FW1565 20 0v1 Getting Started with Traffic Shaping on Sophos Firewall

Prévia do material em texto

<p>Copyright © 2024 Sophos Ltd</p><p>Sophos Firewall</p><p>Getting Started with</p><p>Traffic Shaping on</p><p>Sophos Firewall</p><p>Version: 20.0v1</p><p>[Additional Information]</p><p>Sophos Firewall</p><p>FW1565: Getting Started with Traffic Shaping on Sophos Firewall</p><p>January 2024</p><p>Version: 20.0v1</p><p>© 2024 Sophos Limited. All rights reserved. No part of this document may be used or reproduced in any form or by any means without the prior written</p><p>consent of Sophos.</p><p>Sophos and the Sophos logo are registered trademarks of Sophos Limited. Other names, logos and marks mentioned in this document may be the</p><p>trademarks or registered trademarks of Sophos Limited or their respective owners.</p><p>While reasonable care has been taken in the preparation of this document, Sophos makes no warranties, conditions or representations (whether express</p><p>or implied) as to its completeness or accuracy. This document is subject to change at any time without notice.</p><p>Sophos Limited is a company registered in England number 2096520, whose registered office is at The Pentagon, Abingdon Science Park, Abingdon,</p><p>Oxfordshire, OX14 3YP.</p><p>Getting Started with Traffic Shaping on Sophos Firewall - 1</p><p>Copyright © 2024 Sophos Ltd</p><p>Getting Started with Traffic Shaping on Sophos Firewall</p><p>In this chapter you will learn how</p><p>to configure the global settings</p><p>for traffic shaping, including</p><p>default policy settings, and the</p><p>different types of traffic shaping</p><p>policy you can create.</p><p>DURATION 8 minutes</p><p>RECOMMENDED KNOWLEDGE AND EXPERIENCE</p><p>✓ Navigating Sophos Firewall using the web admin</p><p>console</p><p>✓ Managing the Sophos Firewall using the web</p><p>admin console</p><p>Copyright © 2023 Sophos Ltd</p><p>In this chapter you will learn how to configure the global settings for traffic shaping, including default</p><p>policy settings, and the different types of traffic shaping policy you can create.</p><p>Getting Started with Traffic Shaping on Sophos Firewall - 2</p><p>Copyright © 2024 Sophos Ltd</p><p>Traffic Shaping</p><p>What are some example scenarios where traffic shaping</p><p>can be deployed to help optimize and manage network</p><p>performance?</p><p>Using traffic shaping policies, you can manage bandwidth and prioritize network traffic to reduce the</p><p>impact of heavy bandwidth usage.</p><p>What are some example scenarios where traffic shaping can be deployed to help optimize and</p><p>manage network performance?</p><p>Getting Started with Traffic Shaping on Sophos Firewall - 3</p><p>Copyright © 2024 Sophos Ltd</p><p>Traffic Shaping</p><p>Protect business continuity</p><p>Prioritize or guarantee bandwidth for cloud services</p><p>Limit bandwidth of non-business critical heavy bandwidth applications</p><p>Control bandwidth usage from guest networks</p><p>Traffic shaping is primarily deployed to protect business continuity. With the increasing move to using</p><p>cloud services it is important to prioritize and guarantee bandwidth for these business critical</p><p>applications.</p><p>Another approach is to limit bandwidth of non-business critical heavy bandwidth applications, such as</p><p>streaming and downloads.</p><p>Traffic shaping is also a great tool for controlling the amount of bandwidth used by guest networks,</p><p>ensuring they do not impact more important business use.</p><p>Getting Started with Traffic Shaping on Sophos Firewall - 4</p><p>Copyright © 2024 Sophos Ltd</p><p>Traffic Shaping Settings</p><p>Sum of the maximum</p><p>bandwidth of all WAN links in</p><p>KBps</p><p>Traffic shaping settings are configured in: CONFIGURE > System Services > Traffic shaping settings</p><p>To start using traffic shaping you should first configure the general traffic shaping settings. It is</p><p>important to specify the settings found on the CONFIGURE > System Services > Traffic shaping</p><p>settings tab.</p><p>This includes the total WAN bandwidth available, which Sophos Firewall needs so it can allocate</p><p>bandwidth effectively. The total available WAN bandwidth is the sum of the maximum bandwidth of</p><p>all WAN links in KBps.</p><p>To view bandwidth usage, click Show bandwidth usage at the bottom of the page.</p><p>Getting Started with Traffic Shaping on Sophos Firewall - 5</p><p>Copyright © 2024 Sophos Ltd</p><p>Traffic Shaping Settings</p><p>The option Optimize for real-time (VoIP) gives priority to real-time traffic such as VoIP. If disabled,</p><p>priority will be applicable only for excess bandwidth, that is, bandwidth remaining after guaranteed</p><p>bandwidth allocation.</p><p>If ‘Optimize for Real-Time (VoIP)’ is enabled real-time traffic (Traffic Shaping policy with priority 0) like</p><p>VoIP will be given precedence over all other traffic.</p><p>As priority is given to the real time traffic, it is possible that some non-real-time traffic will not get</p><p>their minimum guaranteed bandwidth. Specifically, if the sum of Limit (max allowed) of all Traffic</p><p>Shaping policies (real-time and non real-time) is greater than total max-limit, then guaranteed</p><p>bandwidth of the real-time policies will be fulfilled but non-real-time might not get the minimum</p><p>guaranteed bandwidth.