网络需求
内网有 200 用户，使用华为USG5150连接公网，总带宽为50Mb，要求内网每一个用户保证带宽为200KB/S，最大带宽为512KB/S,上传带宽最大为125KB/S以保证用户都能正常上网和业务延迟不能太大。同时需要保证对迅雷等PTP下载一样限速在范围之类。
说明：
当前华为设备防火墙和路由器都已经能支持基于IP地址限速功能，防火墙支持更好。
配置思路
需要对每一个内网的IP限速。如果只是简单的端口限速是肯定满足不了需求的。因为每一个用户对网络的需求都不相同，使用了各种业务各种端口各种服务类型。
所以配置IP限速需求以下：
1、服务模板，如ftp，ptp等等这些需要限制的类型
2、定制限流策略，也就是流量大小，连接数量等等的设定。
3、在域之间引用服务模板和策略。
在配置前一定要明白域间的inbound和outbound 定义。因为与端口规定不一样。
安全域间的数据流动具有方向性，包括入方向（Inbound）和出方向（Outbound）。
l 入方向：数据由低优先级的安全区域向高优先级的安全区域传输。
l 出方向：数据由高优先级的安全区域向低优先级的安全区域传输。
配置命令
1、配置服务模板
ip service-set ip_server type group service 0 service-set http service 1 service-set ftp service 2 service-set pptp service 3 service-set l2tp service 4 service-set tcp service 5 service-set udp service 6 service-set telnet service 7 service-set ras service 8 service-set dns service 9 service-set rtsp service 10 service-set ils service 11 service-set hwcc service 12 service-set smtp service 13 service-set sip service 14 service-set sqlnet service 15 service-set netbios-name service 16 service-set netbios-session service 17 service-set netbios-data service 18 service-set qq service 19 service-set stun service 20 service-set msn-stun service 21 service-set mgcp service 22 service-set mms service 23 service-set rpc service 24 service-set h225 service 25 service-set icmp service 26 service-set msn service 27 service-set msn-audio service 28 service-set msn-discard service 29 service-set tftp service 30 service-set https service 31 service-set ssh service 32 service-set imap service 33 service-set dns-tcp service 34 service-set gre service 35 service-set ah service 36 service-set esp service 37 service-set gtp service 38 service-set pop3 service 39 service-set gtpv0 service 40 service-set gtpv1 service 41 service-set gtpu service 42 service-set icmpv6 service 43 service-set stun64 service 44 service-set bootps service 45 service-set discard-udp service 46 service-set dnsix service 47 service-set echo-udp service 48 service-set mobileip-ag service 49 service-set mobileip-mn service 50 service-set nameserver service 51 service-set netbios-dgm service 52 service-set netbios-ns service 53 service-set netbios-ssn service 54 service-set ntp service 55 service-set rip service 56 service-set snmp service 57 service-set snmptrap service 58 service-set sunrpc-udp service 59 service-set syslog service 60 service-set tacacs-ds service 61 service-set talk-udp service 62 service-set time-udp service 63 service-set who service 64 service-set xdmcp service 65 service-set h323 service 66 service-set bgp service 67 service-set chargen service 68 service-set cmd service 69 service-set daytime service 70 service-set discard-tcp service 71 service-set echo-tcp service 72 service-set exec service 73 service-set finger service 74 service-set gopher service 75 service-set hostname service 76 service-set irc service 77 service-set klogin service 78 service-set kshell service 79 service-set login service 80 service-set lpd service 81 service-set nntp service 82 service-set pop2 service 83 service-set sunrpc-tcp service 84 service-set tacacs service 85 service-set talk-tcp service 86 service-set time-tcp service 87 service-set uucp service 88 service-set whois service 89 service-set biff service 90 service-set bootpc
ip service-set ip_server type group 创建一个服务组模板并进入模板视图 ip_server 是服务组的名称，在后面需要引用就使用它。 service 89 service-set biff ，这个命令是在服务模板视图下定义一条需要匹配的服务类型。数字是定义规则的ID，最后的关键字是 服务的类型，
2、配置限流策略，包括上传和下载
car-class per_ip_in type per-ip reference-mode per-policy connection-number 20 car max 4096 guaranteed 1600
car-class per_ip_in type per-ip ： 创建一个策略，名称为 per_ip_in , 类型为 per_ip 既是每个IP，还可以选择一个网段或者一个固定的地址等等。。 这个策略我作为 下载策略。
几个命令解释是：匹配策略的模式为每条策略，最大连接数为20 ，最大带宽4096，保证带宽1600.
请注意这里的单位是 kb/s , 所以请自己换算好 KB 与 Kb 的换算。注意的是在IT中 M 和 K 之间的换算，只有表示文件大小的时候 1M =1024K，否则换算关系是 1000 倍。
car-class per_ip_out type per-ip reference-mode per-policy connection-number 20 car max 1000 guaranteed 80
以上策略是用来限制上传的。最大125KB，保证10KB，如果只是上网 10KB的上传速度足够了。
3、在安全域trust untrust之间绑定出入策略。
traffic-policy interzone trust untrust inbound per-ip policy 0 action car policy service service-set ip_server policy car-type destination-ip policy car-class per_ip_in
注意的是policy是针对目的地址还是源地址。因为我们要限制内网的下载速度，所以应该是选目的地址，因为是入方向。
traffic-policy interzone trust untrust outbound per-ip policy 0 action car policy service service-set ip_server policy car-type source-ip policy car-class per_ip_out
这里需要选的是源IP，因为是上传，自然要选源IP。
4、验证，开个迅雷下载东西试试~
