前一段時(shí)間一直有客戶問我路由器可不可以做到限制內(nèi)部某些機(jī)子的下行速率，我很自然的答了句：可以做限速的。其實(shí)限速肯定是可以的，但是需要考慮一個(gè)具體的問題。
一般接入路由器都作了地址轉(zhuǎn)換，但是了解到路由器的操作步驟會(huì)發(fā)現(xiàn)如下的執(zhí)行步驟：
check input rate limits ------->nat outside to inside------->check output rate limits
所以針對(duì)內(nèi)部部分主機(jī)做限速策略，由于必須在ACL里面指定inside local 地址，所以應(yīng)該在內(nèi)網(wǎng)接口上應(yīng)用service-policy output xxx，而不是在外網(wǎng)接口上的service-policy input xxx！
下面是一個(gè)具體的例子：
Router#sh run
Building configuration...
Current configuration : 1026 bytes
!
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
!
ip subnet-zero
!
!
no ip domain lookup
!
!
class-map match-all test-class
match access-group 100
!
!
policy-map speed
class test-class
police cir 80000 bc 32000
conform-action transmit
exceed-action drop
!
!
!
!
!
interface FastEthernet0/0
ip address 192.168.1.111 255.255.255.0
ip nat outside
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 172.16.1.1 255.255.255.0
ip nat inside
duplex auto
speed auto
service-policy output speed
!
ip nat inside source list 1 interface FastEthernet0/0 overload
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.1.1
no ip http server
!
!
access-list 1 permit any
access-list 100 deny ip any host 172.16.1.100
access-list 100 permit ip any any
!
line con 0
line aux 0
line vty 0 4
!
!
end
|
（責(zé)任編輯:
51CTO.com TEL：010-68476606)
