前段时间一直有客户问我路由器可不可以做到限制内部某些机子的下行速率,我很自然的答了句:可以做限速的。其实限速肯定是可以的,但是需要考虑一个具体的问题一般接入路由器都作了地址转换,但是了解到路由器的操作步骤会发现如下的执行步骤:check input rate limits ------->nat outside to inside------->check output rate limits所以针对内部部分主机做限速策略,由于必须在ACL里面指定inside local 地址,所以应该在内网接口上应用service-policy output xxx,而不是在外网接口上的service-policy input xxx!下面是一个具体的例子:Router#sh runBuilding configuration...Current configuration : 1026 bytes!version 12.2service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname Router!!ip subnet-zero!!no ip domain lookup!!class-map match-all test-classmatch access-group 100!!policy-map speedclass test-classpolice cir 80000 bc 32000conform-action transmitexceed-action drop!!!!!interface FastEthernet0/0ip address 192.168.1.111 255.255.255.0ip nat outsideduplex autospeed auto!interface FastEthernet0/1ip address 172.16.1.1 255.255.255.0ip nat insideduplex autospeed autoservice-policy output speed!ip nat inside source list 1 interface FastEthernet0/0 overload!ip classlessip route 0.0.0.0 0.0.0.0 192.168.1.1no ip http server!!access-list 1 permit anyaccess-list 100 deny ip any host 172.16.1.100access-list 100 permit ip any any!line con 0line aux 0line vty 0 4!!endRouter#最后的效果,可以达到限制内网除172.16.1.100的其他主机的下行速率在10KBps附近最后,提一下,那如果想限制内网部分主机的上行速率呢?大家自己举一反三吧
本文转自danni505 51CTO博客,原文链接:http://blog.51cto.com/danni505/22747,如需转载请自行联系原作者