带宽管理配置

实验topo

配置流程

1、带宽通道：整体带宽、每个用户带宽、连接数、优先级信息 
2、带宽策略 
3、策略+通道，引用 
4、配置接口出入带宽

前置条件

SW1划分vlan

[SW1]vlan b 10 20 30 40
[SW1]interface GigabitEthernet 0/0/1
[SW1-GigabitEthernet0/0/1]port link-type trunk 
[SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20 30 40
[SW1-GigabitEthernet0/0/1]int g 0/0/2
[SW1-GigabitEthernet0/0/2]port link-type access 
[SW1-GigabitEthernet0/0/2]port default vlan 10
[SW1-GigabitEthernet0/0/2]int g 0/0/3
[SW1-GigabitEthernet0/0/3]port link-type access 
[SW1-GigabitEthernet0/0/3]port default vlan 20
[SW1-GigabitEthernet0/0/3]int g 0/0/4
[SW1-GigabitEthernet0/0/4]port link-type access
[SW1-GigabitEthernet0/0/4]port default vlan 30
[SW1-GigabitEthernet0/0/4]int g 0/0/5
[SW1-GigabitEthernet0/0/5]port link-type access 
[SW1-GigabitEthernet0/0/5]port default vlan 40

IP配置

[DIAN]int g 0/0/0
[DIAN-GigabitEthernet0/0/0]ip address 12.0.0.2 24

[LIAN]int g 0/0/0
[LIAN-GigabitEthernet0/0/0]ip address 13.0.0.2 24

[FW]int g 1/0/0
[FW-GigabitEthernet1/0/0]ip address 12.0.0.1 24
[FW-GigabitEthernet1/0/0]int g 1/0/1
[FW-GigabitEthernet1/0/1]ip address 13.0.0.1 24
[FW-GigabitEthernet1/0/1]int g 1/0/2.10
[FW-GigabitEthernet1/0/2.10]ip address 192.168.1.254 24
[FW-GigabitEthernet1/0/2.10]interface GigabitEthernet 1/0/2.20
[FW-GigabitEthernet1/0/2.20]ip address 192.168.2.254 24
[FW-GigabitEthernet1/0/2.20]int g 1/0/2.30
[FW-GigabitEthernet1/0/2.30]ip add 192.168.3.254 24
[FW-GigabitEthernet1/0/2.30]int g 1/0/2.40
[FW-GigabitEthernet1/0/2.40]ip add 192.168.4.254 24
[FW-GigabitEthernet1/0/2.40]interface GigabitEthernet 1/0/3
[FW-GigabitEthernet1/0/3]ip add 10.1.1.254 24

路由配置

[FW]ip route-static 0.0.0.0 0 12.0.0.2
[FW]ip route-static 0.0.0.0 0 13.0.0.2

区域划分

[FW]firewall zone untrust 
[FW-zone-untrust]add int g 1/0/0
[FW-zone-untrust]add int g 1/0/1
[FW]firewall zone trust 
[FW-zone-trust]add int g 1/0/2.10
[FW-zone-trust]add int g 1/0/2.20
[FW-zone-trust]add int g 1/0/2.30
[FW-zone-trust]add int g 1/0/2.40
[FW]firewall zone dmz
[FW-zone-dmz]add int g 1/0/3

nat配置

[FW]nat-policy 
[FW-policy-nat]rule name 01
[FW-policy-nat-rule-01]source-zone trust 	
[FW-policy-nat-rule-01]action source-nat easy-ip 

需求一

企业组织架构中存在部门A，部门A中存在销售组1和研发组2
销售部门--->业务Email、ERP服务
可以对部门A中的销售组进行带宽资源细分，保证销售员工的业务服务流量正常转发：
1、部门A的下行最大带宽不超过60M
 2、部门A中的销售组下行最大带宽不超过30M
 3、部门A中的销售组的Email、ERP业务下行最小带宽不低于20M
分析：需求之间存在父子关系
A部门带宽通道---最大60M
部门A销售组带宽通道最大30M
部门A销售组Email业务带宽通道---最小20M

策略一

[FW]traffic-policy                  ---进入带宽策略配置视图
[FW-policy-traffic]profile 01 		---创建一个带宽通道
[FW-policy-traffic-profile-01]bandwidth maximum-bandwidth whole downstream 60000
---设定带宽

