- 產品與解決方案
- 行業解決方案
- 服務
- 支持
- 合作夥伴
- BOB登陆 人才研學中心
- 關於我們
26-H3C VSR1000虛擬路由器流量監管典型配置舉例
本章節下載： 26-H3C VSR1000虛擬路由器流量監管典型配置舉例 (138.13 KB)
H3C VSR1000虛擬路由器流量監管配置舉例
|
Copyright © 2014 杭州華三通信技術有限公司 版權所有，保留一切權利。 非經本公司書麵許可，任何單位和個人不得擅自摘抄、複製本文檔內容的部分或全部， 並不得以任何形式傳播。本文檔中的信息可能變動，恕不另行通知。 |
|
本文檔介紹了流量監管的配置舉例。
流量監管就是對流量進行控製，通過監督進入網絡的流量速率，對超出部分的流量進行“懲罰”，使進入的流量被限製在一個合理的範圍之內，以保護網絡資源和運營商的利益。
本文檔不嚴格與具體軟件版本對應，如果使用過程中與產品實際情況有差異，請參考相關產品手冊，或以設備實際情況為準。
本文檔中的配置均是在實驗室環境下進行的配置和驗證，配置前設備的所有參數均采用出廠時的缺省配置。如果您已經對設備進行了配置，為了保證配置效果，請確認現有配置和以下舉例中的配置不衝突。
本文假設您已了解流量監管特性。
如圖1所示，某公司網絡通過專線接入Internet，上行帶寬為60Mbps，所有終端設備均以Device作為網關設備。現要求使用流量監管功能，對上行至Internet的流量進行分類限速：
· HTTP流量：總上行限速為40Mbps，其中研發部25台主機分配15Mbps上行帶寬；市場部40台主機分配25Mbps上行帶寬。
· 郵件服務器代理所有客戶端向外網發送電子郵件，限製上行帶寬為2Mbps。
· 遠端分支機構可以通過Internet訪問FTP服務器，限製上行的FTP的數據流量不超過10Mbps。
要實現對不同特征數據流的流量監管，主要是明確匹配各業務數據的類規則。在本例中，需要使用ACL來匹配各種協議或來源的IP報文，並將這些分類規則與不同的流量監管動作進行綁定，即可實現對不同特征的數據進行不同的速率限製。
本舉例是在E0301版本上進行配置和驗證的。
(1) 配置接口的IP地址
# 配置接口GigabitEthernet4/0的IP地址
[Device] interface gigabitethernet 4/0
[Device-GigabitEthernet4/0] ip address 200.1.1.2 24
[Device-GigabitEthernet4/0] quit
# 請參考上麵的方法，分別配置其它接口的IP地址，具體步驟省略。
(2) 配置對研發部HTTP上行流量的限製
# 創建高級IPv4 ACL 3000，匹配研發部發送的HTTP流量（目的TCP端口80）。
[Device] acl number 3000
[Device-acl-adv-3000] rule permit tcp destination-port eq 80 source 192.168.1.0 0.0.0.255
[Device-acl-adv-3000] quit
# 創建類rd_http，匹配規則為IPv4 ACL 3000。
[Device] traffic classifier rd_http
[Device-classifier-rd_http] if-match acl 3000
[Device-classifier-rd_http] quit
# 創建流行為rd_http，動作為流量監管，承諾速率15Mbps。
[Device] traffic behavior rd_http
[Device-behavior-rd_http] car cir 15360
[Device-behavior-rd_http] quit
# 創建QoS策略rd_http。
[Device] qos policy rd_http
[Device-qospolicy-rd_http] classifier rd_http behavior rd_http
[Device-qospolicy-rd_http] quit
# 將策略應用到GigabitEthernet2/0端口的入方向。
[Device] interface gigabitethernet 2/0
[Device-GigabitEthernet2/0] qos apply policy rd_http inbound
[Device-GigabitEthernet2/0] quit
(3) 配置對市場部HTTP上行流量的限製
#創建高級IPv4 ACL3001，匹配市場部發送的HTTP流量。
[Device] acl number 3001
[Device-acl-adv-3001] rule permit tcp destination-port eq 80 source 192.168.2.0 0.0.0.255
[Device-acl-adv-3001] quit
# 創建類mkt_http，匹配規則為IPv4 ACL 3001。
[Device] traffic classifier mkt_http
[Device-classifier-mkt_http] if-match acl 3001
[Device-classifier-mkt_http] quit
# 創建流行為mkt_http，動作為流量監管，承諾速率為25Mbps。
[Device] traffic behavior mkt_http
[Device-behavior-mkt_http] car cir 25600
[Device-behavior-mkt_http] quit
# 創建QoS策略mkt_http。
[Device] qos policy mkt_http
[Device-qospolicy-mkt_http] classifier mkt_http behavior mkt_http
[Device-qospolicy-mkt_http] quit
# 將策略應用到GigabitEthernet3/0端口的入方向。
[Device] interface gigabitethernet 3/0
