Equal WAN bandwidth for all LAN devices using Sonicwall NSA 2400/2600

Question

I have a Sonicwall NSA 2400 (soon to replace with NSA 2600). The LAN has a widely varying number of users/devices. Some days there are 10 people onsite, some days 75-100. I want to be able to equally and dynamically allocate our WAN bandwidth (about 75 Mbps down, 20 Mbps up) to each device on the LAN.

On the days with 10 devices onsite, each device should get 1/10th the bandwidth. On the days with 75 devices, each device gets 1/75th. Or, 10 devices downloading something via the WAN connection, each device gets 1/10th bandwidth. The goal is fairness to all devices. I don't want to prioritize traffic types (i.e. HTTP, FTP, etc.); I don't care what the device is doing on the internet, they just need to have about equal bandwidth to everyone else. What they do with their slice, we don't care.

I'm familiar with the bandwidth management settings where I can put an absolute limit on the bandwidth, e.g. 1,000 Kbps. I can't do this because we would have massive underutilization of the available bandwidth on the days with fewer devices onsite.

I'm not sure if the Sonicwall has some existing settings I could configure to achieve this goal? Or do I need to look at some QOS configuration to achieve this?

Thanks in advance.

Edit in response to comment from Ron The goal is fairness of available bandwidth but without wasting it when there's only a few people. So if only 2 devices are using the internet connection, each should get roughly half. After posting this question, I did more digging on my NSA 2400. After upgrading firmware to 5.9 I get a checkbox in Firewall > Bandwidth Objects to put a per-IP kpbs max. But this doesn't work as desired since the number of devices using the internet varies.

Answer 1

I know this is an older post, but in case someone else stumbles upon it like I did, I wanted to provide some input.

So far, the only way to do this that I know of is with Mikrotik's PCQ (per-connection queuing) algorithm. It's not too hard to set up and there's a ton of guides out there to show you how. But it basically makes a packet queue for each device on your network and as the link hits your specified bandwidth limit (typically you set it to your ISP's limit) it begins dropping packets from the highest speed queues until all queues reach the same speed. Then it drops packets equally from each.

There is an option to set a fixed limit per queue, but if you don't set a limit it works the way I described.

This is particularly useful in hospitality environments, like hotels, since it basically dynamically adjusts your bandwidth limits per device as your occupancy changes.

Answer 2

This can also be done with the limiter in pfSense's traffic shaper (and probably many other systems have some way to get there) - m0n0wall did in the simplest way possible (one button to "share bandwidth equally", which folks on pfSense have asked for and not gotten), but I guess m0n0wall's moved into being abandonedware.

Per @RonTrunk's question, with the pfSense Limiter (being the one I use, as I assume @Andrew uses Microtik's) it does appear that the 2 active devices each get half the bandwidth, or if one is only looking for 20% the other gets 80%. However, in practice it's really a somewhat smaller figure since the "root" limiter that gets split up among the child queues needs to be a bit smaller than the actual maximum bandwidth for the limiter to work correctly (it needs to be shaping the traffic, not an upstream device.)

Details on how I do it are here: https://forum.pfsense.org/index.php?topic=99529.msg555886#msg555886 and additional detail is provided here (it links to the message above, but fills in some additional details) https://forum.pfsense.org/index.php?topic=101774.msg569030#msg569030

I make no claim that it's the be-all end-all, but it works (for @RossC's desired version of work) better than anything else I've tried so far with some truly painful loading on it (I'm in desperate need of a bigger pipe, but it's endlessly delayed in getting here.)

I used to do hard per-user limits. This works much better.