How to configure an AR to limit the rate of IPSec data flows

To configure an AR to limit the rate of IPSec data flows, configure the QoS function for IPSec packets first, and then configure rate limiting for IPSec data flows through MQC.
[Huawei]ipsec policy huawei 1 manual //Create an IPSec policy, set the SA creation mode to manual, and enter the IPSec policy view. Alternatively, you can complete the following configurations in the ISAKMP policy view, IPSec policy template view, IPSec profile view, Efficient VPN policy view, or GDOI policy view.
[Huawei-ipsec-policy-manual-huawei-1]qos group 10 //Configure the QoS group to which IPSec packets belong.
[Huawei]traffic classifier c1 //Create a traffic classifier and enter the traffic classifier view.
[Huawei-classifier-c1]if-match qos-group 10 //Configure a matching rule based on QoS group 10.
[Huawei]traffic behavior b1 //Create a traffic behavior and enter the traffic behavior view.
[Huawei-behavior-b1]car cir 3000 //Limit the rate of traffic.
[Huawei]traffic policy p1 //Create a traffic policy and enter the traffic policy view.
[Huawei-trafficpolicy-p1]classifier c1 behavior b1 //Bind the traffic classifier to the traffic behavior.
[Huawei]interface GigabitEthernet 0/0/0
[Huawei-GigabitEthernet0/0/0]traffic-policy p1 outbound //Apply the traffic policy on the interface

Scroll to top