[Device-GigabitEthernet3/0] qos apply policy mkt_http inbound
[Device-GigabitEthernet3/0] quit
(4) 配置對郵件服務器發送電子郵件流量的限製
# 創建高級IPv4 ACL 3002，匹配郵件服務器向外發送郵件的數據。
[Device] acl number 3002
[Device-acl-adv-3002] rule permit tcp destination-port eq smtp source 192.168.10.1 0.0.0.0
[Device-acl-adv-3002] quit
# 創建類email，匹配規則為IPv4 ACL 3002。
[Device] traffic classifier email
[Device-classifier-email] if-match acl 3002
[Device-classifier-email] quit
# 創建流行為email，動作為流量監管，承諾速率為2Mbps。
[Device] traffic behavior email
[Device-behavior-email] car cir 2048
[Device-behavior-email] quit
# 創建QoS策略email&ftp。
[Device] qos policy email&ftp
[Device-qospolicy-email&ftp] classifier email behavior email
[Device-qospolicy-email&ftp] quit
(5) 配置對分支機構的FTP流量的限製
# 創建基本IPv4 ACL 2001，匹配FTP服務器發送的報文。
[Device] acl number 2001
[Device-acl-basic-2001] rule permit source 192.168.10.2 0.0.0.0
[Device-acl-basic-2001] quit
# 創建類ftp，匹配規則為IPv4 ACL 2001。
[Device] traffic classifier ftp
[Device-classifier-ftp] if-match acl 2001
[Device-classifier-ftp] quit
# 創建流行為ftp，動作為流量監管，承諾速率為10Mbps。
[Device] traffic behavior ftp
[Device-behavior-ftp] car cir 10240
[Device-behavior-ftp] quit
# 在QoS策略email&ftp中為類ftp指定流行為ftp。
[Device] qos policy email&ftp
[Device-qospolicy-email&ftp] classifier ftp behavior ftp
[Device-qospolicy-email&ftp] quit
# 將策略應用到GigabitEthernet4/0端口的出方向。
[Device] interface gigabitethernet 4/0
[Device-GigabitEthernet4/0] qos apply policy email&ftp outbound
[Device-GigabitEthernet4/0] quit
# 執行display qos policy interface命令查看端口上QoS策略的應用狀態。
[Device] display qos policy interface
Interface: GigabitEthernet2/0
Direction: Inbound
Policy: rd_http
Classifier: default-class
Matched : 313 (Packets) 29916 (Bytes)
5-minute statistics:
Forwarded: 0/719 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match any
Behavior: be
-none-
Classifier: rd_http
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match acl 3000
Behavior: rd_http
Committed Access Rate:
CIR 15360 (kbps), CBS 960000 (Bytes), EBS 0 (Bytes)
Green action : pass
Yellow action : pass
Red action : discard
Green packets : 0 (Packets) 0 (Bytes)
Yellow packets: 0 (Packets) 0 (Bytes)
Red packets : 0 (Packets) 0 (Bytes)
Interface: GigabitEthernet3/0
Direction: Inbound
Policy: mkt_http
Classifier: default-class
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match any
Behavior: be
-none-
Classifier: mkt_http
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match acl 3001
Behavior: mkt_http
Committed Access Rate:
CIR 25600 (kbps), CBS 1600000 (Bytes), EBS 0 (Bytes)
Green action : pass
Yellow action : pass
Red action : discard
Green packets : 0 (Packets) 0 (Bytes)
Yellow packets: 0 (Packets) 0 (Bytes)
