Cisco ASA 5508-X, Руководство по настройке

Страница: 402 / 428

17-2
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 17 Quality of Service
About QoS
Supported QoS Features
The ASA supports the following QoS features:
•
Policing—To prevent classified traffic from hogging the network bandwidth, you can limit the
maximum bandwidth used per class. See
Policing, page 17-2 for more information.
• Priority queuing—For critical traffic that cannot tolerate latency, such as Voice over IP (VoIP), you
can identify traffic for Low Latency Queuing (LLQ) so that it is always transmitted ahead of other
traffic. See
Priority Queuing, page 17-3 .
What is a Token Bucket?
A token bucket is used to manage a device that regulates the data in a flow, for example, a traffic policer.
A token bucket itself has no discard or priority policy. Rather, a token bucket discards tokens and leaves
to the flow the problem of managing its transmission queue if the flow overdrives the regulator.
A token bucket is a formal definition of a rate of transfer. It has three components: a burst size, an
average rate, and a time interval. Although the average rate is generally represented as bits per second,
any two values may be derived from the third by the relation shown as follows:
average rate = burst size / time interval
Here are some definitions of these terms:
•
Average rate—Also called the committed information rate (CIR), it specifies how much data can be
sent or forwarded per unit time on average.
• Burst size—Also called the Committed Burst (Bc) size, it specifies in bytes per burst how much
traffic can be sent within a given unit of time to not create scheduling concerns.
•
Time interval—Also called the measurement interval, it specifies the time quantum in seconds per
burst.
In the token bucket metaphor, tokens are put into the bucket at a certain rate. The bucket itself has a
specified capacity. If the bucket fills to capacity, newly arriving tokens are discarded. Each token is
permission for the source to send a certain number of bits into the network. To send a packet, the
regulator must remove from the bucket a number of tokens equal in representation to the packet size.
If not enough tokens are in the bucket to send a packet, the packet waits until the packet is discarded or
marked down. If the bucket is already full of tokens, incoming tokens overflow and are not available to
future packets. Thus, at any time, the largest burst a source can send into the network is roughly
proportional to the size of the bucket.
Policing
Policing is a way of ensuring that no traffic exceeds the maximum rate (in bits/second) that you
configure, thus ensuring that no one traffic class can take over the entire resource. When traffic exceeds
the maximum rate, the ASA drops the excess traffic. Policing also sets the largest single burst of traffic
allowed.