H3C流量监管典型配置举例

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

资料版本：6W100-20200330

产品版本：Release 7585P05

 

Copyright © 2020 新华三技术有限公司 版权所有，保留一切权利。 非经本公司书面许可，任何单位和个人不得擅自摘抄、复制本文档内容的部分或全部，并不得以任何形式传播。 除新华三技术有限公司的商标外，本手册中出现的其它公司的商标、产品标识及商品名称，由各自权利人拥有。 本文档中的信息可能变动，恕不另行通知。

 

目  录

1 简介

2 配置前提

3 基于IP地址和协议类型进行流量监管典型配置举例

3.1 组网需求

3.2 配置思路

3.3 配置注意事项

3.4 配置步骤

3.5 验证配置

3.6 配置文件

4 基于VLAN的带宽分配典型配置举例

4.1 组网需求

4.2 配置思路

4.3 配置注意事项

4.4 配置步骤

4.5 验证配置

4.6 配置文件

5 聚合CAR典型配置举例

5.1 组网需求

5.2 配置思路

5.3 配置步骤

5.4 验证配置

5.5 配置文件

6 相关资料

 

1  简介

本文档介绍了流量监管的配置举例。

流量监管就是对流量进行控制，通过监督进入网络的流量速率，对超出部分的流量进行“惩罚”，使进入的流量被限制在一个合理的范围之内，以保护网络资源和运营商的利益。

流量监管分为：聚合CAR和普通CAR。聚合CAR是指能够对多个端口上的业务流使用同一个CAR进行流量监管，即如果多个端口应用同一聚合CAR，则这多个端口的流量之和必须在此聚合CAR设定的流量监管范围之内。普通CAR与聚合CAR不同，在端口上应用的普通CAR无法实现对多个端口的流量之和进行流量监管，不同端口上应用的普通CAR需要单独配置。

2  配置前提

本文档中的配置均是在实验室环境下进行的配置和验证，配置前设备的所有参数均采用出厂时的缺省配置。如果您已经对设备进行了配置，为了保证配置效果，请确认现有配置和以下举例中的配置不冲突。

本文假设您已了解流量监管特性。

3  基于IP地址和协议类型进行流量监管典型配置举例

3.1  组网需求

如4.1  图2所示，某公司网络通过专线接入Internet，上行带宽为60Mbps，所有终端设备均以防火墙作为网关设备。现要求使用流量监管功能，对上行至Internet的流量进行分类限速：

·     HTTP流量：总上行限速为40Mbps，其中研发部25台主机分配15Mbps上行带宽；市场部40台主机分配25Mbps上行带宽。

·     邮件服务器代理所有客户端向外网发送电子邮件，限制上行带宽为2Mbps。

·     远端分支机构可以通过Internet访问FTP服务器，限制上行的FTP的数据流量不超过10Mbps。

图1 基于IP地址和协议类型进行流量监管配置组网图

 

 

3.2  配置思路

要实现对不同特征数据流的流量监管，主要是明确匹配各业务数据的类规则。在本例中，需要使用ACL来匹配各种协议或来源的IP报文，并将这些分类规则与不同的流量监管动作进行绑定，即可实现对不同特征的数据进行不同的速率限制。

3.3  配置注意事项

在一个流行为中，流量监管动作不能与重标记优先级（包括本地优先级、丢弃优先级、802.1p优先级、DSCP优先级、IP优先级）的动作同时配置，否则会导致该流行为不能被正常应用。

3.4  配置步骤

(1)     配置对研发部HTTP上行流量的限制

# 创建高级IPv4 ACL 3000，匹配研发部发送的HTTP流量（目的TCP端口80）。

<Device> system-view

[Device] acl advanced 3000

[Device-acl-ipv4-adv-3000] rule permit tcp destination-port eq 80 source 192.168.1.0 0.0.0.255

[Device-acl-ipv4-adv-3000] quit

# 创建类rd_http，匹配规则为IPv4 ACL 3000。

[Device] traffic classifier rd_http

[Device-classifier-rd_http] if-match acl 3000

[Device-classifier-rd_http] quit

# 创建流行为rd_http，动作为流量监管，承诺速率15Mbps。

[Device] traffic behavior rd_http

[Device-behavior-rd_http] car cir 15360

[Device-behavior-rd_http] quit

# 创建QoS策略rd_http。

[Device] qos policy rd_http

[Device-qospolicy-rd_http] classifier rd_http behavior rd_http

[Device-qospolicy-rd_http] quit

# 将策略应用到Ten-GigabitEthernet1/0/3端口的入方向。

[Device] interface ten-gigabitethernet 1/0/3

[Device-Ten-GigabitEthernet1/0/3] qos apply policy rd_http inbound

[Device-Ten-GigabitEthernet1/0/3] quit

(2)     配置对市场部HTTP上行流量的限制

#创建高级IPv4 ACL3001，匹配市场部发送的HTTP流量。

[Device] acl advanced 3001

[Device-acl-ipv4-adv-3001] rule permit tcp destination-port eq 80 source 192.168.2.0 0.0.0.255

