Is QoS working?

Question

Hello everyone, 
 This is our first implementation of QoS so perhaps more experienced members can confirm that is all is setup right. We have worked with Support and it seems like all the settings are correct but our Data network spikes past the limits set by QoS. 
 
 We want to limit all data traffic for internal LAN traffic (Data QoS) to 5-7Mbps. However we are seeing spikes to full 10Mpbs in utilization. 
 QoS (WAN = 10/10Mps)

Utilization

Traffic Selectors 
 Each selectors is a different subnet with VLANed interface - all is well internally with DHCP and traffic separation. 
 
 Bandwidth Pools 
 
 Data Pool

So what gives? How is it that our Data Pool can be consuming full 10Mbps? 
 Thank you!

BioTech · Accepted Answer

Well, I finally got a chance to work with support and after some testing consensus was that Bandwidth Pools is sort of best effort and min. bandwidth guarantee and it fails when controlling downloads. Which, to me, beats the whole purpose of QoS if users(networks) can trigger a large file download and consume the full WAN link. What good is the "guaranteed" bandwidth value if you can't impose it in both directions? So is QoS actually working? Maybe, but seems useless without throttling. 
 So the solution was to: 
 1. Enable every interface under Status, being concerned only with WAN's true speed. 
 
 2. Create traffic selectors for Both Upload and Download to be used for Throttling on each network/interface. 
 
 3. Then on the Bandwidth Throttling apply the Download Throttling on the External Interface for Downloads, and on the Internal interface for Uploads - repeat for each of the internal interfaces/networks to control Uploads. This took me a bit to digest, use of "(up)" naming for each interface was confusing. 
 External Interface 
 
 Internal (up) = "Data"

It seems to be a long way around to get this to work but it checks out, hopefully someone can chime in with a more elegant way if there is one.

Billybob · Answer

Your settings are correct. QoS flakes out once in a while if you are using web proxy etc because the proxy is actually sending and receiving on behalf of the internal network so the internal network rules don't work when sending traffic externally. I usually try to use application control to limit traffic and it works great. I just tested what you are trying and seems that it works correctly if you apply download throttling instead of data pools (maybe they broke it in one of the firmware updates and nobody complained[:(] ) 
 Leave everything like it is, turn off your data pool rule. Then go under download throttling and recreate the same rule but on internal network. 
 
 This will actually throttle the traffic leaving the internal interface and will be throttled. Since you have support contract, file this as a bug also so they are aware of it. Keep in mind that if you are running any servers like smtp etc, that connection may not get throttled using this method since the message is first queued in the smtp proxy spool before it is delivered.