Bandwidth is consumed and not recovering when windows update is triggered.

[sethadrian]

Hi Guys,

Need your help on this.  I have a FG100D with two ISP connections configured to perform LLB.  Firewall is working okay except at point when servers and allowed PCs are doing windows update.  It seems that the Bandwidth is exhausted even if the windows update app control is shaped to 1Mbps.  Worst part is even if the update is already downloaded, the bandwidth does not recover and continuously exhausts resulting to slow internet connection.  also I am seeing a session clash log under system events.  Anyone have fix on this? need help.

Regards,

Seth

[retrotech]

You didnt specify what version of Windows you are running, but if you are running Windows 10 (especially combined with the newest office), it could be the culprit. The updates may be downloading (and pushing out to others on the Internet) via P2P. This is the default setting (which can be changed). On top of this, the updates are fairly large. The updates will download whenever it feels like it if you are in a non-domain setup like us (we're a small business with no need for the extra complexity and cost). Rather than increase bandwidth, we setup policies to block Windows and Mac OS updates plus Office updates via app control an hour before and up to an hour after work hours and then allow those connections on nights/weekends. We also segmented a few static IPs to use for I.T. staff to do manual windows updates during the work day if needed. So far its been working well. This may or may not work in other situations, but works for us. We'd also like to hear others solutions if anyone else has any.

[sethadrian]

Hi retrotech,

thank you for your reply.  you are right it is a windows 10.  regarding your suggestions to create scheduled policies for windows updates, it can be done there is no problem with that.  The only thing that i am concerned about is that how come that even after the windows already finishes the updates and is in idle already, the bandwidth does not recover and still it consumes the entire allocation?  Have you encountered those instances?

[retrotech]

Sorry, we didnt pay that close attention when it was happening. Makes me think it's something with the way Windows 10 does P2P update sharing? If thats the case, maybe the "Choose how updates are delivered" setting might affect that? (Or maybe not?) If anyone has any solid or confirmed information i'd be interested to know as well.

[sethadrian]

It is kind of a weird behavior specially when these desktops are already shut off.  still the BW is being clipped out and checking on forward traffic there is not a single windows update activity happening. The BW does not really recover and the only thing to stop it is to initiate a session clear command.  I also attempted to configure an application shaper for windows update signature but did not work.  In addition, I tried configuring a scheduled policy for the update to be allowed on off shifts but problem is when next day comes the BW is clipped out even though there is no production during night times. Do you have any suggestions that i might have missed?

[tanr]

Seth,

Have you confirmed that the Windows 10 desktops have had their P2P sharing of Windows Update files turned off? Because if not they may be happily trying to send updates to Windows 10 users outside your local network, which is almost what this sounds like.  And if they're doing it using Tenedo, it's hard to track.

The settings are buried, see http://www.pcworld.com/article/2955491/windows/how-to-stop-windows-10-from-using-your-pcs-bandwidth-... for how to change them.

[retrotech]

The p2p setting that tanr linked will probably be the more important thing to implement on all your computers. Probably want to double check its set right on each machine too. Time based policies would only help you move the rather large Windows 10 updates to after hours. We don't have any traffic after hours and we have tight bandwidth so it's perfect for us. You might give application traffic shaping a try again after setting the p2p setting on all machines, if you want to let the updates download during the day.

[sethadrian]

tanr,

regarding your first statement about the bandwidth being used by the PC to share updates.  I understand that the traffic flow would be egress from the WAN interface.  So if the internet bandwidth would be used and consumed in particular it should be the upload bandwidth and not the download bandwidth.  When i did samples with a PC trying to get updates the download bandwidth of WAN interface was consumed. this is normal since it is downloading.  Now when the update is finished assuming the the PC will begin its sharing state, it will now redirect the flow in opposite direction.  Which means on the WAN interface, the one that will be utilized then will be the upload bandwidth.  Checked on the graph, it turns out that the upload transmission is only averaging about 400 kbps to max around 1 Mbps and the download speed is still being eaten up.  this is why i am quite confused as to why the download bandwidth is still consumed instead of the upload bandwidth even though there are no more downloading activities at that time.

[sethadrian]

hi tanr,

i am just quite confused with your first statement.  so let's say I have an ISP connection of 10up/10down CIR.  When i update windows on PC obviously the 10Mbps download would be consumed.  Now after the update is downloaded and PC begins its sharing state, Should it be the 10Mbps upload that would be used and not the 10Mbps download?

[sethadrian]

hi tanr,

i am just quite confused with your first statement.  so let's say I have an ISP connection of 10up/10down CIR.  When i update windows on PC obviously the 10Mbps download would be consumed.  Now after the update is downloaded and PC begins its sharing state, Should it be the 10Mbps upload that would be used and not the 10Mbps download?