</p><p>Getting Started with Traffic Shaping on Sophos Firewall - 6</p><p>Copyright © 2024 Sophos Ltd</p><p>Traffic Shaping Settings</p><p>Default traffic shaping policy</p><p>for firewall.</p><p>The setting to ‘Enforce guaranteed bandwidth’ should only be enabled if you would like to apply the</p><p>default policy shown here to all traffic that does not have an explicit Traffic shaping policy applied to it.</p><p>If this option is enabled, you should take the time to configure the default policy as well.</p><p>Enforce guaranteed bandwidth handles all Internet-bound traffic by the traffic-shaping policy applied</p><p>to it. If there is no policy applied to the traffic, it will be handled by the default policy.</p><p>• Enable this setting if you want to enforce bandwidth restriction on the traffic to which a traffic-</p><p>shaping policy is not applied</p><p>• Disable this setting if you do not want to enforce a bandwidth restriction on traffic to which a</p><p>traffic-shaping policy is not applied (it will handle traffic only on which a traffic-shaping policy is</p><p>applied)</p><p>If you have enabled Enforce guaranteed bandwidth you can configure the default policy to use for</p><p>traffic that does not have a traffic-shaping policy applied.</p><p>• Guarantee, is the minimum bandwidth available to the user</p><p>• Limit, is the maximum bandwidth available to the user</p><p>• Priority, can be set from 1 (highest) to 7 (lowest) depending on the traffic required to be shaped</p><p>Getting Started with Traffic Shaping on Sophos Firewall - 7</p><p>Copyright © 2024 Sophos Ltd</p><p>Traffic Shaping Policies</p><p>What the traffic shaping policy</p><p>will be applied to</p><p>Additional information in</p><p>the notes</p><p>Traffic shaping policies are configured in CONFIGURE > System services > Traffic shaping.</p><p>Traffic shaping policies can be applied to either users, rules, web categories or applications, and can be</p><p>used to either limit or guarantee bandwidth.</p><p>You can choose to set bandwidth limits for upload and download either separately or combined.</p><p>The Priority field is used to set the traffic type to which bandwidth priority is to be allocated. By</p><p>default, priority is assigned to realtime traffic. When priority is allocated to real-time traffic, the ability</p><p>of non-real time policies to receive their guaranteed bandwidth is determined by the bandwidth</p><p>remaining in the total available bandwidth after real-time policies have been serviced.</p><p>Bandwidth usage can either be configured to be individual or shared. Individual applies the policy to a</p><p>single user, firewall rule, web category or application. Shared applied to policy to all the users, firewall</p><p>rules web categories or applications which have the policy assigned.</p><p>[Additional Information]</p><p>Rule type:</p><p>• Limit User cannot exceed the defined bandwidth limit</p><p>• Guarantee User is guaranteed the specified bandwidth and can draw on bandwidth up to the</p><p>specified limit, if available. Allowing users to draw on additional bandwidth can ensure constant</p><p>service levels during peak periods</p><p>Getting Started with Traffic Shaping on Sophos Firewall - 8</p><p>Copyright © 2024 Sophos Ltd</p><p>Traffic Shaping Policies Example</p><p>Let's look at an example policy. Here we have a policy to limit the bandwidth of streaming media</p><p>applications</p><p>to 480p based on their web category as determined by the firewall.</p><p>We have set the association to Web categories and the Rule type to Limit. We then calculated the</p><p>bandwidth needed for 480p video to 1000 KB/s and set it as an individual limit, so each person</p><p>viewing a video will have enough bandwidth to view the video at 480p.</p><p>Finally, the Priority is set low. We have chosen a priority of 5 to make sure it is processed after any</p><p>business-critical applications.</p><p>Getting Started with Traffic Shaping on Sophos Firewall - 9</p><p>Copyright © 2024 Sophos Ltd</p><p>Applying Traffic Shaping - Web</p><p>PROTECT > Web > Categories</p><p>Traffic shaping can also be applied to web categories under PROTECT > Web > Categories.</p><p>By editing a category, you can select a traffic shaping policy to apply to that web category,</p><p>independent of the firewall rule matched.</p><p>Getting Started with Traffic Shaping on Sophos Firewall - 10</p><p>Copyright © 2024 Sophos Ltd</p><p>Chapter Review</p><p>The total WAN bandwidth must be configured before using traffic shaping.</p><p>You can configure a default traffic shaping policy for all traffic that does not have a policy applied.</p><p>Traffic shaping policies can be created for users, rules, web categories, and applications.</p><p>Here are the three main things you learned in this chapter.</p><p>The total WAN bandwidth must be configured before using traffic shaping.</p><p>You can configure a default traffic shaping policy for all traffic that does not have a policy applied.</p><p>Traffic shaping policies can be created for users, rules, web categories, and applications.</p><p>Getting Started with Traffic Shaping on Sophos Firewall - 16</p><p>Copyright © 2024 Sophos Ltd</p><p>Getting Started with Traffic Shaping on Sophos Firewall - 17</p>