- Table of Contents
-
- 09-Configuration Examples
- 01-Web Login Configuration Examples
- 02-Internet Access Through a Static IP Address Configuration Examples
- 03-Internet access through PPPoE configuration examples
- 04-License Configuration Examples
- 05-Signature Library Upgrade Configuration Examples
- 06-Software Upgrade Examples
- 06-Software Upgrade Examples (only for F50X0-D and F5000-AK5X5 firewalls)
- 07-Routing deployment configuration examples
- 08-Transparent deployment configuration examples
- 09-Static routing configuration examples
- 10-RIP configuration examples
- 11-OSPF configuration examples
- 12-BGP configuration examples
- 13-Policy-based routing configuration examples
- 14-Security Policy Configuration Examples
- 15-APR-Based Security Policy Configuration Examples
- 16-Object Group Configuration Examples
- 17-User identification configuration examples
- 18-Attack defense configuration examples
- 19-IPCAR Configuration Examples
- 20-IPS Configuration Examples
- 21-URL Filtering Configuration Examples
- 22-Anti-Virus Configuration Examples
- 23-File Filtering Configuration Examples
- 24-Data Filtering Configuration Examples
- 25-WAF Configuration Examples
- 26-IP Reputation Configuration Examples
- 27-APT Defense Configuration Examples
- 28-NetShare Control Configuration Examples
- 29-Bandwidth Management Configuration Examples
- 30-IPsec configuration examples
- 31-SSL VPN IP access configuration examples
- 31-SSL VPN TCP access configuration examples
- 31-SSL VPN Web access configuration examples
- 32-L2TP Configuration Examples
- 33-NAT configuration examples
- 34-NPTv6 Configuration Examples
- 35-Policy-based NAT configuration examples
- 36-NAT hairpin configuration examples
- 37-NAT Flow Logging Configuration Examples
- 38-Inbound Link Load Balancing Configuration Examples
- 39-Outbound Link Load Balancing Configuration Examples
- 40-Server Load Balancing Configuration Examples
- 41-Transparent DNS Proxy Configuration Examples
- 42-High Availability Group Configuration Examples
- 43-Context Configuration Examples
- 43-Context Configuration Examples(only for F50X0-D and F5000-AK5X5 firewalls)
- 44-IRF configuration examples
- 44-IRF configuration examples(only for F50X0-D and F5000-AK5X5 firewalls)
- 45-DHCP configuration examples
- 46-DNS configuration examples
- 47-Server Connection Detection Configuration Examples
- 48-Connection Limit Configuration Examples
- 49-Public key management configuration examples
- 50-SSL Decryption Configuration Examples
- 51-MAC Address Learning Through a Layer 3 Device Configuration Examples
- 52-4G Configuration Examples
- 53-WLAN Configuration Examples
- Related Documents
-
Title | Size | Download |
---|---|---|
29-Bandwidth Management Configuration Examples | 599.01 KB |
Bandwidth management configuration examples
Contents
· Example: Configuring a single traffic profile
· Example: Configuring parent/child traffic profiles
· Example: Configuring a user-based traffic profile
The following information provides bandwidth management configuration examples.
Bandwidth management provides fine-grained control over traffic that flows through the device by using the following information:
· Source and destination security zones.
· Source and destination IP addresses.
· Users and user groups.
· Applications and application groups.
· DSCP priorities.
· Time ranges.
This document is not restricted to specific software or hardware versions. Procedures and information in the examples might be slightly different depending on the software or hardware version of the device.
The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.
The following information is provided based on the assumption that you have basic knowledge of bandwidth management.
When you configure bandwidth management, follow these restrictions and guidelines:
· Traffic policies support nesting, and can be nested for up to four levels.
· The maximum bandwidth for a child traffic policy must be smaller than or equal to that for its parent traffic policy.
· The guaranteed bandwidth for a child traffic policy must be smaller than or equal to that for its parent traffic policy.
