当前位置：首页 > article >正文

防火墙带宽管理

article 2025/3/25 13:11:50

拓扑

配置

[fw]interface GigabitEthernet 0/0/0    
[fw-GigabitEthernet0/0/0]service-manage all permit   
[fw]interface GigabitEthernet 1/0/0
[fw-GigabitEthernet1/0/0]ip address 12.0.0.1 24
[fw]interface GigabitEthernet 1/0/1
[fw-GigabitEthernet1/0/1]ip address 13.0.0.1 24
[fw]interface GigabitEthernet 1/0/3
[fw-GigabitEthernet1/0/3]ip address 10.1.1.254 24
[fw]interface GigabitEthernet 1/0/2.1
[fw-GigabitEthernet1/0/2.1]ip address 10.1.1.254 2
[fw-GigabitEthernet1/0/2.1]vlan-type dot1q 10
[fw-GigabitEthernet1/0/2.1]interface GigabitEthernet 1/0/2.2
[fw-GigabitEthernet1/0/2.2]ip address 192.168.2.254 24
[fw-GigabitEthernet1/0/2.2]vlan-type dot1q 20
[fw-GigabitEthernet1/0/2.2]interface GigabitEthernet 1/0/2.3
[fw-GigabitEthernet1/0/2.3]ip address 192.168.3.254 24
[fw-GigabitEthernet1/0/2.3]vlan-type dot1q 30
[fw-GigabitEthernet1/0/2.3]interface GigabitEthernet 1/0/2.4
[fw-GigabitEthernet1/0/2.4]ip address 192.168.4.254 24
[fw-GigabitEthernet1/0/2.4]vlan-type dot1q 40





[fw]firewall zone trust 
[fw-zone-trust]add interface GigabitEthernet 1/0/2.1
[fw-zone-trust]add interface GigabitEthernet 1/0/2.2
[fw-zone-trust]add interface GigabitEthernet 1/0/2.3
[fw-zone-trust]add interface GigabitEthernet 1/0/2.4
[fw]firewall zone dmz 
[fw-zone-dmz]add interface GigabitEthernet 1/0/3
[fw]firewall zone untrust 
[fw-zone-untrust]add interface GigabitEthernet 1/0/1
[fw-zone-untrust]add interface GigabitEthernet 1/0/0




[Huawei]interface GigabitEthernet 0/0/0    
[Huawei-GigabitEthernet0/0/0]ip address 12.0.0.2 24





[liantong]interface GigabitEthernet 0/0/0    
[liantong-GigabitEthernet0/0/0]ip address 13.0.0.3 24





[sw1]vlan batch 10 20 30 40
[sw1-GigabitEthernet0/0/1]port link-type trunk 
[sw1-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20 30 40
[sw1-GigabitEthernet0/0/1]interface GigabitEthernet 0/0/2
[sw1-GigabitEthernet0/0/2]port link-type access 
[sw1-GigabitEthernet0/0/2]port default vlan 10
[sw1-GigabitEthernet0/0/2]interface GigabitEthernet 0/0/3
[sw1-GigabitEthernet0/0/3]port link-type access
[sw1-GigabitEthernet0/0/3]port default vlan 20
[sw1-GigabitEthernet0/0/3]interface GigabitEthernet 0/0/4
[sw1-GigabitEthernet0/0/4]port link-type access
[sw1-GigabitEthernet0/0/4]port default vlan 30
[sw1-GigabitEthernet0/0/4]interface GigabitEthernet 0/0/5
[sw1-GigabitEthernet0/0/5]port link-type access
[sw1-GigabitEthernet0/0/5]port default vlan 40

需求一
企业组织架构中存在部门A，部门A中存在销售组1和研发组2

销售部门--->业务Email、ERP服务

可以对部门A中的销售组进行带宽资源细分，保证销售员工的业务服务流量正常转发：

1、部门A的下行最大带宽不超过60M

2、部门A中的销售组下行最大带宽不超过30M

3、部门A中的销售组的Email、ERP业务下行最小带宽不低于20M

[fw]traffic-policy
[fw-policy-traffic-profile-01]bandwidth maximum-bandwidth whole downstream 60000
[fw-policy-traffic-profile-01]q
[fw-policy-traffic]rule name 01 
[fw-policy-traffic-rule-01]source-zone trust
[fw-policy-traffic-rule-01]destination-zone untrust   
[fw-policy-traffic-rule-01]source-address 192.168.1.0 24 
[fw-policy-traffic-rule-01]source-address 192.168.2.0 24 
[fw-policy-traffic-rule-01]action qos profile 01