[Device-acl-ipv4-adv-3001] quit

# 创建类mkt_http，匹配规则为IPv4 ACL 3001。

[Device] traffic classifier mkt_http

[Device-classifier-mkt_http] if-match acl 3001

[Device-classifier-mkt_http] quit

# 创建流行为mkt_http，动作为流量监管，承诺速率为25Mbps。

[Device] traffic behavior mkt_http

[Device-behavior-mkt_http] car cir 25600

[Device-behavior-mkt_http] quit

# 创建QoS策略mkt_http。

[Device] qos policy mkt_http

[Device-qospolicy-mkt_http] classifier mkt_http behavior mkt_http

[Device-qospolicy-mkt_http] quit

# 将策略应用到Ten-GigabitEthernet1/0/4端口的入方向。

[Device] interface ten-gigabitethernet 1/0/4

[Device-Ten-GigabitEthernet1/0/4] qos apply policy mkt_http inbound

[Device-Ten-GigabitEthernet1/0/4] quit

(3)     配置对邮件服务器发送电子邮件流量的限制

# 创建高级IPv4 ACL 3002，匹配邮件服务器向外发送邮件的数据。

[Device] acl advanced 3002

[Device-acl-ipv4-adv-3002] rule permit tcp destination-port eq smtp source 192.168.10.1 0.0.0.0

[Device-acl-ipv4-adv-3002] quit

# 创建类email，匹配规则为IPv4 ACL 3002。

[Device] traffic classifier email

[Device-classifier-email] if-match acl 3002

[Device-classifier-email] quit

# 创建流行为email，动作为流量监管，承诺速率为2Mbps。

[Device] traffic behavior email

[Device-behavior-email] car cir 2048

[Device-behavior-email] quit

# 创建QoS策略email&ftp。

[Device] qos policy email&ftp

[Device-qospolicy-email&ftp] classifier email behavior email

[Device-qospolicy-email&ftp] quit

(4)     配置对分支机构的FTP流量的限制

# 创建基本IPv4 ACL 2001，匹配FTP服务器发送的报文。

[Device] acl basic 2001

[Device-acl-ipv4-basic-2001] rule permit source 192.168.10.2 0.0.0.0

[Device-acl-ipv4-basic-2001] quit

# 创建类ftp，匹配规则为IPv4 ACL 2001。

[Device] traffic classifier ftp

[Device-classifier-ftp] if-match acl 2001

[Device-classifier-ftp] quit

# 创建流行为ftp，动作为流量监管，承诺速率为10Mbps。

[Device] traffic behavior ftp

[Device-behavior-ftp] car cir 10240

[Device-behavior-ftp] quit

# 在QoS策略email&ftp中为类ftp指定流行为ftp。

[Device] qos policy email&ftp

[Device-qospolicy-email&ftp] classifier ftp behavior ftp

[Device-qospolicy-email&ftp] quit

# 将策略应用到Ten-GigabitEthernet1/0/1端口的出方向。

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] qos apply policy email&ftp outbound

[Device-Ten-GigabitEthernet1/0/1] quit

3.5  验证配置

# 执行display qos policy interface命令查看端口上QoS策略的应用状态。

[Device] display qos policy interface

Interface: Ten-GigabitEthernet1/0/3

  Direction: Inbound

  Policy: rd_http

   Classifier: rd_http

     Operator: AND

     Rule(s) :

      If-match acl 3000

     Behavior: rd_http

      Committed Access Rate:

        CIR 15360 (kbps), CBS 960000 (Bytes), EBS 0 (Bytes)

        Green action  : pass

        Yellow action : pass

        Red action    : discard

        Green packets : 0 (Packets)

        Red packets   : 0 (Packets)

 

Interface: Ten-GigabitEthernet1/0/4

  Direction: Inbound

  Policy: mkt_http

   Classifier: mkt_http

     Operator: AND

     Rule(s) :

      If-match acl 3001

     Behavior: mkt_http

      Committed Access Rate:

        CIR 25600 (kbps), CBS 1600000 (Bytes), EBS 0 (Bytes)

        Green action  : pass

        Yellow action : pass

        Red action    : discard

        Green packets : 0 (Packets)

        Red packets   : 0 (Packets)

 

Interface: Ten-GigabitEthernet1/0/1

  Direction: Outbound

  Policy: email&ftp

   Classifier: email

     Operator: AND

     Rule(s) :

      If-match acl 3002

     Behavior: email

      Committed Access Rate:

        CIR 2048 (kbps), CBS 128000 (Bytes), EBS 0 (Bytes)

        Green action  : pass

        Yellow action : pass

        Red action    : discard

        Green packets : 0 (Packets)

        Red packets   : 0 (Packets)

   Classifier: ftp

     Operator: AND

     Rule(s) :

      If-match acl 2001

     Behavior: ftp

      Committed Access Rate:

        CIR 10240 (kbps), CBS 640000 (Bytes), EBS 0 (Bytes)

        Green action  : pass

        Yellow action : pass

        Red action    : discard

        Green packets : 0 (Packets)

        Red packets   : 0 (Packets)

