static Identity Users tab, click Create.

# In the dialog box that opens, configure the username as student1, configure the IP address type as IPv4, and configure the IP address as 10.1.1.11.

# Click OK.

# Create static identity users student2, student3, student4, student5, teacher1, and teacher2 in the same way the static identity user student1 is configured.

# On the top navigation bar, click Objects.

# From the navigation pane, select User > User Management > Online Users.

# On the Online Users tab, click Enable user identification.

4.     Configure traffic profiles.

# On the top navigation bar, click Policies.

# From the navigation pane, select Bandwidth Management > Traffic Profiles.

# Click Create.

# In the dialog box that opens, create a traffic profile named profile-teacher as shown in Figure 19 and Figure 20.

Figure 19 Creating a traffic profile named profile-teacher (I)

 

Figure 20 Creating a traffic profile named profile-teacher (II)

 

# Click OK.

# Create a traffic profile named profile-student as shown in Figure 21 and Figure 22.

Figure 21 Creating a traffic profile named profile-student (I)

 

Figure 22 Creating a traffic profile named profile-student (II)

 

# Click OK.

5.     Configure traffic policies.

# On the top navigation bar, click Policies.

# From the navigation pane, select Bandwidth Management > Traffic Policies.

# Click Create.

# In the dialog box that opens, create a traffic policy named policy-teacher as shown in Figure 23.

Figure 23 Creating a traffic policy named policy-teacher

 

Figure 24 Creating a traffic policy named policy-teacher (continued)

 

# Click OK.

# After creating the traffic policy, select the policy and click Enable to enable the policy.

# Create a traffic policy named policy-student in the same way you create the traffic policy named policy-teacher, as shown in Figure 25.

Figure 25 Creating a traffic policy named policy-student

 

Figure 26 Creating a traffic policy named policy-student (continued)

 

# Click OK.

# After creating the traffic policy, select the policy and click Enable to enable the policy.

Verifying the configuration

# Verify that the bandwidth is limited to 10 Mbps for each teacher, and that the bandwidth is limited to 2 Mbps for each student.

# Verify that the connection counts are limited for both students and teachers.