Уважаемые коллеги !!
Помогите с решением проблемы.
Прошу сильно не ругаться, весь форум перерыл - не нашел...
Имеется:
Сервер с установленной UTM 5 -2.1.006, ос FreeBSD 7.
Роутер, NAT, NAS - Cisco 7301
Ограничение скорости на дезлимитных ТП осуществляется передачей радиус-параметров вида:
Vendor = 9
Attr = 1
Значение = lcp:interface-config#1=rate-limit input 64000 12000 24000 conform-action transmit exceed-action drop
Задача :
Организовать изменение скорости (для разных хитрых ТП типа день/ночь и т.д.).
Нужно как-то менять радиус-параметры в текущей услуге IP-трафика, либо подменять абоненту услугу, с другими значениями скорости...
Подскажите, в какую сторону копать, и с помощью чего такое можно реализовать.
Заранее благодарен за любые ответы.
Как менять скорость канала на Cisco ?
Time based ACL (Cisco)
Router01(config)#time-range night
Router01(config-time-range)#periodic daily 20:00 to 08:00
Router01(config-time-range)#periodic daily 12:00 to 13:00
Router01(config)#access-list 135 permit ip any any time-range night
Router01(config)#time-range day
Router01(config-time-range)#periodic daily 08:00 to 11:59
Router01(config-time-range)#periodic daily 13:01 to 20:00
Router01(config)#access-list 136 permit ip any any time-range day
int s6/1
rate-limit input access-group 136 512000 128000 128000 conform-action transmit exceed-action drop
rate-limit output access-group 136 512000 128000 128000 conform-action transmit exceed-action drop
rate-limit input access-group 135 1024000 128000 128000 conform-action transmit exceed-action drop
rate-limit output access-group 135 1024000 128000 128000 conform-action transmit exceed-action drop
Выставляем только несколько вышеуказанных аттрибутов rate-limit в конфигурации radius параметров тарифного плана. Пока идею не проверял, но должно работать)
Проверьте, если работает надо бы в faq добавить. Ситуация то весьма актуальная.
Router01(config-time-range)#periodic daily 20:00 to 08:00
Router01(config-time-range)#periodic daily 12:00 to 13:00
Router01(config)#access-list 135 permit ip any any time-range night
Router01(config)#time-range day
Router01(config-time-range)#periodic daily 08:00 to 11:59
Router01(config-time-range)#periodic daily 13:01 to 20:00
Router01(config)#access-list 136 permit ip any any time-range day
int s6/1
rate-limit input access-group 136 512000 128000 128000 conform-action transmit exceed-action drop
rate-limit output access-group 136 512000 128000 128000 conform-action transmit exceed-action drop
rate-limit input access-group 135 1024000 128000 128000 conform-action transmit exceed-action drop
rate-limit output access-group 135 1024000 128000 128000 conform-action transmit exceed-action drop
Выставляем только несколько вышеуказанных аттрибутов rate-limit в конфигурации radius параметров тарифного плана. Пока идею не проверял, но должно работать)
Проверьте, если работает надо бы в faq добавить. Ситуация то весьма актуальная.
единственное я не понял, это вешается на интерфейс чтоль? или в параметрах радиуса указывается в тарифных планах?int s6/1
rate-limit input access-group 136 512000 128000 128000 conform-action transmit exceed-action drop
rate-limit output access-group 136 512000 128000 128000 conform-action transmit exceed-action drop
rate-limit input access-group 135 1024000 128000 128000 conform-action transmit exceed-action drop
rate-limit output access-group 135 1024000 128000 128000 conform-action transmit exceed-action drop
вешается в параметрах радиуса. Я на интерфейсе сначала тестил. Потом через радиус.
