Traffic Shaping Based on IP address

[Thilina_Senevirathna]

Hi, Could we implement in Traffic Shaping in the firewall such that it can detect and limit bandwidth usage of the WAN link based on the IP address? Thanks. Thilina

[emnoc]

Yes , just make the shaper per-ip. Keep in mind when you say WAN link utilization, we are assuming traffic egressing the wan interface.

[Thilina_Senevirathna]

Does that mean if I have total WAN bandwidth of 20Mbps, I can create policies and set limits for bandwidth usage based on IP addresses? Eg:- For 20Mbps WAN bandwidth, 192.168.1.10 - Bandwidth limit of 10Mbps 192.168.1.15 - Bandwidth limit of 4Mbps etc.

[emnoc]

Yes I guess you could, but why would you do that? Would be my 1st question & it would be a nightmare to do this per-ip imho You would need to do something like this, but keep in mind the bps values are limited by the model/OS version from what I recall. I don' t think you could write a 40mbps per-ip-shaper config firewall shaper per-ip-shaper edit " 1m" set action log set bps 1000000 next end FWWI: I typically build traffic-shaper and rate limit by protocol/service outbound to ensure low priority traffic doesn' t exhaust my WAN uplinks or set prioritization for critical services/applications. Or to ensure critical traffic is not starved such as VoIP. next edit " DNS_PORT53" set guaranteed-bandwidth 200 set maximum-bandwidth 500 set per-policy enable next edit " ICMP-rate" set maximum-bandwidth 15 set per-policy enable set priority low next edit " generic-udp-rate" set guaranteed-bandwidth 1000 set maximum-bandwidth 1250 set per-policy enable set priority low next edit " dns-udp-rate" set action none set guaranteed-bandwidth 512000 set maximum-bandwidth 768000 set per-policy disable set priority high next Keep in mind guaranteed and maxiumum bw values, the latter can' t below lower than the 1st value. I would suggest you download the current shaping guide for your OS version and review the options.