· The traffic profiles cannot be the same for the child and parent traffic policies.
· An interface with small default expected bandwidth might experience traffic loss if the following conditions exist:
○ There is a large amount of traffic on the interface.
○ The interface uses the default expected bandwidth.
To avoid traffic loss, implicitly set the expected bandwidth to a large value for such an interface. For example, you can set the expected bandwidth of a tunnel interface to a value greater than 64 kbps (the default) if there is a large amount of traffic on the interface.
· If a traffic policy to be copied has child traffic policies, only the parent traffic policy is copied.
Example: Configuring a single traffic profile
Network configuration
As shown in Figure 1, configure bandwidth management on the device to meet the following requirements:
· The maximum bandwidth is limited to 30 Mbps for both upstream and downstream iQiYiPPS application traffic of the host in the intranet.
· The guaranteed bandwidth is 30 Mbps for both upstream and downstream FTP traffic of the host .
· The bandwidth of the interface to the Internet is limited to 100 Mbps.
Software versions used
This configuration example was created and verified on R8860 of the F1000-AI-55 device.
Procedure
1. Assign IP addresses to interfaces and add the interfaces to security zones.
# On the top navigation bar, click Network.
# From the navigation pane, select Interface Configuration > Interfaces.
# Click the Edit icon for GE 1/0/1.
# In the dialog box that opens, configure the interface:
¡ Select the Trust security zone.
¡ On the IPv4 Address tab, enter the IP address and mask of the interface. In this example, enter 10.1.1.1/24.
¡ Use the default settings for other parameters.
¡ Click OK.
# Add GE 1/0/2 to the Untrust security zone and set its IP address to 20.1.1.1./24 in the same way you configure GE 1/0/1.
2. Configure security policies.
# On the top navigation bar, click Policies.
# From the navigation pane, select Security Policies > Security Policies.
# Click Create.
# In the dialog box that opens, configure a security policy:
¡ Enter policy name Trust-Untrust.
¡ Select source zone Trust.
¡ Select destination zone Untrust.
¡ Enter source IPv4 address 10.1.1.2/24.
¡ Select action Permit.
¡ Use the default settings for other parameters.
¡ Click OK.
3. Configure traffic profiles.
# On the top navigation bar, click Policies.
# From the navigation pane, select Bandwidth Management > Traffic Profiles.
# Click Create.
# In the dialog box that opens, create a traffic profile named aiqiyi as shown in Figure 2.
Figure 2 Creating a traffic profile named aiqiyi
# Click OK.
# Create a traffic profile named profileftp in the same way you create traffic profile aiqiyi, as shown in Figure 3.
Figure 3 Creating a traffic profile named profileftp
# Click OK.
4. Configure traffic policies.
# On the top navigation bar, click Policies.
# From the navigation pane, select Bandwidth Management > Traffic Policies.
# Click Create.
# In the dialog box that opens, create a traffic policy named aiqiyi, as shown in Figure 4.
Figure 4 Creating a traffic policy named aiqiyi
Figure 5 Creating a traffic policy named aiqiyi (continued)
# Click OK.
# After creating the traffic policy, select the policy and click Enable to enable the policy.
# Create a traffic policy FTP in the same way you create traffic policy aiqiyi, as shown in Figure 6.
Figure 6 Creating a traffic policy named FTP
# Click OK.
# After creating the traffic policy, select the policy and click Enable to enable the policy.
5. Configure interface bandwidth.
# On the top navigation bar, click Policies.
# From the navigation pane, select Bandwidth Management > Interface Bandwidth.
# Click Create.
# In the dialog box that opens, configure interface bandwidth as shown in Figure 7.
Figure 7 Configuring interface bandwidth
# Click OK.
Verifying the configuration
# Verify that the iQiYiPPS application traffic rate cannot exceed 30 Mbps and the FTP traffic rate can reach a minimum of 30 Mbps when the total traffic rate on GigabitEthernet 1/0/2 reaches 100 Mbps.
