I came across an interesting problem the other day where someone had a 15Gb usage cap on their ADSL during the day but unlimited usage from midnight to 8am. Someone who lived in their house was partial to downloading large files and they wanted to restrict them from doing this until they were in the unlimited usage period.
What was required was essentially a class map which matches based on both the time of day and the protocols in use. I could then drop traffic by applying a policy-map against an interface.
The first thing I did was to create a class-map which would match any of the peer to peer protocols like so....
class-map match-any Peer2Peer
match protocol bittorrent
match protocol edonkey
match protocol gnutella
match protocol kazaa2
match protocol fasttrack
match protocol winmx
match protocol directconnect
Next I created a time range called OFFPEAK. I made the time range between 08:00 and 23:59 which is the period where the restrictions apply.
time-range OFFPEAK
periodic daily 8:00 to 23:59
Now we need an access-list in order to apply my time-range against. This will simply match any traffic from my LAN range destined to any other IP but is within the hours of 08:00 and 23:59
ip access-list extended P2P_TOD
remark Used to apply Time of Day to P2P traffic
permit ip 192.168.3.0 0.0.0.255 any time-range OFFPEAK
We can then create a class-map which looks for traffic which is both a P2P protocol and is seen between the hours of 8am and midnight
class-map match-all Peer2Peer_TOD
match class-map Peer2Peer
match access-group name P2P_TOD
Lastly we can simply create a policy-map (preferably on the interface closest to the offending user to save the traffic crossing the router) which drops the packets like so...
policy-map Drop_P2P
class Peer2Peer_TOD
drop
Simple huh! There are plenty of other uses of the configuration above. What about rate limiting certain types of traffic during work hours whilst unrestricting them at lunch or afterhours. The possibilities are endless...enjoy!
What was required was essentially a class map which matches based on both the time of day and the protocols in use. I could then drop traffic by applying a policy-map against an interface.
The first thing I did was to create a class-map which would match any of the peer to peer protocols like so....
class-map match-any Peer2Peer
match protocol bittorrent
match protocol edonkey
match protocol gnutella
match protocol kazaa2
match protocol fasttrack
match protocol winmx
match protocol directconnect
Next I created a time range called OFFPEAK. I made the time range between 08:00 and 23:59 which is the period where the restrictions apply.
time-range OFFPEAK
periodic daily 8:00 to 23:59
Now we need an access-list in order to apply my time-range against. This will simply match any traffic from my LAN range destined to any other IP but is within the hours of 08:00 and 23:59
ip access-list extended P2P_TOD
remark Used to apply Time of Day to P2P traffic
permit ip 192.168.3.0 0.0.0.255 any time-range OFFPEAK
We can then create a class-map which looks for traffic which is both a P2P protocol and is seen between the hours of 8am and midnight
class-map match-all Peer2Peer_TOD
match class-map Peer2Peer
match access-group name P2P_TOD
Lastly we can simply create a policy-map (preferably on the interface closest to the offending user to save the traffic crossing the router) which drops the packets like so...
policy-map Drop_P2P
class Peer2Peer_TOD
drop
Simple huh! There are plenty of other uses of the configuration above. What about rate limiting certain types of traffic during work hours whilst unrestricting them at lunch or afterhours. The possibilities are endless...enjoy!
Comments
Post a Comment