H3C SecPath DAR特性（BT限流）典型配置

<H3C>

sys

进入系统视图

[H3C]

firewall packet-filter default permit

防火墙包过滤默认改为允许

[H3C]

firewall zone untrust

进入域视图

[H3C-zone-untrust]   

add interface GigabitEthernet0/0

添加外网接口到untrust域

[H3C-zone-untrust]

quit

退回系统视图

[H3C]

firewall zone trust

进入域视图

[H3C-zone-trust]

add interface GigabitEthernet 0/1

添加内网接口到trust域

[H3C-zone-trust]

quit

退回系统视图

[H3C]

acl number 2002

创建标准访问控制列表2002

[H3C-acl-basic-2002]

rule permit

配置需要进行NAT转换的IP地址范围

[H3C-acl-basic-2002]

quit

退回系统视图

[H3C]

acl number 3010

创建高级访问控制列表3010

[H3C-acl-adv-3010]

rule permit ip destination 10.173.0.0 0.0.0.255

配置需要限制BT下载的IP网段

[H3C-acl-adv-3010]

rule deny ip

不限制其他网段的BT下载

[H3C-acl-adv-3010]

quit

退回系统视图

[H3C]

acl number 3011

创建高级访问控制列表3011

[H3C-acl-adv-3011]

rule permit ip source 10.173.0.0 0.0.0.255

配置需要限制BT上传的IP网段

[H3C-acl-adv-3011]

rule deny ip

不限制其他网段的BT上传

[H3C-acl-adv-3011]

quit

退回系统视图

[H3C]

time-range test 08:30 to 18:00 working-day

创建BT报文限流的时间段

[H3C]

acl number 2001

创建标准访问控制列表2001

[H3C-acl-basic-2001]

rule permit time-range test

配置BT报文限流的时间段

[H3C-acl-basic-2001]

quit

退回系统视图

[H3C]

interface GigabitEthernet 0/0

进入接口视图

[H3C-GigabitEthernet0/0]

ip address 58.60.106.1 255.255.255.0

配置接口IP

[H3C-GigabitEthernet0/0]

nat outbound 2002

直接使用该接口的IP地址作为NAT转换后的IP地址，对匹配标准访问控制列表2002的数据报文的源IP地址进行NAT转换

[H3C-GigabitEthernet0/0]

quit

退回系统视图

[H3C]

interface GigabitEthernet 0/1

进入接口视图

[H3C-GigabitEthernet0/1]

ip address 10.173.0.1 255.255.255.0

配置接口IP

[H3C-GigabitEthernet0/1]

quit

退回系统视图

[H3C]

traffic classifier BT_Download

创建BT下载报文流分类

[H3C-classifier-BT_Download]

if-match protocol bittorrent 

匹配BT报文

[H3C-classifier-BT_Download]

if-match acl 3010

配置需要限制BT下载的IP网段

[H3C-classifier-BT_Download]

if-match acl 2001

配置需要限制BT下载的时间段

[H3C-classifier-BT_Download]

quit

退回系统视图

[H3C]

traffic classifier BT_Upload

创建BT上传报文流分类

[H3C-classifier-BT_Upload]

if-match protocol bittorrent 

匹配BT报文

[H3C-classifier-BT_Upload]

if-match acl 3011

配置需要限制BT上传的IP网段

[H3C-classifier-BT_Upload]

if-match acl 2001

配置需要限制BT上传的时间段

[H3C-classifier-BT_Upload]

quit

退回系统视图

[H3C]

traffic behavior BT_Download

创建BT报文下载流行为

[H3C-behavior-BT_Download]

car cir 160000

限流160kbps

[H3C-behavior-BT_Download]

quit

退回系统视图

[H3C]

traffic behavior BT_Upload

创建BT报文上传流行为

[H3C-behavior-BT_Upload]

car cir 160000

限流160kbps

[H3C-behavior-BT_Upload]

quit

退回系统视图

[H3C]

qos policy BT_Download

创建BT报文下载QOS策略

[H3C-qospolicy-BT_Download]

classifier BT_Download behavior BT_Download

创建BT报文下载QOS策略

[H3C-qospolicy-BT_Download]

quit

退回系统视图

[H3C]

qos policy BT_Upload

创建BT报文上传QOS策略

[H3C-qospolicy-BT_Upload]

classifier BT_Upload behavior BT_Upload

创建BT报文上传QOS策略

[H3C-qospolicy-BT_Upload]

quit

退回系统视图

[H3C]

interface GigabitEthernet 0/1

进入接口视图

[H3C-GigabitEthernet0/1]

qos apply policy BT_Download outbound

在内网接口上应用BT报文下载QOS策略

[H3C-GigabitEthernet0/1]

qos apply policy BT_Upload inbound

在内网接口上应用BT报文上传QOS策略

[H3C-GigabitEthernet0/1]

quit

退回系统视图

[H3C]

return

退回用户视图