QoS issues (again)

Hello ChriZathens ,

Could you please try setting up "Total available WAN bandwidth" to 68500 (instead of 62500) and observe?

Sorry if I am not making myself comprehensive enough...

I understand that it is for the WAN and it can have impact only on the download speed.

I tried the setting you posted on the screenshot (using my limits, so around 60000+). The result is that it caps the download at 300 instead of 400+.

Disabling this setting immediatelly I get 400+

The different thing I then tried is (by having the setting from your screenshot disabled) to  created traffic shaping policies.

I created one, selected to limit the speed (screenshot is at my first post) and it stills caps me at 250-300

Hello Sanket!

So step 1. I have set the "Enforce guaranteed bandwidth" to disabled and I run a speedtest

Results:

Download: 420.99 Mbps (data used: 380.8 MB)
30.39 ms (jitter: 1.38ms, low: 4.28ms, high: 40.13ms)
Upload: 52.91 Mbps (data used: 25.8 MB)
44.26 ms (jitter: 1.82ms, low: 10.21ms, high: 48.07ms)
Packet Loss: 0.0%

Step2: I set the total available bandwidth to 68500 and set the "Enforce guaranteed bandwidth" to enabled and the rest as follows:

Results:

Download: 262.78 Mbps (data used: 241.0 MB)
6.95 ms (jitter: 1.65ms, low: 3.07ms, high: 13.44ms)
Upload: 52.92 Mbps (data used: 24.6 MB)
47.51 ms (jitter: 19.21ms, low: 22.11ms, high: 340.94ms)
Packet Loss: 0.0%

I set "Enforce guaranteed bandwidth" to disabled it again. Results:

Download: 444.77 Mbps (data used: 423.3 MB)
19.19 ms (jitter: 5.32ms, low: 4.60ms, high: 259.21ms)
Upload: 52.96 Mbps (data used: 23.8 MB)
44.07 ms (jitter: 9.06ms, low: 7.36ms, high: 316.16ms)
Packet Loss: 0.0%

Hello ChriZathens ,

For step 2, This is possible. Let me explain.

Enforce guaranteed bandwidth - enable

- Any firewalled traffic passing thru WAN (inbound/outbound), where traffic shaping policy is not applied, would go thru "default policy". In your case, it's wrong configuration because you now have 2 traffic shaping policy which exceeds total ISP bandwidth you have.

When you would be doing speed test and you might have other traffic which can compete for guarantee, you might see some drop which would make TCP connection to go in "slow start" mode and would lead to decrease in bandwidth usage.

Do you mind setting guaranteed value too low (like 2KBps) and check?

Enforce guaranteed bandwidth - disable

- Either admin has orchestrated all firewalled traffic to go thru some traffic shaping policies (either firewall/user/web/app) OR providing guarantee is not the primary use case. In such scenarios, default policy would be "disabled". 

If no other traffic is going thru during speed test at that time, speed test might give you good results but if you have some other traffic bypassing traffic shaping policy, it can affect traffic which is going thru traffic shaping processing. And you might see "decrease in bandwidth usage".

In general, if you just have simple use case of traffic shaping policy and planning to have 1-2 firewall rules only, you may want to consider "disabling" enforce guaranteed bandwidth. However, if you are planning to have more firewall rules, better to divide bandwidth among all firewall rules and "default policy". It shouldn't exceed "total available WAN bandwidth".

Hello again!

With Enforce guaranteed bandwidth - enable I tried setting the guaranted value to a low value, as you said. I set it to 20  and the results are:

Download: 231.99 Mbps (data used: 273.8 MB)
6.96 ms (jitter: 1.65ms, low: 2.01ms, high: 14.47ms)
Upload: 52.71 Mbps (data used: 23.8 MB)
40.62 ms (jitter: 1.22ms, low: 28.77ms, high: 48.41ms)
Packet Loss: 0.0%

Setting Enforce guaranteed bandwidth - disable

Download: 412.24 Mbps (data used: 364.3 MB)
23.45 ms (jitter: 1.59ms, low: 3.07ms, high: 39.31ms)
Upload: 52.76 Mbps (data used: 23.8 MB)
43.55 ms (jitter: 2.12ms, low: 5.30ms, high: 52.29ms)
Packet Loss: 0.0%

Additionally you say that 

" In your case, it's wrong configuration because you now have 2 traffic shaping policy which exceeds total ISP bandwidth you have."

But the thing is exactly that: I don't have 2 traffic shaping policies. The traffic shaping policy I have created is attached to a top level firewall rule, which only applies traffic shaping, nothing else, and for the purposes of these tests, this specific firewall rule is disabled. I am only messing with the "Traffic Shaping Settings"

So let me ask it more simply:

Let's pretend that I don't have set anything regarding traffic shaping. (please pretend that I have installed XG right now and it is out of the box.)

I have a 500/50 internet connection.

I want to limit ALL machines via a single rule to not consume more than 450/50. 

Can you please tell me what I need to do?

Hi,

1/. you don't need a firewall rule

2/. using the screenshot I posted but modifying the values as recommended by Sanket Shah.

Ian

Hello Ian!

But this is what I am saying form the start.. The values don't work.

1. There was only one firewall rule with QoS. This rule is disabled

 So there is absolutely nothing in settings limiting the bandwidth.

2. I run a speedtest. Results:

Download: 415.84 Mbps (data used: 466.4 MB)
27.21 ms (jitter: 1.99ms, low: 3.27ms, high: 40.02ms)
Upload: 52.87 Mbps (data used: 23.8 MB)
44.41 ms (jitter: 1.98ms, low: 13.42ms, high: 54.25ms)
Packet Loss: 0.0%

I then go to traffic shaping settings and set "Enforce guaranteed bandwidth" to Enabled with the below values:

Even if in the first speedtest I don't get the full speed, since QoS is set to 68500 (about 550Mbit), it should give me the full available speed, correct?

So with the above settings I run a speedtest. Results:

Download: 227.66 Mbps (data used: 215.1 MB)
9.57 ms (jitter: 12.67ms, low: 2.14ms, high: 232.48ms)
Upload: 52.79 Mbps (data used: 26.5 MB)
43.15 ms (jitter: 1.47ms, low: 4.20ms, high: 48.14ms)
Packet Loss: 0.0%

I 

I immediately go to traffic shaping settings and set "Enforce guaranteed bandwidth" to Disabled again and run another speedtest:

Download: 411.33 Mbps (data used: 465.5 MB)
19.72 ms (jitter: 1.77ms, low: 3.39ms, high: 41.71ms)
Upload: 53.02 Mbps (data used: 25.1 MB)
43.50 ms (jitter: 1.43ms, low: 16.28ms, high: 48.40ms)
Packet Loss: 0.0%

As you can (both) see, traffic shaping settings does not limit according to the numbers I set. This has been my problem from the beginning of this discussion.

you need to change the limit to less than your link speed otherwise the firewall has nothing to negotiate

and increase your guaranteed value.

Works fine for me. I have a firewall rule with  QOS policy for my VoIP service only.

Ian

I did what you proposed.

Run a speedtest and got 420 Mbits

I decreased the total bandwidth to 50500

I set guaranteed value to 5000 and limit to 50000.

I run a speedtest and I get 240Mbits.

I then set Enforce guaranteed bandwidth to disabled and again I run a speedtest.

I get again 420 Mbits

It just isn't working as it should...

The following is the results I get with the settings I posted earlier. I thought I had posted this previously.