Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

QoS issues (again)

.Hello @all!

So I have asked in the past a few questions about QoS, but I had a more complicated setup with two WANs and additionally the second was a bonding between an ADSL line and a 4G+ sim card, which was nor really steady regarding the bandwidth

Time went by and I finally have a decent FTTH connection (500/50)

Now the never-ending question: When I perform a speedtest I get a result of 508 down / 53 up

What I want is to limit my whole network to 495 down/ 49 up

I went to system services and created a Traffic shaping rule as follows

Then in Firewall rules I created a top firewall rule and set as source zone my LANs/VLANs and Destination zones WAN.

In this rule I set Shape Traffic to the traffic shaping rule above

I run a command line speedtest from a linux machine and this is what I get


Speedtest by Ookla

Server: LANCOM LTD - Athens (id: 12031)
ISP: FORTHnet SA
Idle Latency: 2.97 ms (jitter: 0.34ms, low: 2.83ms, high: 4.02ms)
Download: 292.54 Mbps (data used: 251.7 MB)
6.49 ms (jitter: 1.77ms, low: 3.61ms, high: 14.59ms)
Upload: 46.91 Mbps (data used: 21.8 MB)
3.09 ms (jitter: 0.31ms, low: 2.55ms, high: 4.53ms)
Packet Loss: 0.0%

Upload Speed is not exactly what I want but I don't mind.

But download speed is a far cry from 495Mbps

Funny thing is that if I change the download limit from 62000 to say, 70000, I get the exact speed from speedtest

Now I turn off the firewall rule and immediately run another speedtest

Speedtest by Ookla

Server: HYPERHOSTING - Athens (id: 5377)
ISP: FORTHnet SA
Idle Latency: 2.40 ms (jitter: 0.55ms, low: 1.71ms, high: 3.14ms)
Download: 408.47 Mbps (data used: 490.1 MB)
30.79 ms (jitter: 1.59ms, low: 3.77ms, high: 40.38ms)
Upload: 51.28 Mbps (data used: 23.9 MB)
44.51 ms (jitter: 8.94ms, low: 11.40ms, high: 301.76ms)
Packet Loss: 0.0%

My kids are downloading something from PS4 at the moment so not the full 500Mbps speed but still..

I have created another traffic shaping rule with the exact same numbers but this time instead of individual I set it to shared.

I get the exact same results: Setting download bandwidth to 62000 I get a speed of 300. Changing again to 70000 I get no increase.

Disabling the rule gets me back to 400+

Can someone explain what is going on?



Edited TAGs
[edited by: Erick Jan at 8:09 AM (GMT -7) on 20 Sep 2024]
Parents
  • Hello,

    What are the results when you perform the test without any users on the network and please share result? Also have you tried directly testing without the FW? PC->directly connected to router->Speedtest? could you share result if you're getting exactly 500 or at least near 500MB DL speed w/o the FW?

    Also could you share your current SFOS version? Thank you

    Regards,

    Raphael Alganes
    Community Support Engineer | Sophos Technical Support
    Sophos Support Videos Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.

  • I have replied to you, but my post was flagged as spam, possibly due to the fact that I pasted speedtest links to share the results (was running the windows app this time).

    Anyway, since I don't know when/if my reply will be unflagged, I am replying again..

    So at the moment there is not much bandwidth consumed at the house

    Run a speedtest (from a linux machine now) without the firewall rule enabled:

    Download: 422.91 Mbps (data used: 407.7 MB)
    32.73 ms (jitter: 4.52ms, low: 3.74ms, high: 253.45ms)
    Upload: 52.96 Mbps (data used: 25.2 MB)
    44.28 ms (jitter: 9.33ms, low: 19.42ms, high: 292.46ms)
    Packet Loss: 0.0%

    I enable the firewall rule again:

    Download: 313.15 Mbps (data used: 238.5 MB)
    5.93 ms (jitter: 1.43ms, low: 2.98ms, high: 12.61ms)
    Upload: 47.09 Mbps (data used: 22.4 MB)
    2.84 ms (jitter: 0.41ms, low: 2.27ms, high: 12.94ms)
    Packet Loss: 0.0%

    I disabled the rule again and at the next speedtest I got 430/45

    I enabled it then once more and got 310/47

    The ISP's router is set to bridge mode, which effectively turns it to an ONT

    I have seen many times the speed reaching at 500, but even if I didn't, the QoS rule (which has the correct numbers for KBps) should not limit me to 300, it should at least give me the full available speed since it is capped at a higher speed that the actual one. It should not contantly cap me at 300

    I am running the latest sfos version SFVH (SFOS 20.0.2 MR-2-Build378)

     
    Sophos XG Home Licence.

    Machine: Checkpoint 3100 appliance (Intel Atom C2558 CPU, 6GB Ram, 250GB sata SSD)

  • It is an old behavior, single connections are getting loaded to a single core. Therefore, most speed tests nowadays offers multi download speedtest per default. 

    If you start another speedtest or another download of a file, it will be loaded to the second CPU etc. 

    Thats the behavior for years (UTM and SFOS). 

