How to set up QoS?

[GJOB]

Afternoon,

I've a need to stop any one user hogging all the bandwidth and protect the SIP to make sure calls get through.

Using a Sophos UTM9 and actually implementing the configuration looks straight forward but I don't know how to create an optimal configuration.

Is it possible to have a smart QoS that limits any user to say 80% of the bandwidth or would I have to apply it individually to each IP address?

Any with QoS and Sophos experience would be a godsend.

Thanks.

[danpalmer1993]

Been a while since I did any of this but I think you can apply to an individual user or a group.

[crusty]

Just mark voice traffic and set as priority

[GJOB]

crusty said:

Just mark voice traffic and set as priority

That protects the SIP but it doesn't prevent a single user hogging everything else. How could that be overcome?

[crusty]

GJOB said:

crusty said:

Just mark voice traffic and set as priority

That protects the SIP but it doesn't prevent a single user hogging everything else. How could that be overcome?

Depends on what the user is using the bandwidth for, if you prioritise the important traffic, then let say the rest (30%) be a free for all.

Or increase the bandwidth if the users use is legitimate?

[ffc]

Can you rate limit the bandwidth for the one user? (I have no Sophos UTM experience).

[ging84]

In my experience any kind of QoS or traffic management outside of large enterprise networks is essentially window dressing, they can do lan support fairly easily, but typically on a small office or home network there is almost never congestion there, its the wan side you need to manage the traffic and that is much harder to do.
You can limit outbound traffic, but unless you've got an asymmetric connection with a fairly poor upload bandwidth that will rarely be the problem either.
Without ISP support there isn't much you can do to limit incoming wan traffic efficiently. You can drop the packets at your end and get the other end to back off, but you need to do that fairly aggressively for that to work, and you isp has no idea you will be dropping those packets, so they are sent in full consuming your bandwidth.

[Ozone]

You could try this rule if it's downloads that you need to restrict to protect traffic

https://community.sophos.com/kb/en-us/119111

to help set this up there is some bedtime reading here

https://community.sophos.com/products/unified-thre...

Edited by Ozone on Wednesday 13th November 21:57

[GJOB]

Ozone said:

You could try this rule if it's downloads that you need to restrict to protect traffic

https://community.sophos.com/kb/en-us/119111

to help set this up there is some bedtime reading here

https://community.sophos.com/products/unified-thre...

Edited by Ozone on Wednesday 13th November 21:57

I had already read the first link but it was unhelpful in that it told you how to set it up but not why you would choose one of the three options "Source, Service and Destination".

I've created a rule for the SIP so thats protected but today, for example, one user was downloading 10GB of Unreal content and it hogged everything, but last week another user was downloading a ton of data from AWS and it did the same so it's not the same sources and it's not the same IP addresses - users all over the place complain they can't do anything (everything we do is via the web).

If I cap a user then they'll never get the maximum download even when the network is quiet.

Perhaps I need to look at protecting the core SaaS applications we use to guarantee them some traffic when the network is congested?

[thebraketester]

Not sure if you can do it on that system but they way it’s done on UniFi stuff is by using vlans.

You have all the SIP on one vlan, all Wi-Fi ( or wired LAN) connections on another. Then you can set a limit on the Wi-Fi (or lan) connections for say 5mbps or what ever it needs to be.

[anonymous-user]

You mention big downloads crippling the downloads for everyone else. It sounds like you "might" be swamping your upload bandwidth. For every amount of download bandwidth, a small amount of upload bandwidth is needed , for the network protocol. If you use up your upload bandwidth it will bring your downloads to a complete halt.

It's not enterprise, but I've had to limit upload bandwidth on my router or large uploads to YouTube etc totally stop any downloads. This is because my ISP clearly doesn't manage the traffic properly (started when I switched from BT to Voda broadband).

Just a thought (as it's quite hard to overload download bandwidth with pure download quantity - the ISP end usually handles the sharing of the bandwidth quite well).