Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 14 replies
  • Answers 1 answer
  • Subscribers 5 subscribers
  • Views 3163 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

QoS Download Throttling Not Working Properly

Josh Marchant

For a long time now I've had download throttling set up for web traffic, limiting connections to 15Mbps for upload and download. This used to work as expected, as verified using speedtest.net. 

Recently I noticed that it didn't seem to be working anymore, and upon checking my traffic selectors noticed that all the ones using application selectors no longer worked, and when trying to edit those selectors the menu would just glitch out, as it seems the ability to select traffic by the application has been removed. A related side now is that the flow monitor is also no longer able to distinguish traffic by application (everything is 'unclassified'). 

I re-created the selectors using port numbers instead and updated the bandwidth pools and download throttling rules to reflect this change. Upon testing my download/upload throttling rule, it appears to be working for upload traffic but not download traffic. The rules are configured with the same ports, and set against both the internal and external interfaces.

Traffic Selectors:

External Interface Throttling Rule:

Internal Interface Throttling Rule:

Speedtest Result (our connection is 100Mbps up and down): 

UTM Firmware version: 9.703-3

UTM Model: SG230

Does anyone know if this is a bug, or how to fix it?



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Josh Marchant

    Jpsh, please show a picture of the Edit of the Traffic Selector.  Also of the Edit of the Services Group with one of the Services open in Edit.  Also, confirm that Web Filtering isn't using an (Address) other than that of the External (Address).

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    We don't use web filtering so it shouldn't be anything to do with that (we don't even have the web protection license). 

    See screenshots below 

  • 0 in reply to Josh Marchant

    I can't see the 'Destination' part of the Traffic Selector picture.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Its shown in the screenshot above that one - "External (WAN) Address"

  • +1 in reply to Josh Marchant

    Indeed!  That should work.  Can you confirm that there's no Uplink Balancing rule, NAT rule or Web Filtering Profile with an 'optional interface for outgoing traffic' sending this traffic out from a different IP?

    If not, I can't think of any other issue.  Maybe it's time to put a Bandwidth Pool with an upper bandwidth limit on the Internal interface.  The Traffic Selector would look like 'Any -> Web Surfing (Download Traffic) -> Internal (Network)'.

    Any luck with that?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    I don't have uplink balancing enabled, or web filtering. We also only have the one external IP in use so shouldn't be anything like that. 

    I've just tried it with the upper limit bandwidth pool and that has done the trick so that should be fine for now. Thanks!

  • 0 in reply to BAlfson

    So I've had this working with the bandwidth pool for a couple of days but have realised that there is no way to set the 15Mbps upper limit on a per-connection basis, only overall. Really I need to limit the connection to 15Mbps for each connection rather than for the whole network. 

  • 0 in reply to Josh Marchant

    Yeah, that's only available with Download Throttling rules.  Someone needs to get eyes on your configuration.  Have you tried getting help from Sophos Support?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML