Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 321)

20-7

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 20 Applying QoS Policies

Applying Rate Limiting

Note Policing is applied only in the output direction.

You cannot enable both priority and policing together.

If a service policy is applied or removed from an interface that has existing VPN client/LAN-to-LAN or

non-tunneled traffic already established, the QoS policy is not applied or removed from the traffic

stream. To apply or remove the QoS policy for such connections, you must clear (that is, drop) the

connections and re-establish them.

Note When policing is specified in the default class map, class-default, the police values of class-default are

applied to the aggregated LAN-to-LAN VPN flow if there is no police command defined for

tunnel-group of LAN-to-LAN VPN. In other words, the policing values of class-default are never applied

to the individual flow of a LAN-to-LAN VPN that exists before encryption.

The following example builds on the configuration developed in the previous section. As in the previous

example, there are two named class-maps: tcp_traffic and TG1-voice. Adding a third class-map:

hostname# class-map TG1-best-effort

hostname(config-cmap)# match tunnel-group Tunnel-Group-1

hostname(config-cmap)# match flow ip destination-address

provides a basis for defining a tunneled and non-tunneled QoS policy, as follows, which creates a simple

QoS policy for tunneled and non-tunneled traffic, assigning packets of the class TG1-voice to the low

latency queue and setting rate limits on the tcp_traffic and TG1-best-effort traffic flows.

Note “Best effort” does not guarantee reliable packet delivery, in that it does not use a sophisticated

acknowledgement system. It does, however, make a “best effort” to deliver packets to the destination.

In this example, the maximum rate for traffic of the tcp_traffic class is 56000 bits/second and a maximum

burst size of 10500 bytes per second. For the TC1-BestEffort class, the maximum rate is 200000

bits/second, with a maximum burst of 37500 bytes/second. Traffic in the TC1-voice class has no policed

maximum speed or burst rate because it belongs to a priority class:

hostname# policy-map qos

hostname (config-pmap)# class tcp_traffic

hostname (config-pmap-c)# police outside 56000 10500

hostname (config-pmap-c)# class TG1-voice

hostname (config-pmap-c)# priority

hostname (config-pmap-c)# class TG1-best-effort

hostname (config-pmap-c)# police outside 200000 37500

hostname (config-pmap-c)# class class-default

hostname (config-pmap-c)# police outside 1000000 37500

Note You can have up to 256 policy-maps, and up to 256 classes in a policy map. The maximum number of

classes in all policy maps together is 256. For any class-map, you can have only one match statement

associated with it, with the exception of a tunnel class. For a tunnel class, an additional match

tunnel-group statement is allowed.

Note The class class-default always exists. It does not need to be declared.

1 2 ... 316 317 318 319 320 321 322 323 324 325 326 ... 603 604

Brak uwag

Cisco PIX 525 Dokumentacja Strona 321