[FW-policy-traffic]rule name 01
[FW-policy-traffic-rule-01]source-zone trust
[FW-policy-traffic-rule-01]destination-zone untrust 
[FW-policy-traffic-rule-01]source-address 192.168.1.0 24
[FW-policy-traffic-rule-01]source-address 192.168.2.0 24
[FW-policy-traffic-rule-01]action qos profile 01   ---限流，调用带宽

策略二

销售

[FW-policy-traffic]profile 02
[FW-policy-traffic-profile-02]bandwidth maximum-bandwidth whole downstream 30000
[FW-policy-traffic-profile-02]q
[FW-policy-traffic]rule name 02 parent 01
[FW-policy-traffic-rule-02]source-zone trust 
[FW-policy-traffic-rule-02]destination-zone untrust
[FW-policy-traffic-rule-02]source-address 192.168.1.0 mask 255.255.255.0
[FW-policy-traffic-rule-02]action qos profile 02

策略三

[FW-policy-traffic] profile 03
[FW-policy-traffic-profile-03]  bandwidth guaranteed-bandwidth whole downstream 
20000
[FW-policy-traffic-profile-03]rule name 03 parent 02
[FW-policy-traffic-rule-03]description A_xiaoshou_email
[FW-policy-traffic-rule-03]source-zone trust
[FW-policy-traffic-rule-03]destination-zone untrust
[FW-policy-traffic-rule-03]source-address 192.168.1.0 mask 255.255.255.0
[FW-policy-traffic-rule-03]action qos profile 03

安全策略

[FW]security-policy
[FW-policy-security]rule name 01
[FW-policy-security-rule-01]source-zone trust
[FW-policy-security-rule-01]destination-zone untrust
[FW-policy-security-rule-01]source-address 192.168.1.0 mask 255.255.255.0
[FW-policy-security-rule-01]source-address 192.168.2.0 mask 255.255.255.0
[FW-policy-security-rule-01]action permit

总览

需求二

给部门A和部门B划分可使用的带宽资源。要避免P2P业务占据较多的带宽，还需要限制部门A和部门B使用
P2P业务的带宽总和。
1、部门A下行最大带宽60M
2、部门B下行最大带宽40M
3、部门A和部门B的P2P业务下行最大带宽不超过80M
4、P2P流量需要计算到各自部门的总流量中

限制P2P

[FW]traffic-policy
[FW-policy-traffic]profile 05_P2P
[FW-policy-traffic-profile-05_P2P]bandwidth reference-mode rule-shared
[FW-policy-traffic-profile-05_P2P]bandwidth maximum-bandwidth whole downstream 80000

[FW-policy-traffic]rule name 05 parent 01
[FW-policy-traffic-rule-05]description A_P2P
[FW-policy-traffic-rule-05]source-zone trust
[FW-policy-traffic-rule-05]destination-zone untrust
[FW-policy-traffic-rule-05]source-address 192.168.1.0 mask 255.255.255.0
[FW-policy-traffic-rule-05]source-address 192.168.2.0 mask 255.255.255.0
[FW-policy-traffic-rule-05]application app Oracle_MySQL
[FW-policy-traffic-rule-05]rule name 04
[FW-policy-traffic-rule-04]description B
[FW-policy-traffic-rule-04]source-zone trust
[FW-policy-traffic-rule-04]destination-zone untrust
[FW-policy-traffic-rule-04]source-address 192.168.3.0 mask 255.255.255.0
[FW-policy-traffic-rule-04]source-address 192.168.4.0 mask 255.255.255.0
[FW-policy-traffic-rule-04]action qos profile 04
 Error: The specified object 04 does not exist.
[FW-policy-traffic-rule-04]rule name 06 parent 04
[FW-policy-traffic-rule-06]description B_P2P
[FW-policy-traffic-rule-06]source-zone trust
[FW-policy-traffic-rule-06]destination-zone untrust
[FW-policy-traffic-rule-06]source-address 192.168.3.0 mask 255.255.255.0
[FW-policy-traffic-rule-06]source-address 192.168.4.0 mask 255.255.255.0
[FW-policy-traffic-rule-06]application app Oracle_MySQL
[FW-policy-traffic-rule-06]action qos profile 05_P2P

