Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Network_M
Collaborator
Jump to solution

Limit speed of internet to some hosts

Let's say I have 20 Mbit/s Internet and 2 Checkpoint Firewalls working in Load Balance mode.

In security policy, there are some rules.

Let's say I want to limit speed of internet to 2 Mbit/s to one group object (some hosts), how can I do it correctly?

2 Solutions

Accepted Solutions
Network_M
Collaborator

If I limit one IP (one host) to 2Mbit/s upload and download, will other 18 Mbit/s be able for other IPs?

View solution in original post

0 Kudos
Timothy_Hall
Champion
Champion

If you just want to limit bandwidth, I'd strongly suggest just using a Limit action in the Action field of your APCL/URLF policy layer.   Enabling QoS opens up a bit of a can of worms and is really only appropriate if you want to do bandwidth guarantees, Weighted Fair Queuing, DiffServ or Low-latency Queuing.  So just define a network object or Access Role matching those you want to limit and use it as the source in a rule with a 2mbps Limit action defined.  All traffic that matches that rule will share the 2Mbps limit, the enforced limit is not per user or per connection.  Everything else will share the 20Mbps total along with the limited rule in a FIFO fashion; a Limit is not a guarantee or reservation of bandwidth.

Note that existing connections that are bandwidth-limited in this way will NOT retain their Limit after a stateful failover to the other firewall.  New connections initiated through the new cluster member handling the traffic will of course have their limit enforced as expected.

--

CheckMates Break Out Sessions Speaker

CPX 2019 Las Vegas & Vienna - Tuesday@13:30

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com

View solution in original post

13 Replies
G_W_Albrecht
Legend
Legend

You can use QoS - see the CheckPoint R80.10 QoS AdminGuide for details !

CCSE CCTE CCSM SMB Specialist
0 Kudos
Network_M
Collaborator

Can it be done by Download and Upload Limit in Action field?

0 Kudos
G_W_Albrecht
Legend
Legend

The various possibilities are throughly explained in the admin guide.

CCSE CCTE CCSM SMB Specialist
0 Kudos
Network_M
Collaborator

If I limit one IP (one host) to 2Mbit/s upload and download, will other 18 Mbit/s be able for other IPs?

0 Kudos
G_W_Albrecht
Legend
Legend

Using QoS will reduce the total throughput of the GW, so the rest will be smaller.

CCSE CCTE CCSM SMB Specialist
0 Kudos
Network_M
Collaborator

If I have 20 Mbit/s of Internet and 20 users (hosts), and

If I limit 1 user (host) to 2 Mbit/s in Actions on Security Policy,

will other 19 users (hosts) share among speed of 18 Mbit/s of Internet?

0 Kudos
G_W_Albrecht
Legend
Legend

No, QoS will reduce the total throughput its much work to decide what to do with each packet...

CCSE CCTE CCSM SMB Specialist
0 Kudos
Network_M
Collaborator

Do you mean that I should limit other hosts too? Or is that OK?

0 Kudos
Timothy_Hall
Champion
Champion

If you just want to limit bandwidth, I'd strongly suggest just using a Limit action in the Action field of your APCL/URLF policy layer.   Enabling QoS opens up a bit of a can of worms and is really only appropriate if you want to do bandwidth guarantees, Weighted Fair Queuing, DiffServ or Low-latency Queuing.  So just define a network object or Access Role matching those you want to limit and use it as the source in a rule with a 2mbps Limit action defined.  All traffic that matches that rule will share the 2Mbps limit, the enforced limit is not per user or per connection.  Everything else will share the 20Mbps total along with the limited rule in a FIFO fashion; a Limit is not a guarantee or reservation of bandwidth.

Note that existing connections that are bandwidth-limited in this way will NOT retain their Limit after a stateful failover to the other firewall.  New connections initiated through the new cluster member handling the traffic will of course have their limit enforced as expected.

--

CheckMates Break Out Sessions Speaker

CPX 2019 Las Vegas & Vienna - Tuesday@13:30

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
Network_M
Collaborator

That is what I am talking about. I don't want to use complex things, so using limit in the actions is enough for limiting bandwidth for that particular host or network group.

Thank you.

G_W_Albrecht
Legend
Legend

Yes, this here is a most convenient way without using QoS.

CCSE CCTE CCSM SMB Specialist
Bruno_Petronio
Contributor
Hello Timothy,
When speaking in "limit" action, are we talking about traffic shaping or policing ?
I would be interested in traffic shaping 🙂

Thanks in advance,
Bruno Petrónio
HristoGrigorov

I believe this is what is known as "traffic shaping" in contrast with QoS which is more like "traffic balancing".

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events