Method used to limit IPSec VPN traffic on the USG6000

18

You can run the speed-limit command to limit the IPSec traffic.
When multiple tunnels are established on the NGFW, traffic conflict occurs in case of heavy traffic. By configuring the speed-limit command, you can limit the traffic on each IPSec tunnel. The traffic beyond the limit is discarded. In this manner, traffic on each tunnel can be transmitted.

Other related questions:
how to limit the flow of IPSec VPN with the USG6000
Speed-limit command can be executed for IPSec current limiting.When building the multi tunnel in NGFW, when large data traffic will generate traffic conflict, by configuring the speed-limit command, can limit the packets flow of each IPSec tunnel, exceeds the limit of the traffic will be discarded, ensure the traffic on each of the tunnel have been transferred.

Limiting IPSec traffic
You can use a traffic policy to limit IPSec traffic. In a traffic policy, esp or ah is used as the matching condition. The service corresponds to IPSec traffic.

Rate limiting for IPSec VPN tunnels of the USG6000 series
On the USG6000 series, rate limiting can be implemented for IPSec VPN tunnels by using two methods. Method 1: If multiple tunnels are established on the USG, traffic conflicts occur in the case of heavy data traffic. In this case, run speed-limit to limit the traffic in each IPSec tunnel. Excess packets are discarded. This ensures that all packets in each tunnel are transmitted properly. If the traffic coming through a tunnel to a local port is heavy, run inbound to limit the traffic coming from this IPSec tunnel to the local port. If the traffic forwarded by the local port is heavy, run outbound to limit the traffic forwarded by the local port to the IPSec tunnel. After a security policy is applied on an interface, you cannot run speed-limit to modify the limited rate in the security policy. If an IPSec security policy is configured in any of the following modes, you can run speed-limit { inbound | outbound } speed-limit to limit the traffic rate of the IPSec tunnel. �?Manual mode �?Template mode �?Internet Key Exchange (IKE) non-policy template mode Method 2: After traffic policies are configured, if the actual address before VPN encapsulation or after decapsulation is matched, the traffic rate of the IPSec VPN can be limited. Assume that the actual address before VPN encapsulation is 10.1.1.1. The configuration method is as follows: [sysname] traffic-policy [sysname-policy-traffic] rule name 1 [sysname-policy-traffic-rule-1] source-address 10.1.1.1 32

Method used to view traffic of the USG6000
The method used to view the traffic on the USG6000 is as follows: 1. On the web UI, select traffic logs in monitoring to view traffic logs. 2. On the web UI, select traffic reports in monitoring to view traffic reports.

Method used to configure the L2TP VPN on the USG6000
The L2TP application scenarios on the USG6000 are as follows: 1. NAS-Initiated VPN A user accesses the LAC by means of PPPoE dialup, and a tunnel is established between the LAC and the LNS. A user accesses the LAC by means of PPPoE dialup. The LAC sends a tunnel establishment request to the LNS through Internet. The LNS allocates an address to the user. The user is authenticated by the proxy on the LAC side or by both the LAC and the proxy on the LAC side. When all L2TP users are offline, the tunnel is automatically released to save resources. The tunnel is re-established when a user is accessed. This networking is applicable to the following scenario: A branch office user initiates a request to connect to the HQ network, and generally, the branch office user does not frequently access the HQ network. 2. LAC autodial A permanent L2TP session is established between the LAC and the LNS. A client can transmit data over the tunnel by means of an IP connection without PPP dialup. The user can configure the trigger condition for establishing a permanent L2TP session between the LAC and the LNS. The LAC establishes a permanent L2TP tunnel with the LNS using the locally-stored user name. The L2TP tunnel serves as a physical connection. In this way, the connection between the user and the LAC is based on the IP connection instead of the PPP connection. The LAC can forward IP packets of the user to the LNS. 3. Client-Initiated VPN A client that supports L2TP dialup can directly initiate a tunnel establishment request to the LNS bypassing the LAC. The user can directly initiate the connection. Therefore, the user can directly initiate a tunnel establishment request to the LNS bypassing the LAC. The LNS allocates an address to the user. Since the LNS needs to establish a tunnel for each remote user, the LNS configuration is relative complex compared with that in the NAS-Initiated VPN scenario. However, the user access is not subject to geographical restrictions. This scenario is applicable to the mobile office. For example, an employee on a business trip can access the HQ server using PCs or mobile phones.

If you have more questions, you can seek help from following ways:
To iKnow To Live Chat
Scroll to top