Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 320)

20-6

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 20 Applying QoS Policies

Defining a QoS Policy Map

The policy-map command configures various policies, such as security policies or QoS policies. A

policy is an association of a traffic class, specified by a class command, and one or more actions. This

section specifically deals with using the policy-map command to define the QoS policies for one or more

classes of packets.

When you enter a policy-map command you enter the policy-map configuration mode, and the prompt

changes to indicate this. In this mode, you can enter class and description commands. A policy-map

command can specify multiple policies. The maximum number of policy maps is 64.

After entering the policy-map command, you then enter a class command to specify the classification

of the packet traffic. The class command configures QoS policies for the class of traffic specified in the

given class-map. A traffic class is a set of traffic that is identifiable by its packet content. For example,

TCP traffic with a port value of 23 can be classified as a Telnet traffic class. The class commands are

differentiated by their previously named and constructed class-map designations, and the associated

actions follow immediately after.

The security appliance evaluates class-maps in the order in which they were entered in the policy-map

configuration. It classifies a packet to the first class-map that matches the packet.

Note The order in which different types of actions in a policy-map are performed is independent of the order

in which the actions appear in the command descriptions in this document.

The priority command provides low-latency queuing for delay-sensitive traffic, such as voice. This

command selects all packets that match the associated class (TG1-voice in the previous example) and

sends them to the low latency queue for priority processing.

Applying Rate Limiting

Every user’s Bandwidth Limiting Traffic stream (BLT) can participate in maximum bandwidth limiting;

that is, strict policing, which rate-limits the individual user’s default traffic to some maximum rate. This

prevents any one individual user’s BLTs from overwhelming any other. LLQ traffic, however, is marked

and processed downstream in a priority queue. This traffic is not rate-limited.

Policing is a way of ensuring that no traffic exceeds the maximum rate (bits/second) that you configure,

thus ensuring that no one traffic flow can take over the entire resource. You use the police command to

specify the maximum rate (that is, the rate limit for this traffic flow); this is a value in the range

8000-2000000000, specifying the maximum speed (bits per second) allowed.

You also specify what action, drop or transmit, to take for traffic that conforms to the limit and for traffic

that exceeds the limit.

Note You can specify the drop action, but it is not functional. The action is always to transmit, except when

the rate is exceeded, and even then, the action is to throttle the traffic to the maximum allowable speed.

The police command also configures the largest single burst of traffic allowed. A burst value in the range

1000-512000000 specifies the maximum number of instantaneous bytes allowed in a sustained burst

before throttling to the conforming rate value.

1 2 ... 315 316 317 318 319 320 321 322 323 324 325 ... 603 604

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 320