3.6  配置文件

#

traffic classifier email operator and

 if-match acl 3002

#

traffic classifier ftp operator and

 if-match acl 2001

#

traffic classifier mkt_http operator and

 if-match acl 3001

#

traffic classifier rd_http operator and

 if-match acl 3000

#

traffic behavior email

 car cir 2048 cbs 128000 ebs 0 red discard

#

traffic behavior ftp

 car cir 10240 cbs 640000 ebs 0 red discard

#

traffic behavior mkt_http

 car cir 25600 cbs 1600000 ebs 0 red discard

#

traffic behavior rd_http

 car cir 15360 cbs 960000 ebs 0 red discard

#

qos policy email&ftp

 classifier email behavior email

 classifier ftp behavior ftp

#

qos policy mkt_http

 classifier mkt_http behavior mkt_http

#

qos policy rd_http

 classifier rd_http behavior rd_http

#

interface Ten-GigabitEthernet1/0/1

 port link-mode bridge

 qos apply policy email&ftp outbound

#

interface Ten-GigabitEthernet1/0/3

 port link-mode bridge

 qos apply policy rd_http inbound

#

interface Ten-GigabitEthernet1/0/4

 port link-mode bridge

 qos apply policy mkt_http inbound

#

acl basic 2001

 rule 0 permit source 192.168.10.2 0

#

acl advanced 3000

 rule 0 permit tcp source 192.168.1.0 0.0.0.255 destination-port eq www

#

acl advanced 3001

 rule 0 permit tcp source 192.168.2.0 0.0.0.255 destination-port eq www

#

acl advanced 3002

 rule 0 permit tcp source 192.168.10.1 0 destination-port eq smtp

4  基于VLAN的带宽分配典型配置举例

4.1  组网需求

如图2所示，某公司各分支机构通过交换机将数据上行至Device，再由Device通过专线将数据传输至公司骨干网。

各分支机构内通过VLAN来标识不同的业务数据，在Device的Ten-GigabitEthernet1/0/1和Ten-GigabitEthernet1/0/2端口上配置了1:1 VLAN Mapping功能，按图中所示对业务VLAN进行了重新映射，以满足骨干网中的传输策略要求。

根据线路带宽状况，现要求使用流量监管功能，实现对不同业务类型的数据进行如下的带宽分配：

·     在Device连接分支机构A和分支机构B的链路上，要求对上行至Device的各业务数据速率分别限制为：VLAN1001为400Mbps，VLAN1002为200Mbps，VLAN1003为200Mbps。对Device下行方向的业务数据同样根据以上数值进行限速。

·     在Device连接分支机构C的链路上，要求对上行至Device的各业务数据速率分别限制为：VLAN201为400Mbps，VLAN202为200Mbps，VLAN203为200Mbps。对Device下行方向的业务数据同样根据以上数值进行限速。

·     在Device连接公司骨干网的联路上，要求对上行至骨干网的各业务数据限速为：VLAN201为100Mbps，VLAN202为60Mbps，VLAN203为40Mbps。对下行方向数据同样根据以上数值进行限速。

图2 基于VLAN的带宽分配配置组网图

 

 

4.2  配置思路

为实现基于VLAN的带宽分配，需要将QoS策略中流分类匹配规则定义为匹配指定的VLAN，同时创建动作为流量监管的流行为，并将二者进行配对关联。通过创建多个这样的配对关系并将对应的QoS策略进行应用，便可以对不同VLAN的数据进行不同的速率限制，达到带宽分配的效果。

 

4.3  配置注意事项

·     在端口上应用QoS策略之后，不能再改变端口QinQ功能的使能状况。因此，本例中需要在端口上先开启QinQ功能，再应用QoS策略。

·     在一个流行为中，流量监管动作不能与重标记优先级（包括本地优先级、丢弃优先级、802.1p优先级、DSCP优先级、IP优先级）的动作同时配置，否则会导致该流行为不能被正常应用。

