Add QoS and Firewall Rules (requires Level 10 permission) To add a new Qos rule: Click Configuration > QoS System Settings > QoS and Firewall Rules tab > Add. In the ID field, type a unique numeric identifier for the rule. The valid range is from 0 to 6000. In the Destination IP boxes, type the destination IP address to be used as criteria for matching the QoS rule. The destination IP address is used with the destination subnet mask to determine matching. In the Destination Netmask boxes, type the subnet mask for the destination IP address. In the Destination Port box, type the TCP or UDP port to be used as criteria for matching the QoS rule. To specify any port, type 0 (zero). In the Source IP boxes, type the source IP address to be used as the criteria for matching the QoS rule. The source IP address is used with the source subnet mask to determine matching. In the Source Netmask boxes, type the subnet mask for the source IP address. In the Source Port box, type the TCP or UDP port to be used as criteria for matching the QoS rule. To specify any port, type 0 (zero). In the Network Protocol box, type the protocol number of the flow protocol for the QoS rule. The protocol number can be a number 1 through 255. The protocol number of TCP is 6, and the protocol number for UDP is 17. For a list of protocol numbers, see http://www.iana.org/assignments/protocol-numbers. If you are also using a QoS protocol detector, you must match the network protocol with the type of QoS protocol. Use the following network protocol and QoS protocol matches: UDP: SIP TCP: H.323 TCP: SCCP In the Firewall Filter ID text box, enter the filter-ID to be used (per-user or per-ESS), if Per-User Firewall configuration is enabled (optional feature). This ID must be between 1 and 16 characters. In the Packet minimum length text box, specify the size of the minimum packet length needed to match the rule. In the Packet maximum length text box, specify the size of the maximum packet length needed to match the rule. In the QoS Protocol list, select one of the following: SIP H.323 SCCP Other None For capture rules, the QoS protocol determines which QoS protocol detector automatically derives the resources needed for the flow (implicitly). Select Other if you want to specify the resource requirements for matched flows explicitly. The QoS protocol value is ignored for non-capture rules. In the Average Packet rate box, type the average flow packet rate. The rate can be from 0 through 200 packets/second. In the Action list, select the action the rule specifies: Forward: A flow is given an explicit resource request, bypassing the QoS protocol detector and regardless of whether a QoS protocol was specified. Capture: The system, using a QoS protocol detector, analyzes the flow for its resource requirements. Drop: The flow is dropped. In the Drop Policy list, select one of the following: Head: New packets that arrive after the queue has reached its maximum length are allowed in the queue, and old information in the queue is replaced with the new information. Tail: New packets that arrive after the queue has reached its maximum length are dropped. In the Token Bucket Rate box, specify the maximum number of bytes allowed for a flow; bytes exceeding this rate will be dropped. This limits a flow to X bytes per second (1 token = 1 byte).  TokenBucketRate Max Bandwidth  1000 8Kbps  5000 40Kbps  12500 125Kbps  125000 1Mbps  625000 5Mbps  1000000 8Mbps Maximum Value  tokenbucketrate’ = x/8, where x is the preferred maximum bandwidth In the Priority box, type the priority at which the flow is placed in a best-effort queue. Packets in a higher priority best-effort queue are transmitted by access points before packets in lower-priority queues, but after packets for reserved flows. The priority can be a value from 0 through 8, with 0 specifying no priority and 8 specifying the highest priority. The default value is 0. If you enable priority (specify a non-zero value), you cannot specify an average packet rate or token bucket rate. In the Traffic Control list, select one of the following: On Off For all types of flows (explicit, detected, and best-effort), selecting On for traffic control restricts the flow to the rate you specified. Packets above that rate are dropped. In the DiffServ Codepoint list, select the appropriate DiffServ setting, if applicable. In the QoS Rule Logging list, select whether to enable or disable logging activity for this QoS rule: On Off In the QoS Rule Logging Frequency text box, change the default collection interval in which packets related to this rule are logged, if QoS Logging is enabled. The interval must be a number between 30 and 60 (seconds). Check appropriate Match Checkboxes: For any field text box with the Match checkbox selected, packets must match the information in the text box or they are dropped. If the box is not checked, packets with any value are matched, regardless of the data in the field. For more information, see More About the Match Checkbox and Flow Class Checkbox below. Check appropriate Flow Class Checkboxes: The first column of check boxes identifies the trigger(s) for the rule; the second column identifies the action(s) that take place when the rule is triggered. The Flow Class options are relevant only for Flow Control rules (rules with Traffic Control enabled and Token Bucket Rate specified) and Firewall rules. When Flow Class is checked for a field, if a packet has matched a rule (either Flow Control or Firewall types), these fields are stored in the Flow Class entry. A Flow Class entry is used by the system for aggregating a set of flows so that they can be subjected to similar behavior, be it dropping the packets, or rate limiting them.  For example, if a rule has a Src IP address of 0.0.0.0 and the Flow Class box checked, and Token Bucket Rate set to 10000 bytes/sec, all packets passing through the system must match this rule, and each flow will be allowed a maximum throughput of 10000 bytes/sec. If the rule were to have Src IP address of 10.0.0.10 and the Flow Class box checked, with a Token Bucket Rate of 10000 bytes/sec, all packets coming from a machine with IP address 10.0.0.10, must match this rule, and the cumulative throughput allowed for this machine shall be no more than 10000bytes/sec.For more information, see More About the Match Checkbox and Flow Class Checkbox below. To add the QoS rule, click OK. More About the Match Checkbox and Flow Class Checkbox The two checkboxes Match and Flow Class operate independently from each other; they perform two different functions. Match will almost always be used because checking this box indicates that the setting on the left must match - this sets the matching criteria for the QoS rule. You can check more than one matching criteria. If you check no criteria at all, then all criteria are matched. Matching is the first phase of QoS rule execution. After criteria are matched, the action phase of the QoS rule is executed. Here are the directions that describe what to do with the matched packet from phase 1, Matching. For example, the rule can capture the packet from a named source and drop it. Action is phase 2 of QoS rule execution. The Flow Class column is all about rate limiting. If a rule involves rate limiting, the actions Traffic Control and Token Bucket Rate must have been turned on. When the QoS rule executes traffic control, it looks at the check marks in the flow class column. If there are no check marks at all, the rate limiting is applied to everything. If Destination, Source, or Network Protocol have Flow Class checked, the following happens: Destination Flow Class - Each destination flow is limited to the rate. Source Flow Class - All source flows combined must be less than or equal to the rate. Network Protocol Flow Class - Any data transported using this protocol is limited to the rate. For a diagram of this explanation, see the QoS chapter in the System Director Configuration guide.