• 全部
  • 经验案例
  • 典型配置
  • 技术公告
  • FAQ
  • 漏洞说明
  • 全部
  • 全部
  • 大数据引擎
  • 知了引擎
产品线
搜索
取消
案例类型
发布者
是否解决
是否官方
时间
搜索引擎
匹配模式
高级搜索

SecPath1800F防火墙IP带宽限制配置

2006-09-08 发表
  • 0关注 ,276浏览
粉丝: 关注:

Eudemon防火墙IP带宽限制配置

 

一、组网需求

PC两台,Eudemon 1000一台。

Client host地址: 100.1.1.100 在防火墙的trust域

Server host地址:110.1.1.110 在防火墙的untrust域

client发起去server的tcp连接,对这个流进行带宽限制。

二、组网图:

Eudemon 1000软件版本:VRP 3.30 RELEASE 0336.01(08)

三、配置步骤:

[Eudemon]display current-configuration                                         

#                                                                              

acl number 2000                                  //定义基本ACL组                              

 rule 0 permit source 100.1.1.100 0                                            

#                                                                              

acl number 3000                                  //定义高级ACL组                              

 rule 0 permit tcp source 100.1.1.100 0 destination 110.1.1.110 0              

#                                                                              

 sysname Eudemon                                                               

#                                                                               

 firewall mode route                                                           

#                                                                              

 firewall statistic system enable                                               

 firewall car-class 1 100000                     // ip带宽等级配置              

#                                                                              

interface Aux0                                                                  

 async mode flow                                                               

 link-protocol ppp                                                             

#                                                                              

interface Ethernet0/0/0                                                        

#                                                                              

interface Ethernet0/0/1                                                        

#                                                                               

interface Ethernet1/0/0                                                        

 ip address 100.1.1.1 255.255.255.0                                            

#                                                                               

interface Ethernet1/0/1                                                        

 ip address 110.1.1.1 255.255.255.0                                            

#                                                                               

interface Ethernet1/0/2                                                        

#                                                                              

interface Ethernet1/0/3                                                         

#                                                                              

interface Ethernet1/0/4                                                        

#                                                                               

interface Ethernet1/0/5                                                        

#                                                                              

interface Ethernet1/0/6                                                        

#                                                                               

interface Ethernet1/0/7                                                        

#                                                                              

interface GigabitEthernet2/0/0                                                 

#                                                                              

interface GigabitEthernet2/0/1                                                 

#                                                                               

interface NULL0                                                                

#                                                                              

firewall zone local                                                             

 set priority 100                                                              

#                                                                              

firewall zone trust                                                             

 set priority 85                                                               

 add interface Ethernet1/0/0                                                   

 statistic enable ip outzone                   //使得域IP统计                

 statistic ip-stat outbound acl-number 3000   //基本acl来绑定ip带宽配置   

 statistic car  ip outbound  1 acl 2000       //用高级acl来指定要做car的流

#                                                                              

firewall zone untrust                                                          

 set priority 5                                                                

 add interface Ethernet1/0/1                                                   

#                                                                               

firewall zone dmz                                                              

 set priority 50                                                               

#                                                                               

firewall interzone local trust                                                 

#                                                                              

firewall interzone local untrust                                                

#                                                                              

firewall interzone local dmz                                                   

#                                                                               

firewall interzone trust untrust                                               

#                                                                              

firewall interzone trust dmz                                                   

#                                                                               

firewall interzone dmz untrust                                                 

#                                                                              

aaa                                                                             

 authentication-scheme default                                                 

#                                                                              

 authorization-scheme default                                                  

#                                                                              

 accounting-scheme default                                                     

#                                                                              

 domain default                                                                

#                                                                              

#                                                                               

user-interface con 0                                                           

user-interface aux 0                                                           

user-interface vty 0 4                                                          

#                                                                              

return              

 

四、配置关键点

client发起的到server的tcp连接的带宽限制,双向流量和为100000bps。如果是server发起去client的连接不受上面配置的限制。

[Eudemon-zone-untrust]statistic car ip outbound 2 acl 2000 

指定从untrust域来的特定IP发起的会话的总带宽等级为2,指该IP发起的会话的双向流量之和。比如,如果untrust域穿过防火墙访问WWW服务器,则该会话中去服务器的流量加上WWW服务器回来的流量之和,不会超过设定的带宽等级。

如果服务器是FTP,因为服务器的Port方式下载,其FTP数据通道是由服务器发起,应增加如下配置

[Eudemon-zone-untrust]statistic car ip inbound 2 acl 2000  才能够限制住该用户的FTP下载流量。

注:IP CAR 中限制的流量,只包含IP包载荷,不包含二层头。

 

 

 

                                                        

0 个评论

该案例暂时没有网友评论

编辑评论

举报

×

侵犯我的权益 >
对根叔知了社区有害的内容 >
辱骂、歧视、挑衅等(不友善)

侵犯我的权益

×

泄露了我的隐私 >
侵犯了我企业的权益 >
抄袭了我的内容 >
诽谤我 >
辱骂、歧视、挑衅等(不友善)
骚扰我

泄露了我的隐私

×

您好,当您发现根叔知了上有泄漏您隐私的内容时,您可以向根叔知了进行举报。 请您把以下内容通过邮件发送到zhiliao@h3c.com 邮箱,我们会尽快处理。
  • 1. 您认为哪些内容泄露了您的隐私?(请在邮件中列出您举报的内容、链接地址,并给出简短的说明)
  • 2. 您是谁?(身份证明材料,可以是身份证或护照等证件)

侵犯了我企业的权益

×

您好,当您发现根叔知了上有关于您企业的造谣与诽谤、商业侵权等内容时,您可以向根叔知了进行举报。 请您把以下内容通过邮件发送到 zhiliao@h3c.com 邮箱,我们会在审核后尽快给您答复。
  • 1. 您举报的内容是什么?(请在邮件中列出您举报的内容和链接地址)
  • 2. 您是谁?(身份证明材料,可以是身份证或护照等证件)
  • 3. 是哪家企业?(营业执照,单位登记证明等证件)
  • 4. 您与该企业的关系是?(您是企业法人或被授权人,需提供企业委托授权书)
我们认为知名企业应该坦然接受公众讨论,对于答案中不准确的部分,我们欢迎您以正式或非正式身份在根叔知了上进行澄清。

抄袭了我的内容

×

原文链接或出处

诽谤我

×

您好,当您发现根叔知了上有诽谤您的内容时,您可以向根叔知了进行举报。 请您把以下内容通过邮件发送到zhiliao@h3c.com 邮箱,我们会尽快处理。
  • 1. 您举报的内容以及侵犯了您什么权益?(请在邮件中列出您举报的内容、链接地址,并给出简短的说明)
  • 2. 您是谁?(身份证明材料,可以是身份证或护照等证件)
我们认为知名企业应该坦然接受公众讨论,对于答案中不准确的部分,我们欢迎您以正式或非正式身份在根叔知了上进行澄清。

对根叔知了社区有害的内容

×

垃圾广告信息
色情、暴力、血腥等违反法律法规的内容
政治敏感
不规范转载 >
辱骂、歧视、挑衅等(不友善)
骚扰我
诱导投票

不规范转载

×

举报说明

提出建议

    +

亲~登录后才可以操作哦!

确定

你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作