4.4  配置步骤

1. 非VLAN Mapping部分的带宽分配配置

# 创建流分类vlan201_c，匹配规则为匹配service-vlan-id为201。

<Device> system-view

[Device] traffic classifier vlan201_c

[Device-classifier-vlan201_c] if-match service-vlan-id 201

[Device-classifier-vlan201_c] quit

# 使用同样步骤创建流分类vlan202_c和vlan203_c，分别匹配service-vlan-id为202和203。

[Device] traffic classifier vlan202_c

[Device-classifier-vlan202_c] if-match service-vlan-id 202

[Device-classifier-vlan202_c] quit

[Device] traffic classifier vlan203_c

[Device-classifier-vlan203_c] if-match service-vlan-id 203

[Device-classifier-vlan203_c] quit

# 创建流行为car_vlan201_downlink，并配置流量监管的动作，承诺速率为400Mbps。该动作用于在Device上限制由分支机构C上行的VLAN201的数据速率。

[Device] traffic behavior car_vlan201_downlink

[Device-behavior-car_vlan201_downlink] car cir 409600

[Device-behavior-car_vlan201_downlink] quit

# 使用同样步骤创建流行为car_vlan202_downlink和car_vlan203_downlink，并配置相应的流量监管动作，分别为：承诺速率200Mbps。

[Device] traffic behavior car_vlan202_downlink

[Device-behavior-car_vlan202_downlink] car cir 204800

[Device-behavior-car_vlan202_downlink] quit

[Device] traffic behavior car_vlan203_downlink

[Device-behavior-car_vlan203_downlink] car cir 204800

[Device-behavior-car_vlan203_downlink] quit

# 创建QoS策略qos_c，将以上三组流分类和流行为分别进行配对。

[Device] qos policy qos_c

[Device-qospolicy-qos_c] classifier vlan201_c behavior car_vlan201_downlink

[Device-qospolicy-qos_c] classifier vlan202_c behavior car_vlan202_downlink

[Device-qospolicy-qos_c] classifier vlan203_c behavior car_vlan203_downlink

[Device-qospolicy-qos_c] quit

# 将QoS策略qos_c应用到Ten-GigabitEthernet1/0/3端口的入方向，即实现了对分支机构C中VLAN201、VLAN202、VLAN203的上行数据进行限速。

[Device] interface ten-gigabitethernet 1/0/3

[Device-Ten-GigabitEthernet1/0/3] qos apply policy qos_c inbound

# 将该策略应用到Ten-GigabitEthernet1/0/3端口的出方向，即可实现在下行方向对各VLAN数据的限速。

[Device-Ten-GigabitEthernet1/0/3] qos apply policy qos_c outbound

# 配置端口Ten-GigabitEthernet1/0/3和Ten-GigabitEthernet1/0/10为Trunk端口，并允许VLAN201、VLAN202和VLAN203通过，取消允许VLAN1通过。

[Device-Ten-GigabitEthernet1/0/3] port link-type trunk

[Device-Ten-GigabitEthernet1/0/3] port trunk permit vlan 201 to 203

[Device-Ten-GigabitEthernet1/0/3] undo port trunk permit vlan 1

[Device-Ten-GigabitEthernet1/0/3] quit

[Device] interface ten-gigabitethernet 1/0/10

[Device-Ten-GigabitEthernet1/0/10] port link-type trunk

[Device-Ten-GigabitEthernet1/0/10] port trunk permit vlan 201 to 203

[Device-Ten-GigabitEthernet1/0/10] undo port trunk permit vlan 1

2. VLAN Mapping部分的带宽分配配置

(1)     端口与VLAN的关系配置

# 配置端口Ten-GigabitEthernet1/0/1和Ten-GigabitEthernet1/0/2为Trunk端口，允许VLAN1001、VLAN1002、VLAN1003，以及VLAN201、VLAN202和VLAN203通过，取消允许VLAN1通过。同时在这两个端口上开启基本QinQ，用于实现VLAN映射功能。

