Watchguard Firebox X20E, Руководство пользователя

Страница: 148 / 310

Traffic Categories
136 Firebox X Edge e-Series
Traffic Categories
The Firebox® X Edge e-Series allows you to limit data sent through policies and Traffic Control filters. A
policy can allow or deny all data of a specified type. Traffic Control does not allow or deny data, but cre-
ates “filters” that separate important network traffic from other data. For example, you can create a fil-
ter that identifies email (SMTP) traffic or secure shell (SSH) connections.
When you create a filter, you must select the priority for the traffic it identifies. There are four categories
of network traffic: interactive, high, medium, and low. You can create as many as 100 traffic filters in
each traffic category. Filters can be based on the IP protocol type, the source or destination IP address,
and the source or destination port.
Interactive traffic is routed before all other traffic. Bandwidth not used for interactive traffic is divided
between high, medium, and low priority traffic. Unused bandwidth is automatically given to other cat-
egories. For example, if there is no interactive or low priority traffic, all of the bandwidth is divided
between high and medium priority traffic.
Interactive traffic
Interactive traffic is sent before any other traffic and is limited only by the speed of your connection.
Use the interactive category for traffic that must have low latency. Some examples of interactive traffic
are Telnet, Secure Shell (SSH), video communication, and Voice over Internet Protocol (VoIP).
High priority
High priority traffic is given 75% of the bandwidth not used by interactive traffic. Use the high priority
category for traffic that is very important to your company or uses a lot of bandwidth. Some examples
of high priority traffic are secure HTTP (HTTPS) and virtual private network (VPN) traffic.
Medium priority
Medium priority traffic is given 20% of the bandwidth not used by interactive traffic. When traffic con-
trol is enabled, any traffic that is not in a different filter is automatically put in the medium c
ateg ory.
This traffic is represented by the “All other traffic” entry on the Traffic Control page.
Low priority
Low priority traffic is given 5% of the bandwidth not used by interactive traffic. Use the low priority cat-
egory for low priority traffic that does not use much bandwidth, or is not important. Some examples of
low priority traffic are peer-to-peer (P2P) file transfers or instant messaging (IM).
To use prioritization, you must know your upstream bandwidth limit in kilobits per second (Kbps). If you do
not know your upstream bandwidth limit, ask your network administrator or ISP. For better traffic control,
the Edge subtracts 5% from the upstream bandwidth rate limit to decrease packet latency. If you enter an
incorrect upstream bandwidth limit, traffic control does not operate correctly.
Traffic Marking
If your Firebox X Edge is part of a larger network that uses Quality of Service (QoS) and your upstream
device, LAN equipment, and IPS support it, you can apply marking to each category of network traffic
you define on your Edge. The Edge then marks all traffic that matches the criteria in your Traffic Control
rule. When you mark traffic, you change up to six bits on packet header fields defined for this pur-