Configuring a Traffic Policy

Procedure

1. Choose Policy > Bandwidth Management > Traffic Policy.
2. Click Add.
3. Specify the policy name, policy description, and the parent policy.

   Parameter	Description
   Name	Name of a traffic policy. Enter a unique name for the traffic policy.
   Description	Description of a traffic policy. Describe the traffic policy in a way that helps administrators understand the function of the traffic policy and enables easy policy query and maintenance.
   Tag	The tag identifies and categorizes the policy. You can query policies based on tags and delete, move, enable, or disable policies in batches based on the query results. For the tag description and configuration, see Tag.
   Parent Policy	Name of the parent policy to which a traffic policy belongs. The parent policy must be an existing traffic policy.

4. Configure traffic policy matching conditions.

   A packet is considered to match a traffic policy only if the packet matches all the conditions in the traffic policy. A matching condition may specify multiple traffic attributes. A packet that matches any of the traffic attributes in the matching condition is considered to match the condition.

   Configure traffic policies in descending order of precision, from the most specific to the least specific.

   Parameter	Description
   Source Type	Source information type, which can be Source Zone or Inbound interface.
   Source Zone	Name of a security zone that sends traffic. You need to configure this parameter only if you set Source Type to Source Zone.
   Inbound Interface	Name of an interface that receives traffic. You need to configure this parameter only if you set Source Type to Inbound interface.
   Destination Type	Destination information type, which can be Destination Zone or Outbound interface.
   Destination Zone	Name of a security zone that receives traffic. You need to configure this parameter only if you set Destination Type to Destination Zone.
   Outbound Interface	Name of an interface that sends traffic. You need to configure this parameter only if you set Destination Type to Outbound interface.
   Source Address/Region	Source IP addresses in traffic. Address and address group: You can specify an IP address, a MAC address, or a continuous IP segment. You can also incorporate MAC address sets, discontinuous IP addresses, and continuous IP address that cannot be represented by network or subnet masks in to an address group. For details, see Address and Address Group. NOTE: To exclude an address or address group (source address or source addresses of traffic) from policy matching, select the address or address group from the available address area, select it in the selected address area and click Invert , and then click OK. Domain group: You can specify a domain group to set the IP addresses of some specific domain names as the policy matching conditions. For details, see Domain Group. NOTE: When an IP address corresponds to multiple domain names, an IP address can be used to search for a maximum of 16 domain names. If the domain name to be searched is not in the policy rule, the policy cannot be matched. You are advised to configure multiple domain names with the same IP address in the same policy rule. Region and region group: You can specify a region or region group as a match condition of a policy. For details, see Region and Region Group. You can manually enter IP/MAC addresses or select an existing address object from the drop-down list. The icons in the drop-down list are described as follows: represents an address. represents an address group. represents a domain group. or national flags represent a country or region. User-defined regions are displayed on top of predefined regions. Region is a group of addresses classified by region. represents a region group. When there are multiple available options, you can select Address or Region from the drop-down list, improving the configuration efficiency. When only Address is selected, the drop-down list displays all optional addresses, address groups, and domain groups. When only Region is selected, the drop-down list displays all optional regions and region groups. NOTE: If the traffic limiting mode is per-IP CAR, the PC to limit traffic rate has multiple IP addresses, and all traffic from these IP addresses to the destination network passes through the FW, you need to add all the IP addresses to the traffic policy. Otherwise, traffic limiting might be inaccurate. For example, a PC accesses the Internet using IP addresses 10.3.1.1 and 10.3.2.1, and the maximum downstream bandwidth of the PC must be limited to 1 Mbit/s. You need to set both 10.3.1.1 and 10.3.2.1 as the source address matching condition in the traffic policy and reference the traffic profile with the downstream bandwidth limit set to 1 Mbit/s.
