Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 4 subscribers
  • Views 1683 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

QOS not working

tom11011

Hi Group, attempting to limit outbound CIFS traffic from servers sitting behind the sophos to computers on the Internet.

Here is how it is setup.

A traffic selector was created as follows- Internal Network --> CIFS --> Any

Then a bandwidth pool bound to the External Interface was created as follows- Specify upper bandwidth 1000 kbits, traffic selector from above chosen.

I'm trying a file copy from the server behind the sophos to my home pc, bandwidth is not being limited.  This should work.  I'm coming in over VPN and I have 'keep classification after encapsulation' enabled in advance.

Any ideas here?



This thread was automatically locked due to age.
Parents
  • 0

    Try reversing the rule.   The VPN client device is initiating the connection to the server's SMB port, so I think it  needs to be on the Source side.

    For security reasons, CIFS/SMB from internal machines to the internet should be blocked with firewall rules, so spammers cannot trick you into connecting to an SMB share on their servers.

    I think your revised rules look like:

    QOS:

    • vpnpool -> cifs -> Internal Network

    Firewall

    • Internal Network -> CIFS -> vpnpool ALLOW (optional, if a VPN client might act as a file server)
    • Internal Network -> CIFS -> Any DENY
Reply
  • 0

    Try reversing the rule.   The VPN client device is initiating the connection to the server's SMB port, so I think it  needs to be on the Source side.

    For security reasons, CIFS/SMB from internal machines to the internet should be blocked with firewall rules, so spammers cannot trick you into connecting to an SMB share on their servers.

    I think your revised rules look like:

    QOS:

    • vpnpool -> cifs -> Internal Network

    Firewall

    • Internal Network -> CIFS -> vpnpool ALLOW (optional, if a VPN client might act as a file server)
    • Internal Network -> CIFS -> Any DENY
Children
No Data
Unfiltered HTML