Smart Access Gateway (SAG) uses quality of service (QoS) policies to classify and prioritize network traffic across applications and services. Attach a QoS policy to an SAG instance to reduce network latency, prevent congestion, and ensure business-critical applications get the bandwidth they need.
How it works
A QoS policy consists of one or more traffic throttling rules, and each traffic throttling rule consists of one or more traffic classification rules, organized in two layers:
-
Traffic classification rules — identify traffic by matching packet attributes (5-tuple or application type) and assign it to a throttling rule.
-
Traffic throttling rules — define bandwidth limits and priorities. The QoS engine processes rules in priority order and allocates bandwidth accordingly.
When traffic arrives at an SAG instance, the QoS policy inspects each packet, matches it to a classification rule, and applies the bandwidth limits of the corresponding throttling rule.
Example: To prioritize video conferencing over file backups, create two throttling rules — one for video conferencing traffic (higher priority, guaranteed bandwidth) and one for backup traffic (lower priority, limited bandwidth). Traffic that does not match any rule follows the default behavior.
Traffic classification methods
SAG supports two methods for classifying traffic:
5-tuple
A 5-tuple rule matches traffic by five network attributes:
| Attribute | Description |
|---|---|
| Protocol | The protocol of the data packets |
| Source CIDR block | The source network from which packets originate |
| Destination CIDR block | The destination network to which packets are sent |
| Source port | The port from which packets are sent |
| Destination port | The port to which packets are sent |
When you create a 5-tuple, make sure that the values in the 5-tuple do not overlap with each other.
Application-aware classification
Use deep packet inspection (DPI) to classify traffic by application or application group — for example, to isolate video conferencing or VoIP traffic without knowing its IP addresses or ports.
Application-aware classification requires DPI to be enabled on the SAG instance. Only SAG instances with DPI enabled support this method. To enable DPI, see Manage DPI. For an overview of the DPI feature, see Overview.
The supported protocols, applications, and application groups are listed in the console. Console information takes precedence over any reference in this topic.
Get started
-
Create a QoS policy. Define traffic throttling rules and traffic classification rules for the policy. See Create and manage a QoS policy.
-
Attach the policy to an SAG instance. See Associate with or disassociate from an SAG instance.
Limitations
Traffic direction
| SAG software version | Traffic throttled |
|---|---|
| 2.3.2 or later | Inbound and outbound (by default) |
| Earlier than 2.3.2 | Outbound only (by default) |
Bandwidth range validation
When a QoS policy throttles traffic based on a bandwidth range, SAG does not validate whether the minimum and maximum bandwidth values meet the requirements of the attached SAG instances. Verify these values manually before applying the policy.
Quotas
| Resource | Limit | Adjustable |
|---|---|---|
| QoS policies per SAG instance | 1 | No |
| Traffic throttling rules per QoS policy | 3 | No |
| QoS policies per Alibaba Cloud account | 10 | Submit a ticket |
| Traffic classification rules per traffic throttling rule | 50 | Submit a ticket |