需求三

在不影响正常用户上网和web服务器正常提供对外服务的情况下，实现以下功能
1、将从ISP购买的100M带宽进行划分
上网高峰期（工作日下午3点-6点），上网用户下行带宽60M(U-T)，外用用户下行带宽40M(D-U)
2、2台Web服务器，限制每一台Web服务器对外提供的最大下行带宽不超过20M
3、假设，总共30个上网用户，在上网高峰期，限制每个用户访问Internet的最大下行带宽不超过2M

[FW-policy-traffic]profile 06
[FW-policy-traffic-profile-06]bandwidth maximum-bandwidth whole downstream 60000
[FW-policy-traffic-profile-06]bandwidth maximum-bandwidth per-ip downstream 2000
[FW-policy-traffic-profile-06]rule name 07
[FW-policy-traffic-rule-07]source-zone trust
[FW-policy-traffic-rule-07]destination-zone untrust
[FW-policy-traffic-rule-07]source-address 192.168.0.0 mask 255.255.0.0
[FW-policy-traffic-rule-07]time-range time_01
[FW-policy-traffic-rule-07]action qos profile 06

[FW-policy-traffic]profile 07
[FW-policy-traffic-profile-07]bandwidth maximum-bandwidth whole downstream 40000
[FW-policy-traffic-profile-07]bandwidth maximum-bandwidth per-ip downstream 2000
0
[FW-policy-traffic-profile-07]rule name 08
[FW-policy-traffic-rule-08]source-zone untrust
[FW-policy-traffic-rule-08]destination-zone dmz
[FW-policy-traffic-rule-08]destination-address 10.1.1.0 mask 255.255.255.0
[FW-policy-traffic-rule-08]action qos profile 07

需求四

部门A的上网用户数量不固定，为了让用户公平的使用带宽，根据实际在线上网用户数量，平均分配带宽
1、部门A的下行最大带宽60M
2、根据实时的上网用户数量，对部门A的60M带宽资源进行均分

动态均分功能：在配置了整体最大带宽的前提下，FW根据在线IP/用户的个数和带宽使用率，动态的对每一个IP/用户能够使用的最大带宽进行平均分配。
计算方式：每个IP/用户最大带宽=MAX(带宽最小值，整体最大带宽/IP用户数*平均分配系数)

平均分配系数—与带宽使用率存在反比关系
0
＜70%
1
2
3
4

[FW-policy-traffic]profile 08
[FW-policy-traffic-profile-08]  bandwidth maximum-bandwidth whole downstream 600
00
[FW-policy-traffic-profile-08]  bandwidth average per-ip manual multiplier 1 min
imum 1000
Mar  5 2025 08:34:05 FW DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.
1 configurations have been changed. The current change number is 125, the change
 loop count is 0, and the maximum number of records is 4095.
[FW-policy-traffic-profile-08]  bandwidth average per-ip manual multiplier 1 min
imum 1000

[FW-policy-traffic]rule name 09
[FW-policy-traffic-rule-09]
Mar  5 2025 08:37:15 FW DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.
1 configurations have been changed. The current change number is 127, the change
 loop count is 0, and the maximum number of records is 4095.
[FW-policy-traffic-rule-09]source-zone trust
[FW-policy-traffic-rule-09]  destination-zone untrust
[FW-policy-traffic-rule-09]  source-address 192.168.1.0 mask 255.255.255.0
[FW-policy-traffic-rule-09]  source-address 192.168.2.0 mask 255.255.255.0
[FW-policy-traffic-rule-09]  action qos profile 08

需求五

电信购买带宽100M
联通购买带宽50M

电信

联通

需求六

运营商—>流量套餐—>对中小企业500G/月，超出部分，额外计费，1G/100元。
限额—>每一个员工规定上网时长
1、员工40人，10名管理人员+30名牛马
高管–>20G/月
牛马–>10G/月
2、牛马—>4h/日，流量500M/日
3、超额后限制
牛马—>禁止上网
高管—>超过配额后最大带宽限定为800K

牛马

[FW]quota-policy   
[FW-policy-quota]profile niuma 
[FW-policy-quota-profile-niuma]stream-daily 500     
[FW-policy-quota-profile-niuma]stream-monthly 10240        
[FW-policy-quota-profile-niuma]time-daily 240     
[FW-policy-quota-profile-niuma]limit-bandwidth 0  

[FW-policy-quota]rule name niuma
[FW-policy-quota-rule-niuma]user user-group /default/niuma   
[FW-policy-quota-rule-niuma]action quota profile niuma

高管