    __________________________________________________________________________________________________________________

  • Hi Chris,

    if you watch the top of the display you will note that CPU1 idle drops to 0 a number of times in the video.

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 EAP

    If a post solves your question please use the 'Verify Answer' button.

  • Thanks for the explanation,  !

    The fact that a single speedtest, with traffic shaping enabled, overloads a CPU core is the problem, however. If a single test could go to 480-490 then I would be OK. However, even one speedtest taxes the CPu and can go up to about 300Mbits.

    So I guess I am leaving shaping disabled for now and will look into upgrading my firewall appliance with something more powerful.

     : 

    Yes I saw it.

    Thanks again, Ian!

     
    Sophos XG Home Licence.

    Machine: Checkpoint 3100 appliance (Intel Atom C2558 CPU, 6GB Ram, 250GB sata SSD)

  • Just wanted to follow up on this issue.

    So yesterday I tried setting up another appliance that I have, which has a Celeron N3350. The Celeron is newer and has better single core score than the Atom, but the Atom is faster overall. In fact, I replaced the Celeron with the Atom and since then, the GUI in not painfully slow anymore. However I needed to verify if the better single core performance of the Celeron would make any difference and how much.

    And - what do you know - performing the same tests, I was still not getting the desired speeds from the Celeron (it was hitting 100%, too), but I got speeds of about 380Mbits.

    So it is 100% certain that CPU is the limiting factor in my situation. I decommissioned the Celeron appliance again, though, because as mentioned, the GUI is painfully slow. The Atom loads the pages noticeably faster. 

    I am in the process of ordering a mini PC with a bunch of Intel cards and an Intel N100 CPU. I am certain that N100 will be able to handle speeds even more than 1Gbit, so I will be OK for many years.

    Thanks again for all that offered their help!

     
    Sophos XG Home Licence.

    Machine: Checkpoint 3100 appliance (Intel Atom C2558 CPU, 6GB Ram, 250GB sata SSD)

  • Make sure they are are not i219 or 225/6 series chips and there bios is NOT UEFI.

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 EAP

    If a post solves your question please use the 'Verify Answer' button.

  • Oh, crap..

    12th Gen 4xi226-V 2.5G Intel Firewall Mini PC N100 DDR5 4800MHz Fanless Soft Router

    This is what it says in the description. The BIOS I assume would have legacy (not 100% certain, though), but the network cards are 226. Are those not supported yet?

    But I assume there is always the option to install proxmox and create XG as a VM, right?

     
    Sophos XG Home Licence.

    Machine: Checkpoint 3100 appliance (Intel Atom C2558 CPU, 6GB Ram, 250GB sata SSD)

  • Correct on both counts.

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 EAP

    If a post solves your question please use the 'Verify Answer' button.

  • Thanks again, Ian!

     
    Sophos XG Home Licence.

    Machine: Checkpoint 3100 appliance (Intel Atom C2558 CPU, 6GB Ram, 250GB sata SSD)

  • Hello  ,

    The above traffic shaping policy (Home_QoS) which you have configured is of type "limit" instead of "guarantee". It means it can go up to configured value but not giving any minimum guarantee.

    Could it be possible to try following configuration and check it once?

    Rule type: Guarantee

    Upload bandwidth: 6000 to 6250

    Download bandwidth: 59000 to 60000

    I presume Total available WAN bandwidth setting is still 68500 and Enforce guaranteed bandwidth is disabled.

    Regards,

    Sanket Shah

    Director, Software Development, Sophos Firewall

  • Hello  !

    I cloned the rule (because you can't edit and change to guarantee), used the numbers you said and applied the policy on my rule.

    I then run the speedtest.

    Fo upload I got 48Mbits, which seems about right. (the 6000 min guarantee)

    For download I was limited again by the CPU (as we established with Ian). I got about 260Mbits but observing top from console, I saw that cpu1 was hitting 99,6% utilization.

    My new appliance is on the way. It should arrive in about 10 -15 days. When I get it and set it up (I need to install proxmox and virtualize XG since the hardware is not supported), I will get back here with the results I will be getting with the new CPU (Intel N100).

     
    Sophos XG Home Licence.

    Machine: Checkpoint 3100 appliance (Intel Atom C2558 CPU, 6GB Ram, 250GB sata SSD)

Reply
  • Hello  !

    I cloned the rule (because you can't edit and change to guarantee), used the numbers you said and applied the policy on my rule.

    I then run the speedtest.

    Fo upload I got 48Mbits, which seems about right. (the 6000 min guarantee)

    For download I was limited again by the CPU (as we established with Ian). I got about 260Mbits but observing top from console, I saw that cpu1 was hitting 99,6% utilization.

    My new appliance is on the way. It should arrive in about 10 -15 days. When I get it and set it up (I need to install proxmox and virtualize XG since the hardware is not supported), I will get back here with the results I will be getting with the new CPU (Intel N100).

     
    Sophos XG Home Licence.

    Machine: Checkpoint 3100 appliance (Intel Atom C2558 CPU, 6GB Ram, 250GB sata SSD)

Children
No Data