思科交換機(jī)端口限速實(shí)戰(zhàn)
簡(jiǎn)介
CISCO3550交換機(jī)作為我們單位的核心網(wǎng)絡(luò)交換機(jī),已經(jīng)穩(wěn)定運(yùn)行了多年,功能上也能滿足我們的需求,但是其端口限速功能卻不像其它的一些交換機(jī)那樣容易實(shí)現(xiàn),好在最近找到了實(shí)現(xiàn)的辦法,配置完成后,配合iperf這款測(cè)速軟件進(jìn)行驗(yàn)證,結(jié)果證明這個(gè)方法是行之有效的,下面是具體實(shí)現(xiàn)步驟。
一、創(chuàng)建ACL
由于這是一臺(tái)三層交換機(jī),所以雖然是對(duì)端口進(jìn)行限速,但是還要考慮這個(gè)端口上通過的網(wǎng)絡(luò)地址,本例中,我們選擇對(duì)CISCO3550交換機(jī)的第22口進(jìn)行限速,該端口屬于VLAN66,IP地址段為10.66/16,所以首先要?jiǎng)?chuàng)建一個(gè)ACL,如下所示:
- 3550#conf t
- Enter configuration commands, one per line. End with CNTL/Z.
- 3550(config)#access-list 15 permit 10.66.0.0 0.0.255.255
二、創(chuàng)建class-map
- 3550#conf t
- Enter configuration commands, one per line. End with CNTL/Z.
- 3550(config)#class-map dkxs
- 3550(config-cmap)#match access-group 15
這一步操作的主要目的就是創(chuàng)建了一個(gè)class-map,在這里面引用了我們事先創(chuàng)建好的ACL 15,方便我們以后對(duì)22端口進(jìn)行操作。
三、創(chuàng)建policy-map
出于測(cè)試的需要,我們創(chuàng)建了多個(gè)policy-map,分別設(shè)置不同的限制帶寬,如80k,1m,5m,10m,分別如下:
- 3550#conf t
- Enter configuration commands, one per line. End with CNTL/Z.
- 3550(config)#policy-map 80k
- 3550(config-pmap)#class dkxs
- 3550(config-pmap-c)# police 80000 8000 exceed-action drop
- 3550#conf t
- Enter configuration commands, one per line. End with CNTL/Z.
- 3550(config)#policy-map 1m
- 3550(config-pmap)#class dkxs
- 3550(config-pmap-c)# police 1000000 100000 exceed-action drop
- 3550#conf t
- Enter configuration commands, one per line. End with CNTL/Z.
- 3550(config)#policy-map 5m
- 3550(config-pmap)#class dkxs
- 3550(config-pmap-c)# police 5000000 500000 exceed-action drop
- 3550#conf t
- Enter configuration commands, one per line. End with CNTL/Z.
- 3550(config)#policy-map 10m
- 3550(config-pmap)#class dkxs
- 3550(config-pmap-c)# police 10000000 1000000 exceed-action drop
四、查看配置信息
- 3550#show run
- policy-map 5m
- class dkxs
- police 5000000 500000 exceed-action drop
- policy-map 1m
- class dkxs
- police 1000000 100000 exceed-action drop
- policy-map 80k
- class dkxs
- police 80000 8000 exceed-action drop
- policy-map 10m
- class dkxs
- police 10000000 1000000 exceed-action drop
#p#
五、通過iperf軟件進(jìn)行驗(yàn)證
即先在一臺(tái)服務(wù)器上運(yùn)行iperf的服務(wù)器端,命令如下:
- F:\tools>iperf -s
- ------------------------------------------------------------
- Server listening on TCP port 5001
- TCP window size: 8.00 KByte (default)
- ------------------------------------------------------------
然后在交換機(jī)的22口上分別應(yīng)用表示不同速率的policy-map,每應(yīng)用一次,通過一臺(tái)連接到22端口的筆記本電腦運(yùn)行iperf的客戶端,進(jìn)行端口速率測(cè)試,結(jié)果分別如下:
(交換機(jī)設(shè)置)
- 3550(config-if)#service-policy input 80k
(IPERF客戶端測(cè)試結(jié)果)
- F:\tools>iperf -c 10.66.66.8
- ------------------------------------------------------------
- Client connecting to 10.66.66.8, TCP port 5001
- TCP window size: 8.00 KByte (default)
- ------------------------------------------------------------
- [1912] local 10.66.123.66 port 1147 connected with 10.66.66.8 port 5001
- [ ID] Interval Transfer Bandwidth
- [1912] 0.0-12.5 sec 104 KBytes 68.3 Kbits/sec
- F:\tools>iperf -c 10.66.66.8
- ------------------------------------------------------------
