How to prioritize bandwidth allocation in R80.20?

[Vladimir]

If I recall accurately, in the past, use of QOS was associated with some serious limitations.

One of potential customers is inquiring about the possibility of using Check Point gateways for bandwidth prioritization for specific sites.

Now that we are on R80.20 and have the ability to use Domain objects in QOS, would this be acceptable configuration?

I would also appreciate any advise or shared experience with QOS on R80.20 and if any issues were encountered that I should be aware of.

The bandwidth limiters available in the APCTL are not really an option due to hard limits and method used to enforce those.

Thank you,

Vladimir

[PhoneBoy]

QoS had some limitations with CoreXL that were resolved in R77.10, FWIW.

[Vladimir]

Thank you for clarification. Can you confirm that the approach depicted in my post above would achieve desired result or am I missing something? I'll have a call with the potential client today at 3:00 pm EDT and would like to give him unambiguous answer.

[PhoneBoy]

The way I understand it, this should do what you're after.

It looks like the ability to use Domain objects in QoS predates R80, so it's not a "new" feature.

That said, with FQDN domains (which ARE new in R80.x), I imagine they work better in QoS as well

[Vladimir]

What are the steps to achieve creation of equivalent settings from embedded systems in a centrally managed environments?

[PhoneBoy]

Offhand, I don't know.

[Vladimir]

Dameon,

Can you get someone from QoS group to take a look at this thread?

One of the CP SEs I am working with and I are conducting the simulations with the use of the FQDNs in QoS by limiting bandwidth allocation and so far we were not able to do it successfully.

Thank you,

Vladimir

[PhoneBoy]

"Limit Bandwidth Consuming Application is disabled" is a no-op here since it's disabled.

You would not use the QoS blade for this, since it has no concept of applications, you would use App Control.

"Limit low latency traffic to 20%" refers to these services:

Which suggests a rule that looks something like (will have to play with weight and/or rule limit):

[Vladimir]

Thanks!

The issue that I am trying to resolve is the bandwidth limit per site accessed based on FQDN Domain object.

There are options of using URIs for QoS as well, creating resources in the format of, for instance, www.samplesite.com/* , associating them with HTTP and HTTPS and placing them in the "Services" sections of the QoS policy.

I am trying to figure out which is the appropriate way to achieve this.

[PhoneBoy]

You could do this a couple of ways:

• Specify the precise limit in terms of "Rule Limit"
• Specify a "weight" for each rule
  • If all rules are weighted are the same, then each rule will be allocated roughly the same amount of bandwidth.
  • If one rule has a higher weight than another, then that rule will get a proportionally higher amount of bandwidth (percentage based on total weight of all rules).
    • For example, if the weight of all rules totals 100 and you give rule 5 a weight of 20, it will get 20 percent of the available bandwidth.

[Vladimir]

But that is the problem: with absolute limit specified and the destination defined as the FQDN Domain object, I do not see the limit being enforced when, for instance, the download is initiated (irrespective of the protocol used).

[PhoneBoy]

Sounds like a TAC case may be in order. 

[Vladimir]

Dameon Welch-Abernathy The SE that I am working with has opened the SR#6-0001181586

If possible, please see if we can get some traction on it, as we are being asked the same questions that were already answered. It was initiated on December the 21st.

Thank you,

Vladimir

[PhoneBoy]

Usually better send me those privately

But will look into it 

[Vladimir]

My bad. Will do so in the future and thank you.