Brocade Communications Systems 5600 vRouter, Руководство по настройке

Страница: 38 / 106

Example of rate limiting for CPP
The configuration steps in this example show how to create a rate limit for all traffic that enters the vRouter by first creating the rule set
and applying it to the system loopback interface, lo.
TABLE 18 Example of rate limiting for CPP
Step Command
Create the configuration node for the CPP firewall instance
and its rule 10 to accept traffic that matches the specified
criteria.
vyatta@R1# set security firewall name CPP rule 10 action
accept
Define the rule set to rate-limit all traffic that enters the
vRouter by adding a police action to rate limit all traffic to
500kpps.
vyatta@R1# set security firewall name CPP rule 10 police
ratelimit 500kpps
Apply CPP to the system loopback interface, lo.
vyatta@R1# set interfaces loopback lo firewall local CPP
Commit the configuration.
vyatta@R1# commit
Save the configuration.
vyatta@R1# save
Show the CPP configuration.
vyatta@R1# show
security {
firewall {
name CPP {
rule 10 {
action accept
police {
ratelimit 500kpps
}
}
}
}
}
Viewing firewall information
This section describes how to display firewall configuration information.
Showing firewall instance information
You can see how firewall instances are set up by using security firewall on page 43 in operational mode and specifying the name of the
instance. If no instance is specified, then all defined instances are displayed.
The following example shows how to display configuration information for firewall instances.
vyatta@R1:~$ show security firewall
---------------------------------------
Rulesets Information: Firewall
---------------------------------------
--------------------------------------------------------------------------------
Firewall "fw_1":
Active on (dp0p192p1, in)
rule action proto packets bytes
---- ------ ----- ------- -----
1 allow tcp 0 0
condition - stateful proto tcp flags S/FSRA all
Configuration Examples
Brocade 5600 vRouter Firewall Configuration Guide
38 53-1004253-01