- Client connecting to 10.66.66.8, TCP port 5001
- TCP window size: 8.00 KByte (default)
- ------------------------------------------------------------
- [1912] local 10.66.123.66 port 1151 connected with 10.66.66.8 port 5001
- [ ID] Interval Transfer Bandwidth
- [1912] 0.0-12.0 sec 104 KBytes 70.8 Kbits/sec
(交換機(jī)設(shè)置)
- 3550(config-if)#service-policy input 1m
(IPERF客戶端測(cè)試結(jié)果)
- F:\tools>iperf -c 10.66.66.8
- ------------------------------------------------------------
- Client connecting to 10.66.66.8, TCP port 5001
- TCP window size: 8.00 KByte (default)
- ------------------------------------------------------------
- [1912] local 10.66.123.66 port 1155 connected with 10.66.66.8 port 5001
- [ ID] Interval Transfer Bandwidth
- [1912] 0.0-10.5 sec 1.08 MBytes 860 Kbits/sec
- F:\tools>iperf -c 10.66.66.8
- ------------------------------------------------------------
- Client connecting to 10.66.66.8, TCP port 5001
- TCP window size: 8.00 KByte (default)
- ------------------------------------------------------------
- [1912] local 10.66.123.66 port 1159 connected with 10.66.66.8 port 5001
- [ ID] Interval Transfer Bandwidth
- [1912] 0.0-10.0 sec 1.09 MBytes 910 Kbits/sec
(交換機(jī)設(shè)置)
- 3550(config-if)#service-policy input 5m
(IPERF客戶端測(cè)試結(jié)果)
- F:\tools>iperf -c 10.66.66.8
- ------------------------------------------------------------
- Client connecting to 10.66.66.8, TCP port 5001
- TCP window size: 8.00 KByte (default)
- ------------------------------------------------------------
- [1912] local 10.66.123.66 port 1163 connected with 10.66.66.8 port 5001
- [ ID] Interval Transfer Bandwidth
- [1912] 0.0-10.5 sec 5.84 MBytes 4.67 Mbits/sec
- F:\tools>iperf -c 10.66.66.8
- ------------------------------------------------------------
- Client connecting to 10.66.66.8, TCP port 5001
- TCP window size: 8.00 KByte (default)
- ------------------------------------------------------------
- [1912] local 10.66.123.66 port 1167 connected with 10.66.66.8 port 5001
- [ ID] Interval Transfer Bandwidth
- [1912] 0.0-10.7 sec 5.98 MBytes 4.68 Mbits/sec
(交換機(jī)設(shè)置)
- 3550(config-if)#service-policy input 10m
(IPERF客戶端測(cè)試結(jié)果)
- F:\tools>iperf -c 10.66.66.8
- ------------------------------------------------------------
- Client connecting to 10.66.66.8, TCP port 5001
- TCP window size: 8.00 KByte (default)
- ------------------------------------------------------------
- [1912] local 10.66.123.66 port 1171 connected with 10.66.66.8 port 5001
- [ ID] Interval Transfer Bandwidth
- [1912] 0.0-10.1 sec 11.8 MBytes 9.83 Mbits/sec
- F:\tools>iperf -c 10.66.66.8
- ------------------------------------------------------------
- Client connecting to 10.66.66.8, TCP port 5001
- TCP window size: 8.00 KByte (default)
- ------------------------------------------------------------
- [1912] local 10.66.123.66 port 1175 connected with 10.66.66.8 port 5001
- [ ID] Interval Transfer Bandwidth
- [1912] 0.0-10.2 sec 12.0 MBytes 9.87 Mbits/sec
為了使測(cè)試的結(jié)果更準(zhǔn)確,每種速率下都進(jìn)行了兩次測(cè)試,從測(cè)試的結(jié)果看,端口限速確實(shí)生效了?!揪庉嬐扑]】