Red packets : 0 (Packets) 0 (Bytes)
Interface: GigabitEthernet4/0
Direction: Outbound
Policy: email&ftp
Classifier: default-class
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match any
Behavior: be
-none-
Classifier: email
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match acl 3002
Behavior: email
Committed Access Rate:
CIR 2048 (kbps), CBS 128000 (Bytes), EBS 0 (Bytes)
Green action : pass
Yellow action : pass
Red action : discard
Green packets : 0 (Packets) 0 (Bytes)
Yellow packets: 0 (Packets) 0 (Bytes)
Red packets : 0 (Packets) 0 (Bytes)
Classifier: ftp
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match acl 2001
Behavior: ftp
Committed Access Rate:
CIR 10240 (kbps), CBS 640000 (Bytes), EBS 0 (Bytes)
Green action : pass
Yellow action : pass
Red action : discard
Green packets : 0 (Packets) 0 (Bytes)
Yellow packets: 0 (Packets) 0 (Bytes)
Red packets : 0 (Packets) 0 (Bytes)
#
traffic classifier email operator and
if-match acl 3002
#
traffic classifier ftp operator and
if-match acl 2001
#
traffic classifier mkt_http operator and
if-match acl 3001
#
traffic classifier rd_http operator and
if-match acl 3000
#
traffic behavior email
car cir 2048 cbs 128000 ebs 0 green pass red discard yellow pass
#
traffic behavior ftp
car cir 10240 cbs 640000 ebs 0 green pass red discard yellow pass
#
traffic behavior mkt_http
car cir 25600 cbs 1600000 ebs 0 green pass red discard yellow pass
#
traffic behavior rd_http
car cir 15360 cbs 960000 ebs 0 green pass red discard yellow pass
#
qos policy email&ftp
classifier email behavior email
classifier ftp behavior ftp
#
qos policy mkt_http
classifier mkt_http behavior mkt_http
#
qos policy rd_http
classifier rd_http behavior rd_http
#
interface GigabitEthernet1/0
port link-mode route
ip address 192.168.10.254 255.255.255.0
#
interface GigabitEthernet2/0
port link-mode route
ip address 192.168.1.1 255.255.255.0
qos apply policy rd_http inbound
#
interface GigabitEthernet3/0
port link-mode route
ip address 192.168.2.1 255.255.255.0
qos apply policy mkt_http inbound
#
interface GigabitEthernet4/0
port link-mode route
ip address 200.1.1.2 255.255.255.0
qos apply policy email&ftp outbound
#
acl number 2001
rule 0 permit source 192.168.10.2 0
#
acl number 3000
rule 0 permit tcp source 192.168.1.0 0.0.0.255 destination-port eq www
#
acl number 3001
rule 0 permit tcp source 192.168.2.0 0.0.0.255 destination-port eq www
#
acl number 3002
rule 0 permit tcp source 192.168.10.1 0 destination-port eq smtp
· 《H3C VSR1000虛擬路由器配置指導》中的“ACL和QoS配置指導”
· 《H3C VSR1000虛擬路由器命令參考》中的“ACL和QoS命令參考”
不同款型規格的資料略有差異, 詳細信息請向具體銷售和400谘詢。H3C保留在沒有任何通知或提示的情況下對資料內容進行修改的權利!
支持
售前谘詢
售後谘詢
人工在線谘詢
