Network bandwidth management and priority

Question

I'm trying to understand the mechanism by which bandwidth is consumed so that I can set the appropriate QoS and/or priority policies on the firewall. Here's the scenario:

Our setup is a Fortigate 60E that sits between our LAN and an AT&T Managed Router with a 10Mbps connection.

When there is no one inside our facility but me, I initiate a single request from my PC browser to a site that starts the download of a 180Mb file. I can watch the bandwidth usage graph for the internal and external interfaces immediately jump to 10Mbps (i.e. the full limit of our service) and, when the download completes, the throughput graph drops back down to 0.

Before the download completes, I initiate another browser request (pick your typical news site with images and text), the firewall graph of bandwidth usage stays at 10Mbps and my second request ultimately gets served.

My question is this: what determines how much bandwidth is allocated to my second browser request? Furthermore, since the default priority (according to Fortigate) is that all requests have a default priority of "high" how are "competing requests" resolved? Clearly it's not sequential (first come, first served) because the second request is fulfilled before the first request (download) is completed.

When there are 10 or 15 people in the office, this scenario will be repeated and amplified many times over. I don't have VOIP or email or an ecommerce server that I need to elevate or prioritize over "normal" internet use. I just have a bunch of people accessing the web simultaneously and they have an expectation of a reasonably responsive internet. So I want to prevent the first requestor having a super fast awesome experience while everyone else (i.e. the subsequent requestors) waits.

My initial thought was to set a maximum bandwidth for all requests (i.e. no request would be allocated more than say 1Mbps of bandwidth), thinking that this would prevent one request from sucking up all the bandwidth. Is this advisable? If so, how would you do it? (Traffic shaping policy? or something else?) Would changing the priority of all traffic to medium (vs. the default high priority) have a favorable effect? Would it be advisable?

I'm new to this stuff, our company is new and our IT infrastructure setup is fresh as well. Feel free to let me know if I'm just not thinking about this the right way. I've read a ton but understand less than half of the jargon that gets tossed around. A layman's explanation/response would be most welcomed!

Answer 1

What you are asking about is incoming data, and you have no real direct control over the bandwidth use of incoming data. Remember that by the time you see the incoming traffic in order to police it, it has already used your incoming bandwidth. It is really first-come, first-served.

It is likely that the servers are sending faster than your link from the ISP, and many packets are dropped and re-requested. TCP will strike a balance because it uses connections, but any incoming UDP traffic (including real-time traffic like VoIP or video) will not be controlled, and it can completely clog your incoming link. The best you can do for incoming traffic is to police (drop) it, and that will give you a rough control over TCP traffic, but nothing for connectionless traffic.

The only thing you can directly control are the QoS policies and implementation on your own network. Some ISPs will allow you to pay extra to give you some QoS on their network, but on the greater Internet, your QoS policies and markings are ignored or reset to BE (Best Effort). You can, and really should, mark high- and low-priority traffic on your own network, and you can shape it out your WAN link.

Don't go overboard on the classification of traffic; usually four or five classification are enough. VoIP should be priority, and control traffic for routing protocols and things like VoIP should be the second highest priority. Things like server backup or other bulk traffic that can interfere with your business traffic should be a low priority. The vast majority of your traffic should remain as BE. Most people first getting into QoS try to mark everything in many different classifications, but this is a rookie mistake. Keep it simple, and if you get a half-dozen classifications, then you should really rethink things.

Answer 2

Given the type of traffic you are describing, Ron Maupin is right about priorities. Since you are dealing with a varied number of users and therefore a varied amount of traffic you have to consider burst levels. Look at the QoS options you have with AT&T and what configuration settings on the Fortigate apply to traffic management and QoS.

You should consider at least Best Effort, Sensitive and Undesired traffic classifications. By filtering out Undesired traffic you can save bandwidth for real traffic, and not waste it on junk. You don't mention any network switches in your post, but you can also use those to do some traffic management. Again, check the configuration options.

I would also look into a network monitoring tool. It is somewhat reaction based but if you have alerts setup then you can find the troubled connection and delete it.