topic Re: Simple QoS rule not working in Firewall and Security Management

Simple QoS rule not working

arcotangente — Fri, 22 May 2020 08:21:51 GMT

Hi,

I'm trying to make a simple QoS rule work but not success.

The plan seems to be simple: we have an IPSEC tunnel between our Checkpoint gateway (4600, R80.10) and a third-party.

QoS blade is enabled, and I've just put a couple or rules in place, one with the public IP of the third-party as source, and the other one with the IP as destination. The action is set to limit 30 Mbps as shown below:

For some reason, this is not working, and the bandwidth used by that tunnel spikes up to 60 Mbps

Any help?

Thanks

Re: Simple QoS rule not working

Timothy_Hall — Fri, 22 May 2020 12:46:04 GMT

Um no, when measured in BITS per second you have set an equivalent Limit of 240Mbit in your QoS rules. The uppercase "B" indicates BYTES per second instead of bits. For a 30Mbit limit you either need to change the existing Limit value from 30,000,000 to 3,750,000 or better yet change the QoS units of measure from bytes to bits on this screen of the Global properties to avoid further confusion:

Re: Simple QoS rule not working

arcotangente — Fri, 22 May 2020 14:19:50 GMT

Ouch... 🙈

Just changed, I'll wait a few days to confirm it works and will update the thread.

Many thanks!!!

Re: Simple QoS rule not working

arcotangente — Fri, 29 May 2020 15:07:03 GMT

Working fine!

Many thanks @Timothy_Hall !!

Re: Simple QoS rule not working

arcotangente — Thu, 11 Jun 2020 07:29:16 GMT

Hi again,

I thought it was working but yesterday the IPSec tunnel spiked again, as shown in the graphic below, it reached 46.86 Mbps while limited to 30Mbps

Thanks

Re: Simple QoS rule not working

Timothy_Hall — Thu, 11 Jun 2020 11:37:59 GMT

Based on your QoS rule, connections initiated from the PT_Global_ network are limited to 30Mbps, and connections initiated to the PT_Global_ network from elsewhere are separately limited to 30Mbps. So in theory up to 60Mbps of bandwidth could be consumed at once depending on the direction of connection initiation.

Re: Simple QoS rule not working

arcotangente — Thu, 11 Jun 2020 12:02:34 GMT

Hi Timothy,

As you see in the bandwidth graphic, it spiked more than 46Mbps only upload (marked in the graphic as Inbound). In the other way (Download/ Outbound in the graphic), there is just a little traffic.

So for some reason, the QoS is not working at all.

Thanks