Dell PowerConnect J-EX8208, Software Manual

Page: 2831 / 3660

Table 342: Configuration Components: Switch Ports on a 48-Port All-PoE Switch (continued)
Port Devices IP and MAC Addresses VLAN Membership Switch and Port Number
Gatekeeper device. The
gatekeeper manages call
registration, admission, and
call status for VoIP phones. IP address: 192.0.2.14
MAC
address:
00.05.85.00.00.0E
voice-vlan ge-0/0/9
Layer 3 connection to a router;
note that this is a port on the
switch’s uplink module IP address:
192.0.2.65
ge-0/1/0
Configuring an Ingress Port Firewall Filter to Prioritize Voice Traffic and Rate-Limit TCP and
ICMP Traffic
To configure and apply firewall filters for port, VLAN, and router interfaces, perform these
tasks:
CLI Quick
Configuration
To quickly configure and apply a port firewall filter to prioritize voice traffic and rate-limit
packets that are destined for the
employee-vlan
subnet, copy the following commands
and paste them into the switch terminal window:
[edit]
set firewall policer tcp-connection-policer if-exceeding burst-size-limit 30k bandwidth-limit 1m
set firewall policer tcp-connection-policer then discard
set firewall policer icmp-connection-policer if-exceeding burst-size-limit 30k bandwidth-limit
1m
set firewall policer icmp-connection-policer then discard
set firewall family ethernet-switching filter ingress-port-voip-class-limit-tcp-icmp term voip-high
from source-mac-address 00.05.85.00.00.01
set firewall family ethernet-switching filter ingress-port-voip-class-limit-tcp-icmp term voip-high
from source-mac-address 00.05.85.00.00.02
set firewall family ethernet-switching filter ingress-port-voip-class-limit-tcp-icmp term voip-high
from protocol udp
set firewall family ethernet-switching filter ingress-port-voip-class-limit-tcp-icmp term voip-high
then forwarding-class expedited-forwarding
set firewall family ethernet-switching filter ingress-port-voip-class-limit-tcp-icmp term voip-high
then loss-priority low
set firewall family ethernet-switching filter ingress-port-voip-class-limit-tcp-icmp term
network-control from precedence net-control
set firewall family ethernet-switching filter ingress-port-voip-class-limit-tcp-icmp term
network-control then forwarding-class network-control
set firewall family ethernet-switching filter ingress-port-voip-class-limit-tcp-icmp term
network-control then loss-priority low
set firewall family ethernet-switching filter ingress-port-voip-class-limit-tcp-icmp term
tcp-connection from destination-address 192.0.2.16/28
set firewall family ethernet-switching filter ingress-port-voip-class-limit-tcp-icmp term
tcp-connection from protocol tcp
set firewall family ethernet-switching filter ingress-port-voip-class-limit-tcp-icmp term
tcp-connection then policer tcp-connection-policer
set firewall family ethernet-switching filter ingress-port-voip-class-limit-tcp-icmp term
tcp-connection then count tcp-counter
set firewall family ethernet-switching filter ingress-port-voip-class-limit-tcp-icmp term
tcp-connection then forwarding-class best-effort
set firewall family ethernet-switching filter ingress-port-voip-class-limit-tcp-icmp term
tcp-connection then loss-priority high
2759
Chapter 101: Examples of Firewall Filters Configuration