Using Profile Acls With The Traffic Rate Limiting Facility - Cabletron Systems IA1100 User's Reference Manual

For example, you can define an IP policy that causes all telnet packets travelling from
source network 9.1.1.0/24 to destination network 15.1.1.0/24 to be forwarded to
destination address 10.10.10.10. You use a Profile ACL to define the selection criteria (in
this case, telnet packets travelling from source network 9.1.1.0/24 to destination network
15.1.1.0/24). Then you use an ip-policy command to specify what happens to packets that
match the selection criteria (in this example, forward them to address 10.10.10.10). The
following commands illustrate this example.
This command creates a Profile ACL called prof1 that uses as its selection criteria all telnet
packets travelling from source network 9.1.1.0/24 to destination network 15.1.1.0/24:
ia(config)# acl prof1 permit ip 9.1.1.0/24 15.1.1.0/24 any any telnet 0
This Profile ACL is then used in conjunction with the ip-policy command to cause packets
matching prof1's selection criteria (that is, telnet packets travelling from 9.1.1.0/24 to
15.1.1.0/24) to be forwarded to 10.10.10.10:
ia(config)# ip-policy p5 permit profile prof1 next-hop-list 10.10.10.10
See Chapter 10, "IP Policy-Based Forwarding Configuration Guide,"
on using the ip-policy command.

Using Profile ACLs with the Traffic Rate Limiting Facility

Traffic rate limiting is a mechanism that allows you to control bandwidth usage of
incoming traffic on a per-flow basis. A flow meeting certain criteria can have its packets
re-prioritized or dropped if its bandwidth usage exceeds a specified limit.
For example, you can cause packets in flows from source address 1.2.2.2 to be dropped if
their bandwidth usage exceeds 10 Mbps. You use a Profile ACL to define the selection
criteria (in this case, flows from source address 1.2.2.2). Then you use a rate-limit
command to specify what happens to packets that match the selection criteria (in this
example, drop them if their bandwidth usage exceeds 10 Mbps). The following commands
illustrate this example.
This command creates a Profile ACL called prof2 that uses as its selection criteria all
packets originating from source address 1.2.2.2:
ia(config)# acl prof2 permit ip 1.2.2.2
The following command creates a rate limit definition that causes flows matching Profile
ACL prof2's selection criteria (that is, traffic from 1.2.2.2) to be restricted to 10 Mbps for
each flow. If this rate limit is exceeded, the packets are dropped.
ia(config)# rate-limit client1 input acl prof2 rate-limit 10000000
exceed-action drop-packets
Internet Appliance User Reference Manual
Chapter 13: Access Control List Configuration Guide
for more information
221