I have some questions about Download Equalizer - Upload Optimizer options of QoS.
Let me explain our network first. we have total of 20 mbps total bandwidth. Main unit uses10 mbps is wich is on TRUST interface. There are two other units, 5 mbps each. Say LAN2 and LAN3 interfaces. And There is EXTERNAL interface witch is connected to internet. Main unit has heavy internet usage in work hours (08:00-17:00) and needs some QoS love.
If I understand correctly, Download Equalizer and Upload Optimizer are for this purpose; when the specified bandwidth is full, astaro drops the most bandwidth consuming streams packages and processes the new comming packages. Thus it prevents a few users to eat all bandwidth and make the others can't use internet.
I also understand it calculates when the bandwidth is full via Downlink kbit/sec: and Uplink kbit/sec: options.
There the problem comes. What should I set to the Downlink kbit/sec: and Uplink kbit/sec: options? If I set 100 mbps which is internal lan speed, astaro will not drop packages when the internet usage exceeds 10 mbps as it will calculate on 100mbps. If I set them to 10 mbps wont our local file transfers affected and we will not use local 100mbps bandwidht?
You can say set QoS on the EXTERNAL interface but the other LAN1 and LAN2 interfaces internet usage are very low at work hours. So if I set 20 mbps it will also not work as the traffic will never reach that level at work hours and astaro will not try to QoS when the traffic is about 10 mbps.
Hope you get what I am asking. Sorry if its confusing to you.
You did a good job of describing your situation, but, without a specific complaint, it's hard to make any specific recommendation.
The "generic" setup would be to enable Download Equalizer and Upload Optimizer, and to set the speeds on the interfaces to those actually experienced. On the internal interface, that's likely 100Mb each way. On the external, our business connection gets 2Mb down and 440Kb up.
Cheers - Bob
Sophos UTM Community Moderator Sophos Certified Architect - UTM Sophos Certified Engineer - XG Gold Solution Partner since 2005
The problem is the three internal interfaces have different physical internet lines; 10 mbps, 5 mbps and 5 mbps. But they all go to internet through astaros EXTERNAL interface. So there is 3 seperate bandwidth on EXTERNAL interface. No shared 20 mbps bandwidth.
So, if I set QoS to 20 mbps, as the other two usualy don't have any significant traffic, astoro will not notice while the 10 mbps users are suffering. If I set it to 10 mbps and some how if the other LANs start to make traffic then astoro will limit us to 10 mbps even our total is 20 mbps.
Setting limits to 10 mbps will help on TRUST interface users, but there is a chance that someone wants to download something on LAN1 and LAN2. So all three LANs will limitied 10 mbps.
Or it should be like this: on a 20 mbps QoS first lan users using all 10 mbps + 2. using 2 of 5 mbps + 3. using 3 of 5 mbps. Total of 15 mbps. Astaro will think its ok even the first lan users suffer from QoS.
Well, maybe its bad idea to put three internal LANs that have separate physical bandwidths (no shared 20 mbps) on the same EXTERNAL interface?
The problem is the three internal interfaces have different physical internet lines; 10 mbps, 5 mbps and 5 mbps. But they all go to internet through astaros EXTERNAL interface. So there is 3 seperate bandwidth on EXTERNAL interface. No shared 20 mbps bandwidth.
If you really have 3 physical uplinks, then the question is how this works, because you have only 1 default gateway on your external Interface. Are you using policy based routes ? Or is there a dedicated loadbalancer in front of the ASG ?
Well, maybe its bad idea to put three internal LANs that have separate physical bandwidths (no shared 20 mbps) on the same EXTERNAL interface?
I would agree to that in most cases [;)]
BTW: If you also activate one of the nice automatic optimizers upload optimizer or download equalizer, your manual set bandwidth pools will be ignored. I found out that a few days ago and opened a request to R&D if this is wanted behaviour or a "unrecognized side effect" ;o)). This a least is the case in V8.001.
...and upload optimizer works by rearranging queue to priorize small packets without dropping packets. Download equalizer will easy explained spread your connections over multiple queues and will only start dropping packets from the most demanding queues if you are near of saturating your available bandwitdh. You will find a lot of good articles to the used techniques SFQ and RED with googling or in wikipedia.
BTW: If you also activate one of the nice automatic optimizers upload optimizer or download equalizer, your manual set bandwidth pools will be ignored. I found out that a few days ago and opened a request to R&D if this is wanted behaviour or a "unrecognized side effect" ;o)). This a least is the case in V8.001.
I just setup a QOS at a Customersite, and I can confirm this issue on V8.000
Fraggled with that for about 2 hours! Keep me posted Sascha!
This entire scenario strikes me as odd, but who am I to criticise. [:)] I think you should be able to achieve the desired result by creating three bandwidth selectors:
Name: TRUST traffic
Selector Type: Selector
Source: TRUST (Network)
Service: Any
Destination: Internet
Name: LAN2 traffic
Selector Type: Selector
Source: LAN2 (Network)
Service: Any
Destination: Internet
Name: LAN3 traffic
Selector Type: Selector
Source: LAN3 (Network)
Service: Any
Destination: Internet
and three bandwidth pools, all bound to your EXTERNAL interface:
The problem is the three internal interfaces have different physical internet lines; 10 mbps, 5 mbps and 5 mbps. But they all go to internet through astaros EXTERNAL interface. So there is 3 seperate bandwidth on EXTERNAL interface.
