D-Link DFL-1600 - Security Appliance, Руководство пользователя

Страница: 451 / 552

Chapter 10. Traffic Management
This chapter describes how NetDefendOS can manage network traffic.
• Traffic Shaping, page 451
• IDP Traffic Shaping, page 472
• Threshold Rules, page 477
• Server Load Balancing, page 480
10.1. Traffic Shaping
10.1.1. Overview
QoS with TCP/IP
A weakness of TCP/IP is the lack of true Quality of Service (QoS) functionality. QoS is the ability
to guarantee and limit network bandwidth for certain services and users. Solutions such as the
Differentiated Services (Diffserv) architecture have been designed to try and deal with the QoS issue
in large networks by using information in packet headers to provide network devices with QoS
information.
NetDefendOS Diffserv Support
NetDefendOS supports the Diffserv architecture the following ways:
• NetDefendOS forwards the 6 bits which make up the Diffserv Differentiated Services Code
Point (DSCP) as well as copying these bits from the data traffic inside VPN tunnels to the
encapsulating packets.
• As described later in this chapter, DSCP bits can be used by the NetDefendOS traffic shaping
subsystem as a basis for prioritizing traffic passing through the NetDefend Firewall.
It is important to understand that NetDefendOS traffic shaping does not add new Diffserv
information as packets traverse a NetDefend Firewall. The NetDefendOS traffic shaping priorities
described later in this chapter are for traffic shaping within NetDefendOS only and are not translated
into Diffserv information that is then added to packets.
The Traffic Shaping Solution
Architectures like Diffserv however, fall short if applications themselves supply the network with
QoS information. In most networks it is rarely appropriate to let the applications, the users of the
network, decide the priority of their own traffic. If the users cannot be relied upon then the network
equipment must make the decisions concerning priorities and bandwidth allocation.
NetDefendOS provides QoS control by allowing the administrator to apply limits and guarantees to
the network traffic passing through the NetDefend Firewall. This approach is often referred to as
traffic shaping and is well suited to managing bandwidth for local area networks as well as to
managing the bottlenecks that might be found in larger wide area networks. It can be applied to any
traffic including that passing through VPN tunnels.
451