Network configuration
As shown in Figure 8, configure bandwidth management on the device to meet the following requirements:
· The maximum bandwidth is limited to 30 Mbps for both upstream and downstream iQiYiPPS application traffic of the host in the intranet.
· The guaranteed bandwidth is 30 Mbps for both upstream and downstream FTP traffic of the host .
· The total traffic rate of the host is limited to 50 Mbps.
Software versions used
This configuration example was created and verified on R8860 of the F1000-AI-55 device.
Procedure
1. Assign IP addresses to interfaces and add the interfaces to security zones.
# On the top navigation bar, click Network.
# From the navigation pane, select Interface Configuration > Interfaces.
# Click the Edit icon for GE 1/0/1.
# In the dialog box that opens, configure the interface:
a. Select the Trust security zone.
b. On the IPv4 Address tab, enter the IP address and mask of the interface. In this example, enter 10.1.1.1/24.
c. Click OK.
# Add GE 1/0/2 to the Untrust security zone and set its IP address to 20.1.1.1./24 in the same way you configure GE 1/0/1.
2. Configure security policies.
# On the top navigation bar, click Policies.
# From the navigation pane, select Security Policies > Security Policies.
# Click Create.
# In the dialog box that opens, configure a security policy:
¡ Enter policy name Trust-Untrust.
¡ Select source zone Trust.
¡ Select destination zone Untrust.
¡ Select action Permit.
¡ Enter source IPv4 address 10.1.1.2/24.
# Click OK.
3. Configure traffic profiles.
# On the top navigation bar, click Policies.
# From the navigation pane, select Bandwidth Management > Traffic Profiles.
# Click Create.
# In the dialog box that opens, configure a traffic profile as shown in Figure 9.
Figure 9 Creating a traffic profile named profile
# Click OK.
# Create a traffic profile named aiqiyi in the same way you create the traffic profile named profile, as shown in Figure 10.
Figure 10 Creating a traffic profile named aiqiyi
# Click OK.
# Create a traffic profile named profileftp in the same way you create the traffic profile named profile, as shown in Figure 11.
Figure 11 Creating a traffic profile named profileftp
# Click OK.
4. Configure the parent traffic policy.
# On the top navigation bar, click Policies.
# From the navigation pane, select Bandwidth Management > Traffic Policies.
# Click Create.
# In the dialog box that opens, create a traffic policy named policy as shown in Figure 12.
Figure 12 Creating a traffic policy named policy
Figure 13 Creating a traffic policy named policy (continued)
# Click OK.
# After creating the traffic policy, select the policy and click Enable to enable the policy.
5. Configure child traffic policies.
# On the top navigation bar, click Policies.
# From the navigation pane, select Bandwidth Management > Traffic Policies.
# Click Create.
# In the dialog box that opens, create a traffic policy named aiqiyi as shown in Figure 14.
Figure 14 Creating a traffic policy named aiqiyi
Figure 15 Creating a traffic policy named aiqiyi (continued)
# Click OK.
# After creating the traffic policy, select the policy and click Enable to enable the policy.
# Create a traffic policy named FTP in the same way you create the traffic policy named policy, as shown in Figure 16.
Figure 16 Creating a traffic policy named FTP
Figure 17 Creating a traffic policy named FTP (continued)
# Click OK.
# After creating the traffic policy, select the policy and click Enable to enable the policy.
Verifying the configuration
# Verify that the total traffic rate of the host is limited to 50 Mbps, and that the iQiYiPPS application traffic rate is limited to 30 Mbps. When congestion occurs, bandwidth of 30 Mbps is guaranteed for FTP traffic.
Network configuration
As shown in Figure 18, an intranet has two user groups: a teacher group with two teachers and a student group with five students.
Configure per-user bandwidth management on the device to meet the following requirements:
· The bandwidth is limited to 10 Mbps for each teacher in both the upstream and downstream directions, and the bandwidth is limited to 2 Mbps for each student in both the upstream and downstream directions.