Для нетапа у меня настройки на один тариф такие:
lcp:interface-config#1=rate-limit output access-group 170 256000 32000 32000 conform-action transmit exceed-action drop
lcp:interface-config#1=rate-limit input access-group 170 256000 32000 32000 conform-action transmit exceed-action drop
lcp:interface-config#1=rate-limit output access-group 171 512000 64000 64000 conform-action transmit exceed-action drop
lcp:interface-config#1=rate-limit input access-group 171 512000 64000 64000 conform-action transmit exceed-action drop
Для нетапа у меня настройки на один тариф такие:
lcp:interface-config#1=rate-limit output access-group 170 256000 32000 32000 conform-action transmit exceed-action drop
lcp:interface-config#1=rate-limit input access-group 170 256000 32000 32000 conform-action transmit exceed-action drop
lcp:interface-config#1=rate-limit output access-group 171 512000 64000 64000 conform-action transmit exceed-action drop
lcp:interface-config#1=rate-limit input access-group 171 512000 64000 64000 conform-action transmit exceed-action drop
РЕЖИМ ДЕНЬ:
GAZTEL#sh users | in test3
Vi88 test3 PPPoE 00:00:00 10.11.2.99
GAZTEL#sh time
time-range entry: day (active)
periodic daily 8:00 to 12:30
periodic daily 13:30 to 21:00
used in: IP ACL entry
time-range entry: night (inactive)
periodic daily 21:00 to 23:59
periodic daily 0:00 to 8:00
periodic daily 12:30 to 13:30
used in: IP ACL entry
GAZTEL#sh int vi88 rat
GAZTEL#sh int vi88 rate-limit
Virtual-Access88
Input
matches: access-group 170
params: 256000 bps, 32000 limit, 32000 extended limit
conformed 3269 packets, 663366 bytes; action: transmit
exceeded 2 packets, 2037 bytes; action: drop
last packet: 6288ms ago, current burst: 0 bytes
last cleared 00:09:51 ago, conformed 8000 bps, exceeded 0 bps
matches: access-group 171
params: 512000 bps, 64000 limit, 64000 extended limit
conformed 0 packets, 0 bytes; action: transmit
exceeded 0 packets, 0 bytes; action: drop
last packet: 2302253188ms ago, current burst: 0 bytes
last cleared 00:09:51 ago, conformed 0 bps, exceeded 0 bps
Output
matches: access-group 170
params: 256000 bps, 32000 limit, 32000 extended limit
conformed 3380 packets, 2847902 bytes; action: transmit
exceeded 321 packets, 440089 bytes; action: drop
last packet: 6292ms ago, current burst: 0 bytes
last cleared 00:09:51 ago, conformed 38000 bps, exceeded 5000 bps
matches: access-group 171
params: 512000 bps, 64000 limit, 64000 extended limit
conformed 0 packets, 0 bytes; action: transmit
exceeded 0 packets, 0 bytes; action: drop
last packet: 2302254236ms ago, current burst: 0 bytes
last cleared 00:09:52 ago, conformed 0 bps, exceeded 0 bps
GAZTEL#
РЕЖИМ НОЧЬ
GAZTEL#date
12:32:53.171 YEKT Thu Nov 26 2009
GAZTEL#sh time
time-range entry: day (inactive)
periodic daily 8:00 to 12:30
periodic daily 13:30 to 21:00
used in: IP ACL entry
time-range entry: night (active)
periodic daily 21:00 to 23:59
periodic daily 0:00 to 8:00
periodic daily 12:30 to 13:30
used in: IP ACL entry
GAZTEL#sh int vi88 rate-limit
Virtual-Access88
Input
matches: access-group 170
params: 256000 bps, 32000 limit, 32000 extended limit
conformed 4050 packets, 793720 bytes; action: transmit
exceeded 2 packets, 2037 bytes; action: drop
last packet: 112752ms ago, current burst: 0 bytes
last cleared 00:15:45 ago, conformed 6000 bps, exceeded 0 bps
matches: access-group 171
params: 512000 bps, 64000 limit, 64000 extended limit
conformed 1480 packets, 375835 bytes; action: transmit
exceeded 0 packets, 0 bytes; action: drop
last packet: 20ms ago, current burst: 42 bytes
last cleared 00:15:45 ago, conformed 3000 bps, exceeded 0 bps
Output
matches: access-group 170
params: 256000 bps, 32000 limit, 32000 extended limit
conformed 4119 packets, 3313434 bytes; action: transmit
exceeded 338 packets, 465089 bytes; action: drop
last packet: 112752ms ago, current burst: 0 bytes
last cleared 00:15:45 ago, conformed 28000 bps, exceeded 3000 bps
