cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post
Network_M
Copper

Limit speed of internet to some hosts

Jump to solution

Let's say I have 20 Mbit/s Internet and 2 Checkpoint Firewalls working in Load Balance mode.

In security policy, there are some rules.

Let's say I want to limit speed of internet to 2 Mbit/s to one group object (some hosts), how can I do it correctly?

Labels (1)
Tags (2)
1 Solution

Accepted Solutions

Re: Limit speed of internet to some hosts

Jump to solution

If you just want to limit bandwidth, I'd strongly suggest just using a Limit action in the Action field of your APCL/URLF policy layer.   Enabling QoS opens up a bit of a can of worms and is really only appropriate if you want to do bandwidth guarantees, Weighted Fair Queuing, DiffServ or Low-latency Queuing.  So just define a network object or Access Role matching those you want to limit and use it as the source in a rule with a 2mbps Limit action defined.  All traffic that matches that rule will share the 2Mbps limit, the enforced limit is not per user or per connection.  Everything else will share the 20Mbps total along with the limited rule in a FIFO fashion; a Limit is not a guarantee or reservation of bandwidth.

Note that existing connections that are bandwidth-limited in this way will NOT retain their Limit after a stateful failover to the other firewall.  New connections initiated through the new cluster member handling the traffic will of course have their limit enforced as expected.

--

CheckMates Break Out Sessions Speaker

CPX 2019 Las Vegas & Vienna - Tuesday@13:30

"IPS Immersion Training" Self-paced Video Class
Now Available at http://www.maxpowerfirewalls.com
12 Replies

Re: Limit speed of internet to some hosts

Jump to solution

You can use QoS - see the CheckPoint R80.10 QoS AdminGuide for details !

0 Kudos
Network_M
Copper

Re: Limit speed of internet to some hosts

Jump to solution

Can it be done by Download and Upload Limit in Action field?

0 Kudos

Re: Limit speed of internet to some hosts

Jump to solution

The various possibilities are throughly explained in the admin guide.

0 Kudos
Network_M
Copper

Re: Limit speed of internet to some hosts

Jump to solution

If I limit one IP (one host) to 2Mbit/s upload and download, will other 18 Mbit/s be able for other IPs?

0 Kudos

Re: Limit speed of internet to some hosts

Jump to solution

Using QoS will reduce the total throughput of the GW, so the rest will be smaller.

0 Kudos
Network_M
Copper

Re: Limit speed of internet to some hosts

Jump to solution

If I have 20 Mbit/s of Internet and 20 users (hosts), and

If I limit 1 user (host) to 2 Mbit/s in Actions on Security Policy,

will other 19 users (hosts) share among speed of 18 Mbit/s of Internet?

0 Kudos

Re: Limit speed of internet to some hosts

Jump to solution

No, QoS will reduce the total throughput its much work to decide what to do with each packet...

0 Kudos
Network_M
Copper

Re: Limit speed of internet to some hosts

Jump to solution

Do you mean that I should limit other hosts too? Or is that OK?

0 Kudos

Re: Limit speed of internet to some hosts

Jump to solution

If you just want to limit bandwidth, I'd strongly suggest just using a Limit action in the Action field of your APCL/URLF policy layer.   Enabling QoS opens up a bit of a can of worms and is really only appropriate if you want to do bandwidth guarantees, Weighted Fair Queuing, DiffServ or Low-latency Queuing.  So just define a network object or Access Role matching those you want to limit and use it as the source in a rule with a 2mbps Limit action defined.  All traffic that matches that rule will share the 2Mbps limit, the enforced limit is not per user or per connection.  Everything else will share the 20Mbps total along with the limited rule in a FIFO fashion; a Limit is not a guarantee or reservation of bandwidth.

Note that existing connections that are bandwidth-limited in this way will NOT retain their Limit after a stateful failover to the other firewall.  New connections initiated through the new cluster member handling the traffic will of course have their limit enforced as expected.

--

CheckMates Break Out Sessions Speaker

CPX 2019 Las Vegas & Vienna - Tuesday@13:30

"IPS Immersion Training" Self-paced Video Class
Now Available at http://www.maxpowerfirewalls.com
Network_M
Copper

Re: Limit speed of internet to some hosts

Jump to solution

That is what I am talking about. I don't want to use complex things, so using limit in the actions is enough for limiting bandwidth for that particular host or network group.

Thank you.

0 Kudos
Highlighted

Re: Limit speed of internet to some hosts

Jump to solution

Yes, this here is a most convenient way without using QoS.

Re: Limit speed of internet to some hosts

Jump to solution

I believe this is what is known as "traffic shaping" in contrast with QoS which is more like "traffic balancing".