Example for Configuring a QoS Policy Based on Application Protocols (Direct Forwarding)
Networking Requirements
As shown in the following figure, an enterprise has deployed a WLAN with the direct data forwarding mode. To regulate online behavior of employees on the network, the administrator needs to configure QoS policies based on application protocols.
Voice, video, and data services are involved on the WLAN, including FaceTime, SkypeForBusiness, QQ_VoIP. The administrator wants to learn the application traffic usage to plan the network capacity and locate faults. For example, discard FaceTime packets, specify the SkypeForBusiness priority, and limit the rate of QQ_VoIP traffic.
For configurations of the WLAN access function, see Related Topics.
Configuration Roadmap
- Enable the security engine and update the signature database.
- Configure application visualization, including specifying the priority for Skype for Business packets, discarding FaceTime packets, and limiting the rate of QQ VoIP packets.
Item |
Data |
|---|---|
AP group |
|
VAP profile |
|
SAC profile |
Name: wlan-sac SAC policy: Discard FaceTime packets, set the DSCP priority of Skype for Business packets to 40, and limit the rate of QQ VoIP packets to 1000 kbit/s. |
Configuration Notes
- No ACK mechanism is provided for multicast packet transmission on air interfaces. In addition, wireless links are unstable. To ensure stable transmission of multicast packets, they are usually sent at low rates. If a large number of such multicast packets are sent from the network side, the air interfaces may be congested. You are advised to configure multicast packet suppression to reduce impact of a large number of low-rate multicast packets on the wireless network. Exercise caution when configuring the rate limit; otherwise, the multicast services may be affected.
- In direct forwarding mode, you are advised to configure multicast packet suppression on switch interfaces connected to APs.
- In tunnel forwarding mode, you are advised to configure multicast packet suppression in traffic profiles of the AC.
Configure port isolation on the interfaces of the device directly connected to APs. If port isolation is not configured and direct forwarding is used, a large number of unnecessary broadcast packets may be generated in the VLAN, blocking the network and degrading user experience.
In tunnel forwarding mode, the management VLAN and service VLAN cannot be the same. Only packets from the management VLAN are transmitted between the AC and APs. Packets from the service VLAN are not allowed between the AC and APs.
Procedure
- Enable the security engine.
In this example, the direct data forwarding mode is used. Therefore, you need to enable the security engine on both the AC and the AP. If tunnel forwarding is used, you only need to enable the security engine on the AC.
# Choose .
# Enable Loading the SAC signature database on the AC.
# Disable Loading the SAC signature database on the AP. In , enable SAC for a specified AP group.
# Click .
- Update the SAC signature database.
# visit Huawei Security Center (https://isecurity.huawei.com/sec/web/freesignature.do) and download the SAC signature databases of the AC and AP.
# Choose .
# Under , click mapping . In the dialog box that is displayed, click . In the dialog box that is displayed, select the corresponding SAC signature database and click . In the dialog box that is displayed, click .
# After the update is successful, a dialog box is displayed, where you can click .
# The method for updating is similar to that for updating the AC SAC signature database, and is not mentioned here.
- Create an SAC profile and bind it to the VAP profile corresponding to the AP group ap-group1.
# Choose .
# In the AP group list, click the AP group ap-group1, click
next to , click
next to wlan-net, and select .
# Click , set to wlan-sac. Click . The page for configuring is displayed.
# Under , set to instant_message, to skypeforbusiness, to Priority policy, to DSCP, and the priority to 40. Click
.
# Under , set to voip, to qq_voip, to Rate limit policy, and to 1000. Click
.
# Under , set to voip, to facetime, and to Drop policy. Click
.
# After the policy is configured, it is displayed as follows.
# Click . In the dialog box that is displayed, click .
- After the configuration is complete, the FaceTime service cannot be used, the DSCP priority of the Skype for Business packets is 40, and the rate of QQ VoIP packets is limited to 1000 kbit/s.
next to 
.
.
.
