Amer Networks E5Web GUI - Manual (Page 659)

Clavister Security Gateway. Different rate limits and traffic guarantees can be created as policies
based on the traffic's source, destination and protocol, similar to the way in which security
policies are created based on IP rules.
The two key components for traffic shaping in cOS Core are:
• Pipes
• Pipe Rules
Pipes
A Pipe is the fundamental object for traffic shaping and is a conceptual channel through which
data traffic can flow. It has various characteristics that define how traffic passing through it is
handled. As many pipes as are required can be defined by the administrator. None are defined by
default.
Pipes are simplistic in that they do not care about the types of traffic that pass through them nor
the direction of that traffic. They simply measure the aggregate data that passes through them
and then apply the administrator configured limits for the pipe as a whole or for Precedences
and/or Groups (these concepts are explained later in Section 10.1.6, “Precedences”).
cOS Core is capable of handling hundreds of pipes simultaneously, but in reality most scenarios
require only a handful of pipes. It is possible that dozens of pipes might be needed in scenarios
where individual pipes are used for individual protocols. Large numbers of pipes might also be
needed in an ISP scenario where individual pipes are allocated to each client.
Pipe Rules
One or more Pipe Rules make up the cOS Core Pipe Rule set which determine what traffic will flow
through which pipes.
Each pipe rule is defined like other cOS Core security policies: by specifying the
source/destination interface/network as well as the service to which the rule is to apply. Once a
new connection is permitted by the IP rule set, the pipe rule set is then checked for any matching
pipe rules.
Pipe rules are checked in the same way as IP rules, by going from top to bottom (first to last) in
the rule set. The first matching rule, if any, decides if the connection is subject to traffic shaping.
Keep in mind that any connection that does not trigger a pipe rule will not be subject to traffic
shaping and could potentially use as much bandwidth as it wants.
Note: No pipe rules are defined by default
The rule set for pipe rules is initially empty with no rules being defined by default. At least
one rule must be created for traffic shaping to begin to function.
Pipe Rule Chains
When a pipe rule is defined, the pipes to be used with that rule are also specified and they are
placed into one of two lists in the pipe rule. These lists are:
• The Forward Chain
These are the pipe or pipes that will be used for outgoing (leaving) traffic from the Clavister
Chapter 10: Traffic Management
659