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] port link-type trunk

[Device-Ten-GigabitEthernet1/0/1] port trunk permit vlan 1001 to 1003 201 to 203

[Device-Ten-GigabitEthernet1/0/1] undo port trunk permit vlan 1

[Device-Ten-GigabitEthernet1/0/1] qinq enable

[Device-Ten-GigabitEthernet1/0/1] quit

[Device] interface ten-gigabitethernet 1/0/2

[Device-Ten-GigabitEthernet1/0/2] port link-type trunk

[Device-Ten-GigabitEthernet1/0/2] port trunk permit vlan 1001 to 1003 201 to 203

[Device-Ten-GigabitEthernet1/0/2] undo port trunk permit vlan 1

[Device-Ten-GigabitEthernet1/0/2] qinq enable

[Device-Ten-GigabitEthernet1/0/2] quit

(2)     对上行流量进行VLAN Mapping的流分类和流行为配置

# 创建流分类vlan1001，用于将VLAN1001映射为VLAN201的QoS策略，匹配条件为customer-vlan-id为VLAN1001。

[Device] traffic classifier vlan1001

[Device-classifier-vlan1001] if-match customer-vlan-id 1001

[Device-classifier-vlan1001] quit

# 创建流行为1001_to_201，动作为重标记service-vlan-id为201。

[Device] traffic behavior 1001_to_201

[Device-behavior-1001_to_201] remark service-vlan-id 201

[Device-behavior-1001_to_201] quit

# 用同样方法创建流分类vlan1002和vlan1003，以及流行为1002_to_202和1003_to_203，用于将VLAN1002映射为VLAN202，以及将VLAN1003映射为VLAN203。

[Device] traffic classifier vlan1002

[Device-classifier-vlan1002] if-match customer-vlan-id 1002

[Device-classifier-vlan1002] quit

[Device] traffic behavior 1002_to_202

[Device-behavior-1002_to_202] remark service-vlan-id 202

[Device-behavior-1002_to_202] quit

[Device] traffic classifier vlan1003

[Device-classifier-vlan1003] if-match customer-vlan-id 1003

[Device-classifier-vlan1003] quit

[Device] traffic behavior 1003_to_203

[Device-behavior-1003_to_203] remark service-vlan-id 203

[Device-behavior-1003_to_203] quit

(3)     对下行流量进行VLAN Mapping的流分类和流行为配置

# 创建流分类vlan201，用于将VLAN201映射为VLAN1001的QoS策略，匹配条件为service-vlan-id为VLAN201。

[Device] traffic classifier vlan201

[Device-classifier-vlan201] if-match service-vlan-id 201

[Device-classifier-vlan201] quit

# 创建流行为201_to_1001，动作为重标记customer-vlan-id为1001。

[Device] traffic behavior 201_to_1001

[Device-behavior-201_to_1001] remark customer-vlan-id 1001

[Device-behavior-201_to_1001] quit

# 用同样方法创建流分类vlan202和vlan203，以及流行为202_to_1002和203_to_1003，用于将VLAN202映射为VLAN1002，以及将VLAN203映射为VLAN1003。

[Device] traffic classifier vlan202

[Device-classifier-vlan202] if-match service-vlan-id 202

[Device-classifier-vlan202] quit

[Device] traffic behavior 202_to_1002

[Device-behavior-202_to_1002] remark customer-vlan-id 1002

[Device-behavior-202_to_1002] quit

[Device] traffic classifier vlan203

[Device-classifier-vlan203] if-match service-vlan-id 203

[Device-classifier-vlan203] quit

[Device] traffic behavior 203_to_1003

[Device-behavior-203_to_1003] remark customer-vlan-id 1003

[Device-behavior-203_to_1003] quit

(4)     对分支机构上行流量进行限速的流分类和流行为配置

根据配置思路中的分析，对分支机构上行流量进行限速的流分类规则为匹配重标记后的VLAN，因此可以直接使用流分类vlan201、vlan202以及vlan203。

对于上行流量进行限速的流行为，可以直接采用上文非VLAN Mapping配置中已经配置好的流行为car_vlan201_downlink、car_vlan202_downlink和car_vlan203_downlink。

(5)     对发往分支机构的下行流量进行限速的流分类和流行为配置

根据配置思路中的分析，对发往分支机构的下行流量进行限速的流分类规则为匹配重标记后的VLAN，因此可以直接使用流分类vlan1001、vlan1002以及vlan1003。

对分支机构的下行流量进行限速的流行为，由于其限制速率与上行方向相同，因此也可以直接采用car_vlan201_downlink、car_vlan202_downlink和car_vlan203_downlink的流行为。

(6)     对向骨干网上行流量进行限速的流分类和流行为配置

对上行流量进行限速的流分类规则应为匹配重标记后的VLAN，即匹配service-vlan-id为VLAN201/202/203，因此可以直接采用流分类vlan201、vlan202以及vlan203。

# 创建流行为car_vlan201_uplink，并配置流量监管的动作，承诺速率为100Mbps。该动作用于在Device上限制VLAN201的上行速率。

[Device] traffic behavior car_vlan201_uplink

[Device-behavior-car_vlan201_uplink] car cir 102400

[Device-behavior-car_vlan201_uplink] quit

# 使用同样步骤创建流行为car_vlan202_uplink和car_vlan203_uplink，并配置相应的流量监管动作，分别为：car_vlan202_uplink承诺速率为60Mbps；car_vlan203_uplink承诺速率为40Mbps。

[Device] traffic behavior car_vlan202_uplink

[Device-behavior-car_vlan202_uplink] car cir 61440

[Device-behavior-car_vlan202_uplink] quit

[Device] traffic behavior car_vlan203_uplink

[Device-behavior-car_vlan203_uplink] car cir 40960

[Device-behavior-car_vlan203_uplink] quit

(7)     对骨干网下行流量进行限速的流分类和流行为配置

对骨干网下行流量进行限速的流分类规则应为匹配重标记后的VLAN，即匹配service-vlan-id为VLAN201/202/203，因此可以直接采用流分类vlan201、vlan202以及vlan203。

对骨干网下行流量进行限速的流行为，由于其限制速率与上行方向相同，因此也可以直接采用car_vlan201_uplink、car_vlan202_uplink和car_vlan203_uplink的流行为。

(8)     配置上行方向的QoS策略并进行应用。

在处理由分支机构上行至骨干网的报文时，交换机将按下图顺序执行动作。

图3 上行方向报文处理流程示意图（以VLAN1001为例）

 

 

# 创建QoS策略downlink_in，策略中顺序包含VLAN映射的流分类/流行为配对和对重标记后的VLAN进行流量监管的流分类/流行为配对。

[Device] qos policy downlink_in

[Device-qospolicy-downlink_in] classifier vlan1001 behavior 1001_to_201

[Device-qospolicy-downlink_in] classifier vlan1002 behavior 1002_to_202

[Device-qospolicy-downlink_in] classifier vlan1003 behavior 1003_to_203

[Device-qospolicy-downlink_in] classifier vlan201 behavior car_vlan201_downlink

[Device-qospolicy-downlink_in] classifier vlan202 behavior car_vlan202_downlink

[Device-qospolicy-downlink_in] classifier vlan203 behavior car_vlan203_downlink

[Device-qospolicy-downlink_in] quit

# 将该策略应用到Ten-GigabitEthernet1/0/1和Ten-GigabitEthernet1/0/2端口的入方向。

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] qos apply policy downlink_in inbound

