6

We're in an office environment of about 50 people. A few departments send emails with large attachments extensively and doing so clogs up the WAN connection (10Mbps).

I'm upgrading the networking equipment so that it now uses Cisco 1921/K9 router along with a Cisco SG300 managed switch and a few Cisco SF200E switches (no extra modules/bundles were purchased for these equipments).

I've set up VLANs that will group certain departments together and set up bandwidth limits for each, but if one person decides to send out a huge email it will still affect other people. How do I throttle one specific node--preferably automatically--with my current equipment?

Improve this question
5
  • How large is the wan circuit at this site?
    – Mike Pennington
    May 30, 2013 at 6:50
  • @MikePennington quite simple actually. We are only connected to the internet via fiber.
    – lamp_scaler
    May 30, 2013 at 7:06
  • I think @MikePennington meant how much bandwidth is available on your WAN connection, i.e. to the internet.
    – Stefan Radovanovici
    May 30, 2013 at 19:16
  • @StefanRadovanovici 10Mbps dedicated fiber
    – lamp_scaler
    May 31, 2013 at 6:14
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Dec 20, 2020 at 18:35

3 Answers 3

Reset to default
6

Expanding upon @javano's answer...

I would change one thing, instead of policing the email traffic (which will drop traffic exceeding that rate) I would recommend just setting aside a small amount of bandwidth for that traffic. Therefore, if nobody else is using the link the email can utilize the unused bandwidth

policy-map PM-Limit-Emails
 class CM-Match-Critical-Apps
  bandwidth percent 50
 class CM-Match-Scavenger
  bandwidth percent 1
 class class-default
  bandwidth percent 20
  fair-queue

I didn't get a sense of if the issue was the sending (outbound) or receiving (inbound) of large attachments so, since you are just connected to the internet, there will be the potential that this issue will continue as the ISP is not throttling the traffic (inbound) based on your classifications. If you have a business class internet service there may be the possibility for them to install a similar policy on their end of your link but you will need to talk with your ISP to determine what, if anything, they will support.

Improve this answer
4
  • If I am not mistaken using percentages won't work as expected at all if the available WAN speed is different than the speed of the WAN interface. The WAN interface is most likely 100Mbps or even 1Gbps depending on the router. The Internet connection is likely much less than that. Usually in those cases a nested policy map is used, with the outer policy map shaping the bandwidth to the actual WAN speed in its class-default class. Then the inner policy map can use percentage in its classes.
    – Stefan Radovanovici
    May 30, 2013 at 19:21
  • You are not mistaken, however since that level of detail was not in the question I did not try to make it more complicated by going there. That does seem like a good topic for a new question though.
    – Mike Marotta
    May 30, 2013 at 19:33
  • @StefanRadovanovici, does the nested policy still work (potentially) if your inbound traffic is always multiples of your outbound traffic such as with HTTP requests (small # of packets) that lead to orders of magnitude in packets for the HTTP responses?
    – generalnetworkerror
    Jun 1, 2013 at 7:48
  • @generalnetworkerror the nested policy map would be applied in the outbound direction and will work ok regardless of the inbound traffic on the same interface. Of course, this is only half the story. Ideally the ISP would also shape the traffic in their outbound direction (inbound for you).
    – Stefan Radovanovici
    Jun 1, 2013 at 11:04
3

Based on the information you have given;

You could use a configuration like the below sample to limit traffic to a specific remote IP (I assume you need to limit traffic to your remote email server, which isn't on site, otherwise you simply could rate limit traffic to/from the email server and your WAN connection);

class-map match-any CM-Match-Email-Server
  description Shape connections to email server
 match access-group 133
!
policy-map PM-Limit-Emails
 class CM-Match-Email-Server
   police cir 175000 pir 175000
     conform-action transmit 
 class class-default
  fair-queue
!
interface Fa0/1
 description YOUR-WAN-CONNECTION
 service-policy output PM-Limit-Backups
!
access-list 133 remark ACL-Offsite-Email-QoS 
access-list 133 permit ip 192.168.0.0 0.0.0.255 1.2.3.4 0.0.0.127 ! Remote email server subnet
access-list 133 permit ip 192.168.0.0 0.0.0.255 host 3.4.5.6 ! Or specific email server IP

Obviously you would need to change the police rate to match your requirements.

Improve this answer
0

This sounds more like a policy issue to me. Why do they need to send such large attachments? The options you have as I see it:

  • Throtte all e-mail traffic
  • Enforce policy to not allow large attachments
  • Educate users to use FTP or some collaboration software like MS Sharepoint
  • Throttle the above application if needed

Higher end devices supports something called microflow policing but it's not available on the ISR G2 as far as I know.

Improve this answer
5
  • The send large attachments because we do document-related services and client documents need to be emailed back to them. How does one throttle the email traffic, via device settings or at the application level?
    – lamp_scaler
    May 30, 2013 at 4:32
  • 1
    On the ISR you could use NBAR and then match protocol imap or match protocol pop3 depending on what you use for your mail. Then use a policy that shapes/polices that to a certain amount of BW appropiate for not using more then you can afford to spare on the WAN link.
    – Daniel Dib
    May 30, 2013 at 4:52
  • I see, what about smart throttling in general? Say if there is only one computer using a lot of bandwidth it's okay, but 2 people start using a lot then the 1st person need to be throttled down so it is averaged out, and so forth when other computers start needing bandwidth.
    – lamp_scaler
    May 30, 2013 at 5:51
  • 1
    You could try implementing fair-queuing. This should let new flows share the bandwidth with existing flows. Flows with better QoS marking will get more preferential treatment.
    – Daniel Dib
    May 30, 2013 at 5:57
  • You really should look at some form of a document management system or web file transfer tool, there's a whole bunch of reasons why SMTP is a horrible file transfer protocol, relevant to this question is that it balloons the file size by over 10% during transmission.
    – LapTop006
    May 30, 2013 at 10:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.