tinajun的博客

QoS策略配置实例

热9已有 140 次阅读 2012-04-27 16:33 标签: 策略配置

最近在看一些文档，发现一些比较有趣的东西，故MARK下来，未知出处，请见谅。待验证。

access-list 110 permit ip 192.168.0.0 0.0.0.255 any
access-list 120 permit ip 192.168.1.0 0.0.0.255 any
class-map match-any premium_class
  match protocol fasttrack      //半分布式P2P系统
  match protocol http
  match protocol icmp
  match protocol napster      //MP3下载软件
  match protocol netshow     //游侠
  match protocol pcanywhere     //远程控制软件
  match protocol realaudio     //即时播音系统
  match protocol streamwork     //ERP软件
  match protocol vdolive     //VDO播放器
  match protocol cuseeme     //网络视频
  match protocol telnet
  match protocol secure-http
  match access-group 110     //高优先级的内网网段，采用NBAR匹配实时性较高的应用
  match ip precedence 5
  match ip precedence 4
  match ip precedence 3
class-map match-any normal_calss
  match protocol ftp
  match protocol imap     //交互式邮件存取协议
  match protocol pop3
  match protocol secure-ftp
  match protocol secure-imap
  match protocol secure-pop3
  match protocol smtp
  match access-group 120     //低优先级内网网段，采用NBAR匹配实时性不强的应用
  match ip precedence 2
  match ip precedence 1
!
policy-map qos_policy_map
  class premium_class
   bandwidth percent 50
   random-detect     //随机检测
   random-detect exponential-weighting-constant 4
   police cir 2000000 bc 10000 be 10000
     conform-action transmit
     exceed-action transmit
  class normal_calss
   bandwidth percent 25
   random-detect
   random-detect exponential-weighting-constant 4
   police cir 2000000 bc 2000 be 2000
     conform-action transmit
     exceed-action drop
！

//在上班时间8:30到18:00禁止BT下载

time-range work
periodic weekdays 8:30 to 18:00

access-list 130 deny   tcp any any range 6881 6890 time-range work
access-list 130 deny   tcp any range 6881 6890 any time-range work
access-list 130 deny   tcp any any range 6969 6979 time-range work
access-list 130 deny   tcp any range 6969 6979 any time-range work
access-list 130 deny   tcp any any range 7000 7100 time-range work
access-list 130 deny   tcp any range 7000 7100 any time-range work
//限制震荡波病毒的端口

access-list 130 deny   tcp any any range 9995 9996
access-list 130 deny   tcp any range 9995 9996 any
access-list 130 deny   tcp any any eq 5554
access-list 130 deny   tcp any eq 5554 any
access-list 130 permit ip any any

interface FastEthernet0/0
ip address 192.168.0.1 255.255.255.0
ip access-group 130 in

interface FastEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip access-group 130 in

interface Serial0/0
rate-limit input 2000000 20000 20000 conform-action transmit exceed-action drop //流量整形
service-policy output qos_policy_map

分享举报