[Device-Ten-GigabitEthernet1/0/1] quit

[Device] interface ten-gigabitethernet 1/0/2

[Device-Ten-GigabitEthernet1/0/2] qos apply policy downlink_in inbound

[Device-Ten-GigabitEthernet1/0/2] quit

# 创建QoS策略uplink_out，策略中包含对骨干网上行流量进行限速的流分类和流行为配对。

[Device] qos policy uplink_out

[Device-qospolicy-uplink_out] classifier vlan201 behavior car_vlan201_uplink

[Device-qospolicy-uplink_out] classifier vlan202 behavior car_vlan202_uplink

[Device-qospolicy-uplink_out] classifier vlan203 behavior car_vlan203_uplink

[Device-qospolicy-downlink_in] quit

# 将该策略应用到Ten-GigabitEthernet1/0/10端口的出方向。

[Device] interface ten-gigabitethernet 1/0/10

[Device-Ten-GigabitEthernet1/0/10] qos apply policy uplink_out outbound

(9)     配置下行方向的QoS策略并应用

在处理在由骨干网下行至分支机构的报文时，交换机将按下图顺序执行动作。

图4 下行方向报文处理流程示意图（以VLAN201为例）

 

 

# 创建QoS策略uplink_in，策略中包含对骨干网下行流量进行限速的流分类/流行为配对。

[Device] qos policy uplink_in

[Device-qospolicy-uplink_in] classifier vlan201 behavior car_vlan201_uplink

[Device-qospolicy-uplink_in] classifier vlan202 behavior car_vlan202_uplink

[Device-qospolicy-uplink_in] classifier vlan203 behavior car_vlan203_uplink

[Device-qospolicy-uplink_in] quit

# 将该策略应用到Ten-GigabitEthernet1/0/10端口的入方向。

[Device] interface ten-gigabitethernet 1/0/10

[Device-Ten-GigabitEthernet1/0/10] qos apply policy uplink_in inbound

[Device-Ten-GigabitEthernet1/0/10] quit

# 创建QoS策略downlink_out，策略中顺序包含下行方向VLAN映射的流分类/流行为配对和对分支机构下行流量进行限速的流分类/流行为配对。

[Device] qos policy downlink_out

[Device-qospolicy-downlink_out] classifier vlan201 behavior 201_to_1001

[Device-qospolicy-downlink_out] classifier vlan202 behavior 202_to_1002

[Device-qospolicy-downlink_out] classifier vlan203 behavior 203_to_1003

[Device-qospolicy-downlink_out] classifier vlan1001 behavior car_vlan201_downlink

[Device-qospolicy-downlink_out] classifier vlan1002 behavior car_vlan202_downlink

[Device-qospolicy-downlink_out] classifier vlan1003 behavior car_vlan203_downlink

[Device-qospolicy-downlink_in] quit

# 将该策略应用到Ten-GigabitEthernet1/0/1和Ten-GigabitEthernet1/0/2端口的出方向。

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] qos apply policy downlink_out outbound

[Device-Ten-GigabitEthernet1/0/1] quit

[Device] interface ten-gigabitethernet 1/0/2

[Device-Ten-GigabitEthernet1/0/2] qos apply policy downlink_out outbound

[Device-Ten-GigabitEthernet1/0/2] quit

4.5  验证配置

# 执行display qos policy interface命令查看端口上QoS策略的应用状态。此处以Ten-GigabitEthernet1/0/10为例。

[Device] display qos policy interface ten-GigabitEthernet 1/0/10

Interface: Ten-GigabitEthernet1/0/10

 

  Direction: Inbound

 

  Policy: uplink_in

   Classifier: vlan201

     Operator: AND

     Rule(s) :

      If-match service-vlan-id 201

     Behavior: car_vlan201_uplink

      Committed Access Rate:

        CIR 102400 (kbps), CBS 6400000 (Bytes), EBS 0 (Bytes)

        Green action  : pass

        Yellow action : pass

        Red action    : discard

        Green packets : 0 (Packets)

        Red packets   : 0 (Packets)

   Classifier: vlan202

     Operator: AND

     Rule(s) :

      If-match service-vlan-id 202

     Behavior: car_vlan202_uplink

      Committed Access Rate:

        CIR 61440 (kbps), CBS 3840000 (Bytes), EBS 0 (Bytes)

        Green action  : pass

        Yellow action : pass

        Red action    : discard

        Green packets : 0 (Packets)

        Red packets   : 0 (Packets)

   Classifier: vlan203

     Operator: AND

     Rule(s) :

      If-match service-vlan-id 203

     Behavior: car_vlan203_uplink

      Committed Access Rate:

        CIR 40960 (kbps), CBS 2560000 (Bytes), EBS 0 (Bytes)

        Green action  : pass

        Yellow action : pass

        Red action    : discard

        Green packets : 0 (Packets)

        Red packets   : 0 (Packets)

 

  Direction: Outbound

 

  Policy: uplink_out

   Classifier: vlan201

     Operator: AND

     Rule(s) :

      If-match service-vlan-id 201

     Behavior: car_vlan201_uplink

      Committed Access Rate:

        CIR 102400 (kbps), CBS 6400000 (Bytes), EBS 0 (Bytes)

