topic Re: checkpoint QoS on site to site vpn traffic in Spark Firewall (SMB)

checkpoint QoS on site to site vpn traffic

nflnetwork29 — Mon, 30 Nov 2020 23:02:32 GMT

Hi there is there any way to prioritize the site to site vpn traffic on a checkpoint vpn network? we are doing full mesh vpn for the inter-site voice calls primarily but I would say its more of a hub/spoke topology for the data network where all branch sites connect back to hub site over vpn for data traffic.

is there any way using QoS to guarantee that these VPN tunnels have a certain amount of bandwidth at all time?

Re: checkpoint QoS on site to site vpn traffic

PhoneBoy — Tue, 01 Dec 2020 00:48:35 GMT

You can do QoS on the traffic inside a VPN tunnel (assuming it's a domain-based VPN, route-based VPNs are not supported per sk36157), but I don't believe you can do QoS on the VPN tunnel itself.
In any case, QoS doesn't make much sense over the public Internet since there is zero guarantee anything there will honor the DSCP tags.

Re: checkpoint QoS on site to site vpn traffic

Timothy_Hall — Wed, 02 Dec 2020 14:32:59 GMT

Actually it is possible to differentiate traffic traversing a VPN tunnel in your QoS policy via a checkbox in the Action of a QoS rule like this, which applies this sample rule only to encrypting/decrypting traffic:

Re: checkpoint QoS on site to site vpn traffic

nflnetwork29 — Tue, 09 Feb 2021 04:07:35 GMT

i tried to create a similar policy but i receive the following error when i try to install policy on the gateway.

Error - QoS Policy does not apply to any network interface.

Can anyone tell me what I missed?

Re: checkpoint QoS on site to site vpn traffic

G_W_Albrecht — Tue, 09 Feb 2021 08:55:36 GMT

I would suggest to follow the QoS Tutorial starting at QoS R80.40 Administration Guide p.32 ! Network Interfaces are the enforcement points for QoS, so QoS has to be enabled on one interface for QoS to be able work on it...

Re: checkpoint QoS on site to site vpn traffic

AaronCP — Mon, 15 Nov 2021 17:28:48 GMT

Hey @PhoneBoy,

Can you clarify the situation outlined in SK36157, please? Does it mean QoS is unsupported on Route-based VPNs, or we cannot implement QoS on any interface if a VTI exists on the gateway?

Thanks,

Aaron.

Re: checkpoint QoS on site to site vpn traffic

PhoneBoy — Mon, 15 Nov 2021 21:25:41 GMT

It just can't be done on any traffic to/from VTI interfaces: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk34086
It should work on other interfaces.