topic Re: qos in General Topics

qos

simsim — Fri, 05 May 2017 15:06:18 GMT

Hi,

After egress max set in the following order ,

If 100 Mb is the internet speed and through the trust link (1 GB) traffic is going other than untrust ( internet zone ) ,

the below configuration is ok ? .

class 1 10

class 2 10

class 3 10

class 4 40

class 5 10

class 6 10

class 7 5

class 8 5

Thanks

Re: qos

pulukas — Sun, 07 May 2017 12:19:13 GMT

Sorry, I'm not understanding the question fully.

I think you are wondering about applying a QoS setting to trust that would perhaps limit traffic pre-maturely because the internet bandwidth is much more limited than your local one.

This would be a concern and you should have the internet QoS only applied to your untrust internet facing interface and NOT the trust interface.

Re: qos

simsim — Sat, 13 May 2017 09:13:15 GMT

Hi,

Thanks for the reply

"This would be a concern and you should have the internet QoS only applied to your untrust internet facing interface and NOT the trust interface"

To limit the download bandwidth we should apply on our trust interface (egress ) , correct me if i am wrong ?

Thanks

Re: qos

pulukas — Sat, 13 May 2017 12:25:16 GMT

Download traffic is also egress on the untrust side as well.

I guess I don't follow what limitations you are trying to support.

Re: qos

simsim — Sat, 13 May 2017 15:02:16 GMT

Hi,

I was trying to limit download from the internet by the user who is sitting inside the campus network .

If I have internet bandwidth 100 Mbps, all the suers ( from class 1 - 8 ) should not send traffic to the service provider more than that ( I mean ISP should not have a chance to drop the traffic ) .

Hope I could clarify

Thanks

Re: qos

Raido_Rattameister — Sat, 13 May 2017 16:18:13 GMT

QoS has to be applied to the interface where traffic will exit firewall.
For download traffic it has to be applied to trust interface.

Only be careful if you have multiple zones.
Assume you have 3 zones - internet, servers, users.
If you apply QoS on "users" zone then it means that download is limited from internet>users and also servers>users.

To avoid that you should tune QoS interface > Clear Text Traffic
Also same place is where you set your Egress Max 100Mbit.
It does not make sense to set Classes so that aggregate max is 100Mbit becase your traffic will never balance between classes to get full 100Mbit.

Re: qos

simsim — Sun, 14 May 2017 07:39:57 GMT

Hi,
We should apply all the egress interface (inside and outside ) to limit the download and upload .
For example user a is trying to access website cnn.com from the internal host ,
the traffic is flowing from the internal network to internet and also in reverse direction .
let 's say if we have 100 Mbps internet bandwidth and if we have profile only to limit the download (on the inside interface)
the traffic will flow from the internal network to the internet ,So there is chance ISP drop this traffic(so the traffic does not exceed network capacity which is alotted by the ISP )
Please correct me if I am wrong

So we should have profile on both egress( internal and wan) .

Thanks