        Green action  : pass

        Yellow action : pass

        Red action    : discard

        Green packets : 0 (Packets)

        Red packets   : 0 (Packets)

   Classifier: vlan202

     Operator: AND

     Rule(s) :

      If-match service-vlan-id 202

     Behavior: car_vlan202_uplink

      Committed Access Rate:

        CIR 61440 (kbps), CBS 3840000 (Bytes), EBS 0 (Bytes)

        Green action  : pass

        Yellow action : pass

        Red action    : discard

        Green packets : 0 (Packets)

        Red packets   : 0 (Packets)

   Classifier: vlan203

     Operator: AND

     Rule(s) :

      If-match service-vlan-id 203

     Behavior: car_vlan203_uplink

      Committed Access Rate:

        CIR 40960 (kbps), CBS 2560000 (Bytes), EBS 0 (Bytes)

        Green action  : pass

        Yellow action : pass

        Red action    : discard

        Green packets : 0 (Packets)

        Red packets   : 0 (Packets)

4.6  配置文件

#

traffic classifier vlan203_downlink operator and

 if-match service-vlan-id 1003

traffic classifier vlan1002 operator and

 if-match customer-vlan-id 1002

traffic classifier vlan201 operator and

 if-match service-vlan-id 201

traffic classifier vlan1003 operator and

 if-match customer-vlan-id 1003

traffic classifier vlan203 operator and

 if-match service-vlan-id 203

traffic classifier vlan201_c operator and

 if-match service-vlan-id 201

traffic classifier vlan201_downlink operator and

 if-match service-vlan-id 1001

traffic classifier vlan202_c operator and

 if-match service-vlan-id 202

traffic classifier vlan202_downlink operator and

 if-match service-vlan-id 1002

traffic classifier vlan202 operator and

 if-match service-vlan-id 202

traffic classifier vlan1001 operator and

 if-match customer-vlan-id 1001

traffic classifier vlan203_c operator and

 if-match service-vlan-id 203

#

traffic behavior car_vlan201_downlink

 car cir 409600 cbs 25600000 ebs 0 green pass red discard yellow pass

traffic behavior car_vlan202_downlink

 car cir 204800 cbs 12800000 ebs 0 green pass red discard yellow pass

traffic behavior car_vlan203_downlink

 car cir 204800 cbs 12800000 ebs 0 green pass red discard yellow pass

traffic behavior car_vlan201_uplink

 car cir 102400 cbs 6400000 ebs 0 green pass red discard yellow pass

traffic behavior car_vlan202_uplink

 car cir 61440 cbs 3840000 ebs 0 green pass red discard yellow pass

traffic behavior car_vlan203_uplink

 car cir 40960 cbs 2560000 ebs 0 green pass red discard yellow pass

traffic behavior 1002_to_202

 remark service-vlan-id 202

traffic behavior 201_to_1001

 remark customer-vlan-id 1001

traffic behavior 1003_to_203

 remark service-vlan-id 203

traffic behavior 203_to_1003

 remark customer-vlan-id 1003

traffic behavior 202_to_1002

 remark customer-vlan-id 1002

traffic behavior 1001_to_201

 remark service-vlan-id 201

#

qos policy uplink_in

 classifier vlan201 behavior car_vlan201_uplink

 classifier vlan202 behavior car_vlan202_uplink

 classifier vlan203 behavior car_vlan203_uplink

qos policy uplink_out

 classifier vlan201 behavior car_vlan201_uplink

 classifier vlan202 behavior car_vlan202_uplink

 classifier vlan203 behavior car_vlan203_uplink

qos policy downlink_in

 classifier vlan1001 behavior 1001_to_201

 classifier vlan1002 behavior 1002_to_202

 classifier vlan1003 behavior 1003_to_203

 classifier vlan201 behavior car_vlan201_downlink

 classifier vlan202 behavior car_vlan202_downlink

 classifier vlan203 behavior car_vlan203_downlink

qos policy qos_c

 classifier vlan201_c behavior car_vlan201_downlink

 classifier vlan202_c behavior car_vlan202_downlink

 classifier vlan203_c behavior car_vlan203_downlink

qos policy downlink_out

 classifier vlan201 behavior 201_to_1001

 classifier vlan202 behavior 202_to_1002

 classifier vlan203 behavior 203_to_1003

 classifier vlan201_downlink behavior car_vlan201_downlink

 classifier vlan202_downlink behavior car_vlan202_downlink

 classifier vlan203_downlink behavior car_vlan203_downlink

#

interface Ten-GigabitEthernet1/0/1

 port link-mode bridge

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 201 to 203 1001 to 1003

 qinq enable

 qos apply policy downlink_in inbound

 qos apply policy downlink_out outbound

#

interface Ten-GigabitEthernet1/0/2

 port link-mode bridge

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 201 to 203 1001 to 1003

 qinq enable

 qos apply policy downlink_in inbound

 qos apply policy downlink_out outbound

#

interface Ten-GigabitEthernet1/0/3

 port link-mode bridge

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 201 to 203

 qos apply policy qos_c inbound

 qos apply policy qos_c outbound

#

interface Ten-GigabitEthernet1/0/10

 port link-mode bridge

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 201 to 203

 qos apply policy uplink_in inbound

 qos apply policy uplink_out outbound

5  聚合CAR典型配置举例

5.1  组网需求

如图5所示，某企业内部包含研发和市场两大部门，其中，研发部又分成研发部一部和研发部二部，各部门通过Device设备接入Internet。现企业要求在Device上配置聚合CAR功能对研发部访问Internet的总带宽进行限速，上行和下行的带宽都不能超过10M。