· Teachers have higher priority over students to access the Internet.
Software versions used
This configuration example was created and verified on R8860 of the F1000-AI-55 device.
Procedure
1. Assign IP addresses to interfaces and add the interfaces to security zones.
# On the top navigation bar, click Network.
# From the navigation pane, select Interface Configuration > Interfaces.
# Click the Edit icon for GE 1/0/1.
# In the dialog box that opens, configure the interface:
a. Select the Trust security zone.
b. On the IPv4 Address tab, enter the IP address and mask of the interface. In this example, enter 10.1.1.1/24.
c. Click OK.
# Add GE 1/0/2 to the Untrust security zone and set its IP address to 20.1.1.1./24 in the same way you configure GE 1/0/1.
2. Configure security policies.
# On the top navigation bar, click Policies.
# From the navigation pane, select Security Policies > Security Policies.
# Click Create.
# In the dialog box that opens, configure a security policy:
¡ Enter policy name Trust-Untrust.
¡ Select source zone Trust.
¡ Select destination zone Untrust.
¡ Enter source IPv4 address 10.1.1.0/24.
¡ Select action Permit.
# Click OK.
3. Create identity users.
# On the top navigation bar, click Objects.
# From the navigation pane, select User > User Management > Local Users.
# On the User tab, click Create.
# In the dialog box that opens, configure the username as student1.
# Click OK.
# Create users student2, student3, student4, student5, teacher1, and teacher2 in the same way the user student1 is created.
# On the top navigation bar, click Objects.
# From the navigation pane, select User > User Management > Local Users.
# On the User Group tab, click Create.
# In the dialog box that opens, configure the group name as student and configure identity users student1, student2, student3, student4, and student5 for the group.
# Click OK.
# Create a group named teacher and configure identity users teacher1 and teacher2 for the group in the same way the group student is configured.
# On the top navigation bar, click Objects.
# From the navigation pane, select User > User Management > Online Users.
# On the Static Identity Users tab, click Create.
# In the dialog box that opens, configure the username as student1, configure the IP address type as IPv4, and configure the IP address as 10.1.1.11.
# Click OK.
# Create static identity users student2, student3, student4, student5, teacher1, and teacher2 in the same way the static identity user student1 is configured.
# On the top navigation bar, click Objects.
# From the navigation pane, select User > User Management > Online Users.
# On the Online Users tab, click Enable user identification.
4. Configure traffic profiles.
# On the top navigation bar, click Policies.
# From the navigation pane, select Bandwidth Management > Traffic Profiles.
# Click Create.
# In the dialog box that opens, create a traffic profile named profile-teacher as shown in Figure 19.
Figure 19 Creating a traffic profile named profile-teacher
# Click OK.
# Create a traffic profile named profile-student as shown in Figure 20.
Figure 20 Creating a traffic profile named profile-student
# Click OK.
5. Configure traffic policies.
# On the top navigation bar, click Policies.
# From the navigation pane, select Bandwidth Management > Traffic Policies.
# Click Create.
# In the dialog box that opens, create a traffic policy named policy-teacher as shown in Figure 21.
Figure 21 Creating a traffic policy named policy-teacher
Figure 22 Creating a traffic policy named policy-teacher (continued)
# Click OK.
# After creating the traffic policy, select the policy and click Enable to enable the policy.
# Create a traffic policy named policy-student in the same way you create the traffic policy named policy-teacher, as shown in Figure 23.
Figure 23 Creating a traffic policy named policy-student
Figure 24 Creating a traffic policy named policy-student (continued)
# Click OK.
# After creating the traffic policy, select the policy and click Enable to enable the policy.
Verifying the configuration
# Verify that the bandwidth is limited to 10 Mbps for each teacher, and that the bandwidth is limited to 2 Mbps for each student.
# Verify that the connection counts are limited for both students and teachers.