(For clarification purposes: Kbps = Kilobits per second for bandwidth, KB/s = Kilobytes per second for file / data transfer stuff. I'm using them separately because XG knows KBps but not Kbps - similar things happen for Mbps and MB/s, etc.)

This is going to sound a little odd, but we have a case where we have an IPSec tunnel and need to implement QoS over the tunnel to not use more than 90Mbps total.

This infrastructure is set up with two Virtual Sophos XG firewall appliances on both sides of the tunnel. Office is where we're trying to set the QoS rules while Datacenter is where the majority of the central infrastructure for this office is located, in this diagram (which also shows the uplink speeds to the Internet at each location:

enter image description here

To that end, we've got the differing pipe sizes by a huge factor, so we don't want to simply let everything attempt to use more than 100Mbps of the tunnel. Further, we want to limit certain types of traffic over the VPN bidirectionally so that they combined never use more than certain amounts of traffic. (These are all at the same QoS priority level currently)

We've got QoS rules in place on the Office side such that traffic restrictions are put into place as follows:

enter image description here

Our network can communicate over this VPN tunnel with these rules, but we are not getting anywhere NEAR the bandwidth limits we've set. Specific examples of this would be the third rule, which gets its own 30Mbps Guarantee rule. This rule SHOULD permit data to flow for SMB (Microsoft file sync/share for Folder Redirection and Profile downloading) to flow at a much faster rate than, say, 100KB/s. Indeed, we should be getting closer to a couple MB/s instead for that transfer, even if that's split across bidirectional data transfer.

This said, with these QoS rate limits in place, we're getting poor network traffic rates, not matching anywhere near these limits. Further, we're concerned that without similar rules in place at the Datacenter side of things, we're going to innundate the pipeline so that it eats too much bandwidth out of the Datacenter pipe.

The question I have here is: should we be doing QoS on both sides of the VPN tunnel to enforce these limits in either direction? Or is doing the QoS simply on the one side of the network a sane way to go here?

  • QoS in 99% of the cases should be both ways unless you only need simple rate limiting – Matt Douhan Feb 6 '20 at 7:07
  • should we be doing QoS on both sides of the VPN tunnel - That entirely depends on how your product implements its QOS. Questions arise like: Is it buffering/delaying/dropping only egress packets (then yes, you might have to do it on both ends)? Is it doing the same to ingress/response packets, in general, or only for the given TCP flows matching the given policy (then you might get away with doing it only on one side)? And then you'll also have to consider in which direction to expect the data flows you want to set limits on - most of the time, these are of asymmetric nature... – Marc 'netztier' Luethi Feb 6 '20 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.