That's a bit confusing to me. I didn't think this was possible without using a separate "external" interface for each internet connection. In that case, or in the case of a single 20Mbps connection, you would have to use Uplink Balancing with Bandwidth Pools to accomplish what you want easily. Are you certain this is working the way you think it is?
Cheers - Bob
Sophos UTM Community Moderator Sophos Certified Architect - UTM Sophos Certified Engineer - XG Gold Solution Partner since 2005
BTW: If you also activate one of the nice automatic optimizers upload optimizer or download equalizer, your manual set bandwidth pools will be ignored. I found out that a few days ago and opened a request to R&D if this is wanted behaviour or a "unrecognized side effect" ;o)). This a least is the case in V8.001.
Sascha, can you explain very briefly how you confirmed this?
Thanks - Bob
Sophos UTM Community Moderator Sophos Certified Architect - UTM Sophos Certified Engineer - XG Gold Solution Partner since 2005
Sascha, can you explain very briefly how you confirmed this?
Thanks - Bob
Hello Bob. I've tested this with a RED due a customer request.
I opened a HD Youtube Videostream (Avatar HD Trailer - Yesssss) from my Client behind RED which will saturate my upstream from ASG to RED and parallel downloaded a big file from my NAS (in the ASG Network) in the same time to the client behind RED.
I could set QoS Settings to priorize the Videostream or the NAS download (guarantee bandwidth), which also worked absolutely fine. (I did a lot of tests with different settings and watched the throughput for the two streams using iftop for reds1 interface, which is my RED device ;o))
As soon as I activate upload optimizer or download equalizer my manual settings will be ignored (or at least the bandwidth will not be shared in my defined ratios in bandwidth pools)
I otherwise really like the two "magic" QoS Settings which works perfectly fine if I don't want to specify guaranteed or upper limits for the bandwidth.
This is a very small and new university of Turkey. I have started to work here about four months ago. My main responsiblity is maintaining servers. And my network background is not so bright [[[[:)]]]] As we have no network administrator yet (and I doubt if we will have soon), I also try to maintain our network. I am still figuring out how this mess (our network design) is really working [[[[:)]]]]
So, I will try to describe the physical structure. We have three small campuses, the main one has the system room, where all the servers, bacbone switch and astaro is. And it has 10 mbps bandwidth. The other campus is about 5-8 km away from as. And the third one is ~30km away. The two away campuses are connected to ISP via MetroEthernet(fiber) and they have no direct phyisical connection to main campus and astaro. Main campus connected to ISP via fiber.
So first I thing I thought was if there is no physical line to main campus, how the hell the other campus's trafic flow through astaro? I think its done via VLANs. Fiber from ISP connected to backbone and its connected to astaro. All the away campus interfaces defined in astaro as VLANs on eth1. So their traffic routed by ISP to main campus and processed by astaro via these VLANs?
Sorry if it doesn't make sense to you [[[[:)]]]] As my knowlage is limited.
Are there VLANs defined on the External interface of the Astaro? Is there "dark fibre" that connects the other campuses to you in a way that you see their internal networks instead of a public IP? Maybe you could show pictures of your 'Interfaces' and 'Additional Addresses' with the middle numbers blanked out like 68.***.***.33. And indicate which names are indicative of the various campuses.
Cheers - Bob
Sophos UTM Community Moderator Sophos Certified Architect - UTM Sophos Certified Engineer - XG Gold Solution Partner since 2005
@BAlfson
Sorry, It took too long to respond [[:)]]
Are there VLANs defined on the External interface of the Astaro?
Yes, there are vlans per remote campus on external interface.
Is there "dark fibre" that connects the other campuses to you in a way that you see their internal networks instead of a public IP?
There is only one fiber cable - its yellow btw [[:)]] - that connects main campus to ISP, so no direct connection between remote and main campuses. So I understand ISP routes the vlans to our main campus and they all go to Internet via vlan 80 (see the attachment).
Maybe you could show pictures of your 'Interfaces' and 'Additional Addresses' with the middle numbers blanked out like 68.***.***.33. And indicate which names are indicative of the various campuses.
Attached.
INTERNET - external interface,
SERVERS - DMZ
TRUST - main campus internal interface
ARHAVI_MYO, MYO, ESKI_REKTORLUK, SAGLIK_YO are remote campuses
What I did to achieve some reliable QoS is to create a 10 mbit granted pool that includes all main campus IP/networks. It seems to work. But not like the way "Equalizer" options advertise. I mean, yes my pool seems to divide the 10 mbit equally thus I get around 30-40 KiB/s on each client. But I get this speed when there are few users also. What I expect was; don't limit users, let them suck bandwidth until new users start to use internet. Then try to QoS bandwidth among users. So the pool and equalizer features work differently?
Quote