Example: Configuring Virtual Channels on a Security Device

Requirements

Before you begin, ensure that your headquarters and branch office have a network connection where the expected aggregate bandwidth is higher for your headquarters than for your branch office. The devices at your headquarters will then be set up to limit the traffic sent to the branch office to avoid oversubscribing the link.

Overview

In this example, you create the virtual channels as branch1–vc, branch2–vc, branch3–vc, and default-vc. You then define the virtual channel group as wan-vc-group to include the four virtual channels and assign the scheduler map as bestscheduler to each virtual channel. Three of the virtual channels are shaped to 1.5 Mbps. The fourth virtual channel is default-vc, and it is not shaped. Hence can use the full interface bandwidth.

Then you apply them in the firewall filter as choose-vc to the device's irb interface. The output filter on the interface sends all traffic with a destination address matching 192.168.10.0/24 to branch1-vc, and similar configurations are set for branch2-vc and branch3-vc. Traffic not matching any of the addresses goes to the default, unshaped virtual channel.

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from the configuration mode.

Step-by-Step Procedure

1. Define the virtual channels and the default virtual channel.
2. Define the virtual channel group and assign each virtual channel a scheduler map.
3. Specify a shaping rate.
4. Apply the virtual channel group to the irb interface.
5. Create the firewall filter to select the traffic.Note

   Separate traffic and scheduling for different traffic streams with different priorities/bandwidths.

   In production use, there is no need to classify the same stream traffic into different classes. You may choose your own criteria to classify traffic into different vc, such as src/dst ip, port number, protocol, and so on.
6. Apply the firewall filter to output traffic.

Results

From configuration mode, confirm your configuration by entering the show class-of-service, show firewall, and show interfaces irb commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Verification

Verifying Virtual Channel Configuration

Purpose

Verify that the virtual channels are properly configured.

Action

From configuration mode, enter the show class-of-service, show firewall, and show interfaces irb commands.