   Destination Address/Region	The destination address, destination address group, destination domain group, destination region, or destination region group of traffic. If the attribute of a packet matches one of the previous values, the packet meets this condition. Destination addresses and regions define the hosts and servers that can be accessed. NOTE: When an IP address corresponds to multiple domain names, an IP address can be used to search for a maximum of 16 domain names. If the domain name to be searched is not in the policy rule, the policy cannot be matched. You are advised to configure multiple domain names with the same IP address in the same policy rule. The destination configuration is similar to source configuration. When there are multiple available options, you can select Address or Region from the drop-down list, improving the configuration efficiency. When only Address is selected, the drop-down list displays all optional addresses, address groups, and domain groups. When only Region is selected, the drop-down list displays all optional regions and region groups. NOTE: To exclude an address or address group (destination address or destination addresses) from policy matching, select the address or address group from the available address area, select it in the selected address area and click Invert , and then click OK.
   User	Name of a user that sends traffic. The value can be a User, User Group, or Security Group. You can reference local users, user groups, or security groups or create new ones. If the server has a great number of users, user groups, or security groups and only some of them need to be imported to the FW to implement policy control, select Server Import from the matching conditions of User, online query and import the desired users, user groups, or security groups, and then reference them in policies. NOTE: Only the AD and AD LDAP servers support online query and import of users, user groups, or security groups. Before that, you need to configure a server import policy in the New User Authentication Options and associate an authentication domain with the configured server import policy. The server import policy determines the target groups, online query path, and filtering parameter. However, the import type configured in the server import policy does not take effect in this function. The user name (cn value) on the server is suggested to be the same as the login name (sAMAccountName value). A policy can reference a maximum of 64 users, user groups, or security groups. Select Import from Server from the matching conditions of User. If Type is set to User, the device will imports only the names of users, not the user groups or security groups to which the users belong.
   Service	The protocol type of the traffic. Services can be predefined or user-defined. Predefined services are well-known services, such as HTTP, FTP, and Telnet. You can also define services as needed. User-defined services are configured by specifying information such as port number. User-defined services fall into three types and the configuration methods are described as follows: For TCP/UDP/SCTP packets, you must specify the source and destination ports. For ICMP packets, you must specify the ICMP message type and code. For IP packets, you must specify the protocol number in the IP header. You can also create a service group and add predefined and user-defined services to the group. For details, see Service and Service Group. NOTE: To exclude a service or service group (service or service group of traffic) from policy matching, select the service or service group from the available service area, select it in the selected service area and click Invert , and then click OK.
   Application	Application of the traffic. A service may be used by multiple applications. Therefore, applications are more fine-grained than services. Applications can be predefined or user-defined. You can also create an application group and add predefined and user-defined applications to the group. In addition, you can reference an application label to control traffic that matches the label or reference software to control traffic that matches this type of software. For details on applications, application groups, application labels, and software, see Application and Application Group. NOTE: The FW supports the fuzzy search function, which helps you rapidly search a needed application. To search an application, perform the following steps: Click Multiple. Enter an application name or a part of the application name. Click . The application with the specified name appears in the drop-down list. Select the needed application name and add the application.
   URL categories	Select or create a URL category. URL categories are classified into predefined and user-defined ones. You can use predefined categories or create user-defined categories based on Configuring User-defined URL Categories.
   Time Range	Validity period of a traffic policy.
   DSCP Value	DSCP priority carried in packets.

5. Specify actions and reference a traffic profile.

   Parameter	Description
   Action	Action that is taken to process traffic. The value can be Limit or None.
   Traffic Profile	Name of a traffic profile. You need to configure this parameter only if you set Action to Limit.

   

   The link to [Add Security Policy] is provided on the web UI. You can click the link to access the Add Security Policy page and rapidly create a security policy based on the configured traffic policy matching conditions to permit traffic. In addition, the Add Security Policy page support Switch Source and Destination and OK and Copy for configuring security policies for forward and return traffic.

6. Click OK.