The Traffic Shaping Solution
However, architectures like DiffServ fall short if applications themselves supply the network with
QoS information. In most networks it is rarely appropriate to let the applications, the users of the
network, decide the priority of their own traffic. If the users cannot be relied upon then the
network equipment must make the decisions concerning priorities and bandwidth allocation.
NetDefendOS provides QoS control by allowing the administrator to apply limits and guarantees
to the network traffic passing through the NetDefend Firewall. This approach is often referred to
as traffic shaping and is well suited to managing bandwidth for local area networks as well as to
managing the bottlenecks that might be found in larger wide area networks. It can be applied to
any traffic including that passing through VPN tunnels.
Traffic Shaping Objectives
Traffic shaping operates by measuring and queuing IP packets with respect to a number of
configurable parameters. The objectives are:
• Applying bandwidth limits and queuing packets that exceed configured limits, then sending
them later when bandwidth demands are lower.
• Dropping packets if packet buffers are full. The packets to be dropped should be chosen from
those that are responsible for the congestion.
• Prioritizing traffic according to administrator decisions. If traffic with a high priority increases
while a communication line is full, traffic with a low priority can be temporarily limited to
make room for the higher priority traffic.
• Providing bandwidth guarantees. This is typically accomplished by treating a certain amount
of traffic (the guaranteed amount) as high priority. The traffic that is in excess of the
guarantee then has the same priority as other traffic, competing with all the other
non-prioritized traffic.
Traffic shaping does not typically work by queuing up immense amounts of data and then
sorting out the prioritized traffic to send before sending non-prioritized traffic. Instead, the
amount of prioritized traffic is measured and the non-prioritized traffic is limited dynamically so
that it will not interfere with the throughput of prioritized traffic.
Note: Traffic shaping will not work with the SIP ALG
Any traffic connections that trigger an IP rule with a service object that uses the SIP ALG
cannot be also subject to traffic shaping.
10.1.2. Traffic Shaping in NetDefendOS
NetDefendOS offers extensive traffic shaping capabilities for the packets passing through the
NetDefend Firewall. Different rate limits and traffic guarantees can be created as policies based
on the traffic's source, destination and protocol, similar to the way in which security policies are
created based on IP rules.
The two key components for traffic shaping in NetDefendOS are:
• Pipes
• Pipe Rules
Chapter 10: Traffic Management
777
To Next Page
Loading...
