sophos xg - ip based traffic shaping

Hi Gurcem, Thanks for reaching out to Sophos Community.

Try a Traffic shaping policy with rule type 'Limit'. Set the Limit to 640Kbps (~ 5 Mbps). and usage type as "Individual". Sharing a screenshot for your reference.

Current configuration is the same but still gives 640KB/s total to all ip addesses in that rule not to individual. Adding the screenshots of current config below:

Current configuration is the same but still gives 640KB/s total to all ip addesses in that rule not to individual. Adding the screenshots of current config below:

Can you see any issue with my config?

The policy shows apply to firewall rule.

ian

yes, i don't have users.

You must have devices which are assigned ip addresses, so give them a name and create clientless user groups for them.

ian

Thank you for your help. Yes, it works when i create clientless user groups but my network has 65534 ip addresses (172.20.x.x/16) so there will be a lot of users in the db. I am not sure if it's ok with xg210?

I think this is the only way. Thanks

But,

you do not assign the entire address range to devices, in practice you probably need to limit the address range to a more realistically manageable size.

Ian

First, reserve the IP address of the device you want to limit the speed. That way the IP never changes.

Then create an IP host for that IP address so you can use it in the firewall rule.

In the firewall rule, the source uses the IP Host you created.

Then make sure this rule is high enough that no other allowed rule happens before it for this zone/subnet.

You can use the Policy Test to see which rule being applied.

Hope this clarifies the configuration flow.

I have 65534 ip addresses in this range. Creating ip host for all of them is not an option. No all of them using xg210 as gateway but still need a rule includes all range.

There is something wrong with your design. You only need to create users for devices that will actually use the XG gateway.

ian