2

We upgraded from 20 Mbps to 50 Mbps DIA about two months ago. This required a router upgrade as well. Since then, anyone who starts a large HTTP download - e.g. an ISO, large spreadsheet or log, movie file, etc. - can take all of the available bandwidth and block others from accessing the internet.

The old router didn't have any kind of QoS configured on it. Further, it was a very vanilla config. It simply had some named ints, the security levels of each, and the IP addresses associated with each int. The ISP supplied the new router and we don't have access to view the config, but they said they don't have any kind of QoS configured on it either.

My questions are:

  1. Why when we had 20 Mbps service did we not have this problem where any one user could monopolize all the bandwidth to the internet?

  2. Am I correct in thinking that Quality of Service configurations would prevent this or does QoS simply identify which traffic has priority over another, and does nothing for competing traffic of the same type?

  3. If it's the latter, and my vocabulary is wrong, what statements do I need to configure and where (we have a Cisco 4507 core switch, a Cisco Pix on the primary ISP, a Cisco ASA on the backup ISP, and the inaccessible ISP router is a Cisco 2911) so that no one user can take all the available bandwidth to our internet connection?

3 Answers 3

1

You use QoS. Cisco has extensive QoS support. QoS is really a subject far too large to treat here. QoS is a very large and complex subject that encompasses everything from classifying and marking packets, to performing some sort of action (shaping, policing, queuing, etc.) based on the classification/marking.

QoS is about fairness, as you define it. First you need to classify the traffic. Basically marking the packets with separate TOS/DSCP marking for the different traffic types. This is best done as close to the traffic source as possible. Once you have classified and marked the traffic, you can apply your fairness doctrine.

Understand that your QoS markings and policies will not be honored on the Internet, and that you have no real control over incoming traffic, since by the time you see the incoming traffic, the bandwidth has already been used. You can police (drop) incoming traffic, but only after it has used your incoming bandwidth. The caveat to that is with TCP because a TCP connection requires acknowledgement, and you can disrupt that to a degree, but it is not as exact as you can do with outgoing traffic.

Once you research and understand QoS, we can help with specific questions.

2

Why when we had 20 Mbps service did we not have this problem where any one user could monopolize all the bandwidth to the internet?

A TCP connection should back-off when it detects congestion, not "hog all the bandwidth". If one TCP connection to a remote device running a normal TCP/IP stack can render your connection unusable then something is seriously wrong. .

A couple of possible causes spring to mind.

  1. A badly designed bandwidth limiter that allows a burst way in excess of your nominal speed then suddenly cuts off leading to massive packet loss.
  2. A massively oversized buffer, this can happen by accident when a relatively slow link is terminated on a big fast device. TCP won't start backing off until packets are actually dropped, so an oversized buffer just leads to a bunch of extra latency.

Both are more likely to be at the ISP end than your end.

Am I correct in thinking that Quality of Service configurations would prevent this or does QoS simply identify which traffic has priority over another, and does nothing for competing traffic of the same type?

QoS is about assigning priorities to packets and then making queuing decisions based on those classifications. Different systems may support different tools for assigning said classifications. Generally it is used to separate traffic into tiers.

The problem with any traffic prioritization or fairness enforcement is to be effective it must be implemented at the bottleneck. That is fine if you control the whole network end to end, but it becomes a problem when you start talking about links to an ISP. Assuming you are running a downstream dominated network the bottleneck is likely at the ISP end not your end.


Ideally you would work with the ISP to troubleshoot, since you are paying for dedicated internet access (I presume that is what the DIA acronym in your post means). I would hope you have access to support personnel with a clue.

Which leaves the final aspect, if you can't get the ISP to work with you and you can't move away from them to a better ISP then what can you do about it from your end? The answer paradoxically is often to introduce your own bottleneck with a slightly lower bandwidth than that if your ISP link. That way packets are dropped and TCP backs off before the problems at the ISP rear their ugly heads.

0

In next generation firewall ,we have feasibility to limit bandwidth utilization of specific users with respect to time .

Bandwidth can be controlled to maximum extend using this features .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.