Extreme Networks ExtremeWare XOS 11.3, Manual

Page: 390 / 698

CLEAR-Flow
ExtremeWare XOS 11.3 Concepts Guide
390
move the traffic to QP3. In addition, reduce the peak rate to 5 Kbps on QP3. As long as the delta
continues to be greater than or equal to 1000 packets, the CLEAR-Flow agent will repeatedly send a trap
message every 120 seconds. Once the delta falls below the threshold, the agent will execute the two
actions in the
else
portion; it will send a single SNMP trap message, return the traffic to QP1, and reset
QP3 to its original bandwidth.
entry acl_rule1 {
if {
destination-address 192.168.16.0/24;
destination-port 2049;
protocol tcp;
} then {
count counter1;
}
}
entry cflow_delta_rule_example {
if { delta counter1 >= 100000 ;
period 10 ;
} then {
snmptrap 123 "Traffic to 192.168.16.0/24 exceed rate limit" 120;
qosprofile acl_rule1 QP3;
cli "configure qosprofile qp3 peak_rate 5 K ports all" ;
} else {
snmptrap 123 "Traffic to 192.168.16.0/24 falls below rate limit";
qosprofile acl_rule1 QP1;
cli "configure qosprofile qp3 maxbw 100 ports all" ;
}
}
Ratio Expression Example
In this example, every 2 seconds the CLEAR-Flow agent will request the counter1 and counter2 statistics
from the hardware. After it receives the two counter values, it will then check each counter value
against its minimum valid threshold, which is 1000. If both of the counter values is greater then 1000, it
then calculates the ratio of
counter1 and counter2 . If the ratio is greater than 5, then the agent will
execute the actions in the
then
clause, which consists of logging a message to the syslog server. Before
logging the syslog string, the agent will replace the
$ruleName
keyword with the string
cflow_ratio_rule_example , the
$ruleValue
keyword with the calculated ratio value, and the
$ruleThreshold
keyword with a value of 5. If either of the counter values is below the minimum value
of 1000, or the ratio is below the threshold of 5, the expression is false and no action is taken.
entry acl_rule1 {
if {
protocol udp;
} then {
count counter1;
}
}
entry acl_rule2 {
if {