(For clarification purposes: Kbps = Kilobits per second for bandwidth, KB/s = Kilobytes per second for file / data transfer stuff. I'm using them separately because XG knows KBps but not Kbps - similar things happen for Mbps and MB/s, etc.)
This is going to sound a little odd, but we have a case where we have an IPSec tunnel and need to implement QoS over the tunnel to not use more than 90Mbps total.
This infrastructure is set up with two Virtual Sophos XG firewall appliances on both sides of the tunnel. Office is where we're trying to set the QoS rules while Datacenter is where the majority of the central infrastructure for this office is located, in this diagram (which also shows the uplink speeds to the Internet at each location:
To that end, we've got the differing pipe sizes by a huge factor, so we don't want to simply let everything attempt to use more than 100Mbps of the tunnel. Further, we want to limit certain types of traffic over the VPN bidirectionally so that they combined never use more than certain amounts of traffic. (These are all at the same QoS priority level currently)
We've got QoS rules in place on the Office side such that traffic restrictions are put into place as follows:
Our network can communicate over this VPN tunnel with these rules, but we are not getting anywhere NEAR the bandwidth limits we've set. Specific examples of this would be the third rule, which gets its own 30Mbps Guarantee rule. This rule SHOULD permit data to flow for SMB (Microsoft file sync/share for Folder Redirection and Profile downloading) to flow at a much faster rate than, say, 100KB/s. Indeed, we should be getting closer to a couple MB/s instead for that transfer, even if that's split across bidirectional data transfer.
This said, with these QoS rate limits in place, we're getting poor network traffic rates, not matching anywhere near these limits. Further, we're concerned that without similar rules in place at the Datacenter side of things, we're going to innundate the pipeline so that it eats too much bandwidth out of the Datacenter pipe.
The question I have here is: should we be doing QoS on both sides of the VPN tunnel to enforce these limits in either direction? Or is doing the QoS simply on the one side of the network a sane way to go here?