matches: access-group 171
params: 512000 bps, 64000 limit, 64000 extended limit
conformed 1801 packets, 1629893 bytes; action: transmit
exceeded 116 packets, 151532 bytes; action: drop
last packet: 396ms ago, current burst: 800 bytes
last cleared 00:15:46 ago, conformed 13000 bps, exceeded 1000 bps
GAZTEL#
Пакетики побежали на скорости 512
GAZTEL#sh users | in test3
Vi88 test3 PPPoE 00:00:00 10.11.2.99
GAZTEL#sh time
time-range entry: day (active)
periodic daily 8:00 to 12:30
periodic daily 13:30 to 21:00
used in: IP ACL entry
time-range entry: night (inactive)
periodic daily 21:00 to 23:59
periodic daily 0:00 to 8:00
periodic daily 12:30 to 13:30
used in: IP ACL entry
GAZTEL#sh int vi88 rat
GAZTEL#sh int vi88 rate-limit
Virtual-Access88
Input
matches: access-group 170
params: 256000 bps, 32000 limit, 32000 extended limit
conformed 3269 packets, 663366 bytes; action: transmit
exceeded 2 packets, 2037 bytes; action: drop
last packet: 6288ms ago, current burst: 0 bytes
last cleared 00:09:51 ago, conformed 8000 bps, exceeded 0 bps
matches: access-group 171
params: 512000 bps, 64000 limit, 64000 extended limit
conformed 0 packets, 0 bytes; action: transmit
exceeded 0 packets, 0 bytes; action: drop
last packet: 2302253188ms ago, current burst: 0 bytes
last cleared 00:09:51 ago, conformed 0 bps, exceeded 0 bps
Output
matches: access-group 170
params: 256000 bps, 32000 limit, 32000 extended limit
conformed 3380 packets, 2847902 bytes; action: transmit
exceeded 321 packets, 440089 bytes; action: drop
last packet: 6292ms ago, current burst: 0 bytes
last cleared 00:09:51 ago, conformed 38000 bps, exceeded 5000 bps
matches: access-group 171
params: 512000 bps, 64000 limit, 64000 extended limit
conformed 0 packets, 0 bytes; action: transmit
exceeded 0 packets, 0 bytes; action: drop
last packet: 2302254236ms ago, current burst: 0 bytes
last cleared 00:09:52 ago, conformed 0 bps, exceeded 0 bps
GAZTEL#
РЕЖИМ НОЧЬ
GAZTEL#date
12:32:53.171 YEKT Thu Nov 26 2009
GAZTEL#sh time
time-range entry: day (inactive)
periodic daily 8:00 to 12:30
periodic daily 13:30 to 21:00
used in: IP ACL entry
time-range entry: night (active)
periodic daily 21:00 to 23:59
periodic daily 0:00 to 8:00
periodic daily 12:30 to 13:30
used in: IP ACL entry
GAZTEL#sh int vi88 rate-limit
Virtual-Access88
Input
matches: access-group 170
params: 256000 bps, 32000 limit, 32000 extended limit
conformed 4050 packets, 793720 bytes; action: transmit
exceeded 2 packets, 2037 bytes; action: drop
last packet: 112752ms ago, current burst: 0 bytes
last cleared 00:15:45 ago, conformed 6000 bps, exceeded 0 bps
matches: access-group 171
params: 512000 bps, 64000 limit, 64000 extended limit
conformed 1480 packets, 375835 bytes; action: transmit
exceeded 0 packets, 0 bytes; action: drop
last packet: 20ms ago, current burst: 42 bytes
last cleared 00:15:45 ago, conformed 3000 bps, exceeded 0 bps
Output
matches: access-group 170
params: 256000 bps, 32000 limit, 32000 extended limit
conformed 4119 packets, 3313434 bytes; action: transmit
exceeded 338 packets, 465089 bytes; action: drop
last packet: 112752ms ago, current burst: 0 bytes
last cleared 00:15:45 ago, conformed 28000 bps, exceeded 3000 bps
matches: access-group 171
params: 512000 bps, 64000 limit, 64000 extended limit
conformed 1801 packets, 1629893 bytes; action: transmit
exceeded 116 packets, 151532 bytes; action: drop
last packet: 396ms ago, current burst: 800 bytes
last cleared 00:15:46 ago, conformed 13000 bps, exceeded 1000 bps
GAZTEL#
Пакетики побежали на скорости 512
Кстати таким же образом с помошью акцесс-групп можно разграничивать доступ и скорость не только по времени но и по типу сервисов (www,ftp, итд), по destination например чтобы не ограничивалась скорость для локальных ресурсов. Теоретически можно попробовать так же сделать динамический шейпинг на основе QoSов, но пока над этим не думал. Если кто поможет с динамическим шейпингом для cisco буду рад)))