x
Creating a PKI domain ·······································································································································455
Creating an RSA key pair ··································································································································458
Destroying the RSA key pair ······························································································································459
Retrieving and displaying a certificate ·············································································································459
Requesting a local certificate ·····························································································································461
Retrieving and displaying a CRL························································································································462
PKI configuration example ··········································································································································464
Configuration guidelines ·············································································································································468
Configuring authorized IP ······································································································································ 469
Configuration procedure·············································································································································469
Authorized IP configuration example·························································································································470
Network requirements·········································································································································470
Configuration procedure ····································································································································470
Configuring port isolation······································································································································· 472
Overview·······································································································································································472
Configuring the isolation group··································································································································472
Port isolation configuration example··························································································································473
Configuring ACLs···················································································································································· 475
Overview·······································································································································································475
ACL categories ····················································································································································475
Match order ·························································································································································475
Rule numbering····················································································································································476
Implementing time-based ACL rules···················································································································477
IPv4 fragments filtering with ACLs ·····················································································································477
Configuration guidelines ·············································································································································477
Recommended ACL configuration procedures··········································································································477
Recommended IPv4 ACL configuration procedure ··························································································477
Recommended IPv6 ACL configuration procedure ··························································································478
Configuring a time range ···································································································································478
Adding an IPv4 ACL ···········································································································································479
Configuring a rule for a basic IPv4 ACL···········································································································480
Configuring a rule for an advanced IPv4 ACL·································································································482
Configuring a rule for an Ethernet frame header ACL ····················································································484
Adding an IPv6 ACL ···········································································································································486
Configuring a rule for a basic IPv6 ACL···········································································································487
Configuring a rule for an advanced IPv6 ACL·································································································488
Configuring QoS····················································································································································· 491
Introduction to QoS······················································································································································491
Networks without QoS guarantee·····················································································································491
QoS requirements of new applications·············································································································491
Congestion: causes, impacts, and countermeasures·······················································································491
End-to-end QoS····················································································································································493
Traffic classification·············································································································································493
Packet precedences·············································································································································494
Queue scheduling ···············································································································································496
Traffic shaping ·····················································································································································498
Rate limit·······························································································································································499
Priority mapping ··················································································································································500
Introduction to priority mapping tables·············································································································501
Recommended QoS configuration procedures·········································································································502
Adding a class ·····························································································································································504
Configuring classification rules···································································································································505