图5 聚合CAR配置组网图

 

 

5.2  配置思路

为了实现研发部访问Internet的上行和下行带宽都不超过10Mbps，可以在研发部与Device连接的两个端口XGE1/0/1的出入方向上分别配置聚合CAR对上下行流量进行监管。

5.3  配置步骤

(1)     配置上行方向聚合CAR

# 配置ACL规则，匹配上行流量的源IP地址。

<Device> system-view

[Device] acl basic 2000

[Device-acl-ipv4-basic-2000] rule permit source 192.168.1.0 0.0.0.255

[Device-acl-ipv4-basic-2000] rule permit source 192.168.2.0 0.0.0.255

[Device-acl-ipv4-basic-2000] quit

# 配置类，引用ACL。

[Device] traffic classifier uplink

[Device-classifier-uplink] if-match acl 2000

[Device-classifier-uplink] quit

# 配置聚合CAR，流量带宽为10Mbps。

[Device] qos car uplink aggregative cir 10240

# 配置流行为，在流行为中引用聚合CAR。

[Device] traffic behavior uplink

[Device-behavior-uplink] car name uplink

[Device-behavior-uplink] quit

# 配置QoS策略。

[Device] qos policy uplink

[Device-qospolicy-uplink] classifier uplink behavior uplink

[Device-qospolicy-uplink] quit

# 将策略应用在端口XGE1/0/1的出方向上。

[Device] interface ten-GigabitEthernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] qos apply policy uplink outbound

[Device-Ten-GigabitEthernet1/0/1] quit

(2)     配置下行方向聚合CAR

# 配置ACL规则，匹配下行流量的目的IP地址。

[Device] acl advanced 3000

[Device-acl-ipv4-adv-3000] rule permit ip destination 192.168.1.0 0.0.0.255

[Device-acl-ipv4-adv-3000] rule permit ip destination 192.168.2.0 0.0.0.255

[Device-acl-ipv4-adv-3000] quit

# 配置类，引用ACL。

[Device] traffic classifier downlink

[Device-classifier-downlink] if-match acl 3000

[Device-classifier-downlink] quit

# 配置聚合CAR，流量带宽为10Mbps。

[Device] qos car downlink aggregative cir 10240

# 配置流行为，在流行为中引用聚合CAR。

[Device] traffic behavior downlink

[Device-behavior-downlink] car name downlink

[Device-behavior-downlink] quit

# 配置QoS策略。

[Device] qos policy downlink

[Device-qospolicy-downlink] classifier downlink behavior downlink

[Device-qospolicy-downlink] quit

# 将策略应用在端口XGE1/0/1的入方向上。

[Device] interface ten-GigabitEthernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] qos apply policy downlink inbound

[Device-Ten-GigabitEthernet1/0/1] quit

5.4  验证配置

# 执行display qos policy interface命令查看端口上QoS策略的应用状态。

[Device] display qos policy interface

Interface: Ten-GigabitEthernet1/0/1

  Direction: Inbound

  Policy: downlink

   Classifier: downlink

     Operator: AND

     Rule(s) :

      If-match acl 3000

     Behavior: downlink

      Committed Access Rate:

        Car name: downlink

 

Interface: Ten-GigabitEthernet1/0/1

  Direction: Outbound

  Policy: uplink

   Classifier: uplink

     Operator: AND

     Rule(s) :

      If-match acl 2000

     Behavior: uplink

      Committed Access Rate:

        Car name: uplink

5.5  配置文件

#

 qos car downlink aggregative cir 10240 cbs 640000 ebs 0 green pass red discard yellow pass

 qos car uplink aggregative cir 10240 cbs 640000 ebs 0 green pass red discard yellow pass

#

traffic classifier downlink operator and

 if-match acl 3000

#

traffic classifier uplink operator and

 if-match acl 2000

#

traffic behavior downlink

 car name downlink

#

traffic behavior uplink

 car name uplink

#

qos policy downlink

 classifier downlink behavior downlink

#

qos policy uplink

 classifier uplink behavior uplink

#

interface Ten-GigabitEthernet1/0/1

 port link-mode bridge

 qos apply policy downlink inbound

 qos apply policy uplink outbound

#

acl basic 2000

 rule 0 permit source 192.168.1.0 0.0.0.255

 rule 5 permit source 192.168.2.0 0.0.0.255

#

acl advanced 3000

 rule 0 permit ip destination 192.168.1.0 0.0.0.255

 rule 5 permit ip destination 192.168.2.0 0.0.0.255

6  相关资料

·     H3C S7500X系列交换机 ACL和QoS配置指导-R758X

·     H3C S7500X系列交换机 ACL和QoS命令参考-R758X