Limit speed of internet to some hosts

[Network_M]

Let's say I have 20 Mbit/s Internet and 2 Checkpoint Firewalls working in Load Balance mode.

In security policy, there are some rules.

Let's say I want to limit speed of internet to 2 Mbit/s to one group object (some hosts), how can I do it correctly?

[G_W_Albrecht]

You can use QoS - see the CheckPoint R80.10 QoS AdminGuide for details !

[Network_M]

Can it be done by Download and Upload Limit in Action field?

[G_W_Albrecht]

The various possibilities are throughly explained in the admin guide.

[Network_M]

If I limit one IP (one host) to 2Mbit/s upload and download, will other 18 Mbit/s be able for other IPs?

[G_W_Albrecht]

Using QoS will reduce the total throughput of the GW, so the rest will be smaller.

[Network_M]

If I have 20 Mbit/s of Internet and 20 users (hosts), and

If I limit 1 user (host) to 2 Mbit/s in Actions on Security Policy,

will other 19 users (hosts) share among speed of 18 Mbit/s of Internet?

[G_W_Albrecht]

No, QoS will reduce the total throughput its much work to decide what to do with each packet...

[Network_M]

Do you mean that I should limit other hosts too? Or is that OK?

[Timothy_Hall · Accepted solution]

If you just want to limit bandwidth, I'd strongly suggest just using a Limit action in the Action field of your APCL/URLF policy layer.   Enabling QoS opens up a bit of a can of worms and is really only appropriate if you want to do bandwidth guarantees, Weighted Fair Queuing, DiffServ or Low-latency Queuing.  So just define a network object or Access Role matching those you want to limit and use it as the source in a rule with a 2mbps Limit action defined.  All traffic that matches that rule will share the 2Mbps limit, the enforced limit is not per user or per connection.  Everything else will share the 20Mbps total along with the limited rule in a FIFO fashion; a Limit is not a guarantee or reservation of bandwidth.

Note that existing connections that are bandwidth-limited in this way will NOT retain their Limit after a stateful failover to the other firewall.  New connections initiated through the new cluster member handling the traffic will of course have their limit enforced as expected.

--

CheckMates Break Out Sessions Speaker

CPX 2019 Las Vegas & Vienna - Tuesday@13:30

[Network_M]

That is what I am talking about. I don't want to use complex things, so using limit in the actions is enough for limiting bandwidth for that particular host or network group.

Thank you.

[G_W_Albrecht]

Yes, this here is a most convenient way without using QoS.

[Bruno_Petronio]

Hello Timothy,
When speaking in "limit" action, are we talking about traffic shaping or policing ?
I would be interested in traffic shaping 🙂

Thanks in advance,
Bruno Petrónio

[HristoGrigorov]

I believe this is what is known as "traffic shaping" in contrast with QoS which is more like "traffic balancing".