Cabletron Systems SSIM-R8-02 Spécifications télécharger pdf (Page 310)

Using ACLs

290 Enterasys Xpedition User Reference Manual

Using Profile ACLs with the Traffic Rate Limiting Facility

Traffic rate limiting is a mechanism that allows you to control bandwidth usage of

incoming traffic on a per-flow basis. A flow meeting certain criteria can have its packets

re-prioritized or dropped if its bandwidth usage exceeds a specified limit.

For example, you can cause packets in flows from source address 1.2.2.2 to be dropped if

their bandwidth usage exceeds 10 Mbps. You use a Profile ACL to define the selection

criteria (in this case, flows from source address 1.2.2.2). Then you use a rate-limit

command to specify what happens to packets that match the selection criteria (in this

example, drop them if their bandwidth usage exceeds 10 Mbps). The following commands

illustrate this example.

This command creates a Profile ACL called prof2 that uses as its selection criteria all

packets originating from source address 1.2.2.2:

The following command creates a rate limit definition that causes flows matching Profile

ACL prof2’s selection criteria (that is, traffic from 1.2.2.2) to be restricted to 10 Mbps for

each flow. If this rate limit is exceeded, the packets are dropped.

When the rate limit definition is applied to an interface (with the rate-limit apply

interface command), packets in flows originating from source address 1.2.2.2 are dropped

if their bandwidth usage exceeds 10 Mbps.

See Limiting Traffic Rate on page 323 for more information on using the rate-limit

command.

Using Profile ACLs with Dynamic NAT

Network Address Translation (NAT) allows you to map an IP address used within one

network to a different IP address used within another network. NAT is often used to map

addresses used in a private, local intranet to one or more addresses used in the public,

global Internet.

The XP supports two kinds of NAT: static NAT and dynamic NAT. With dynamic NAT, an

IP address within a range of local IP addresses is mapped to an IP address within a range

of global IP addresses. For example, you can configure IP addresses on network

10.1.1.0/24 to use an IP address in the range of IP addresses in network 192.50.20.0/24.

You can use a Profile ACL to define the ranges of local IP addresses.

ssr(config)# acl prof2 permit ip 1.2.2.2

ssr(config)# rate-limit client1 input acl prof2 rate-limit 10000000 exceed-action drop-packets

1 2 ... 305 306 307 308 309 310 311 312 313 314 315 ... 393 394

Pas de commentaire

Cabletron Systems SSIM-R8-02 Spécifications Page 310