基于ip地址限流的配置

基于ip地址的Qos限流配置

一、组网需求

PC作为客户端，访问FTP服务器下载资源。配置Qos后，对PC的下载速度进行限制，将 PC的连接速度控制在一个特定的范围。

二、组网图

    如图所示，PC和FTP Server分别接在SecPath防火墙的两个端口上面。通过配置Qos，使PC的下载速度限制在0.5Mbps。

    软件版本如下：

    SecPath1000F：VRP 3.40 ESS 1604；

三、配置步骤

SecPath防火墙的配置：            

[SecPath]dis cu                                                                     

sysname SecPath                                                                   

firewall packet-filter enable                                                 

 firewall packet-filter default permit                                         

undo connection-limit enable                                                  

 connection-limit default deny                                                 

 connection-limit default amount upper-limit 50 lower-limit 20                 

firewall statistic system enable                                              

radius scheme system

domain system

acl number 3000                                                                

 rule 0 permit ip destination 20.0.0.1 0                          //配置匹配目的地址为PC数据流的acl                            

interface Aux0                                                                 

 async mode flow  

interface GigabitEthernet0/0

ip address 20.0.0.2 255.255.255.0                                              

 qos car outbound acl 3000 cir 500000 cbs 500000 ebs 0 green pass red discard

                                                                               //配置流控，对匹配acl3000的数据流进行流量控制，限

                                              制速度为0.5M。

interface GigabitEthernet0/1

ip address 30.0.0.2 255.255.255.0  

interface Encrypt2/0                                                            

interface NULL0                                                                

firewall zone local                                                            

 set priority 100                                                              

firewall zone trust                                                            

add interface GigabitEthernet0/0

 add interface GigabitEthernet0/1

set priority 85                                                               

firewall zone untrust                                                           

 set priority 5                                                                

firewall zone DMZ                                                              

 set priority 50                                                                

firewall interzone local trust                                                 

firewall interzone local untrust                                               

firewall interzone local DMZ                                                   

firewall interzone trust untrust                                               

firewall interzone trust DMZ                                                   

firewall interzone DMZ untrust                                                 

user-interface con 0                                                           

user-interface aux 0                                                           

user-interface vty 0 4                                                          

return   

四、配置关键点

    请见配置里面的蓝色斜体字和红色标记的位子。