Once you start using Fastvue Sophos Reporter with Site Clean, one of the first things you may notice is the bulk of your traffic typically comes from YouTube. The Site Clean functionality provides a clear picture of how much bandwidth is being used because it consolidates all the YouTube traffic instead of splitting it among youtube.com, googlevideo.com, ytimg.com, and other domains.
In the days of old, YouTube primarily contained cute cat videos. Now the site has expanded to include vast amounts of valuable content that could legitimately be required by a company. The big question is: How can a company allow YouTube traffic while limiting its ability to slow down Internet connectivity?
One approach is to simply limit the number of users who have access to streaming media, but this restriction could legitimately affect all of a company's employees. The other approach is to impose some clever flexible limits.
Sophos UTM has the capability of providing Quality Of Service (QoS) for the traffic that passes through it. Because QoS is a generic term, let’s start with what it means. Wikipedia defines QoS as:
The overall performance of a telephony or computer network, particularly the performance seen by the users of the network.
This definition implies you should get what you expect. If you've bought and paid for a certain level of service, you expect to have that delivered to you by the network or ISP. If you do not get that expected level, the QoS has not been met.
Network administrators need to deliver multiple services on a network, and for them, QoS means much more. Your network may be oversubscribed at certain times of the day and almost idle during others. During the idle time, there will usually be no problem maintaining the expected QoS, but during times of congestion, you need to ensure critical applications function as expected.
There are various kinds of traffic, and they have different tolerances for latency and bandwidth starvation.
An example of traffic that needs a high QoS is a video conference call or VOIP application. If insufficient QoS is available, the video will drop frames or scale down the quality of the feed. An example of traffic that can sustain some reduction in QoS is normal web browsing. Web pages still load, just perhaps a little slower.
On the other hand, YouTube traffic is somewhere in between. Leaving your video quality on automatic will allow it to fairly aggressively move between the quality modes, seeking the best available quality that can be sustained. This not only applies to scaling up and using higher stream quality but also to scaling down when required.
Without some sort of QoS control, YouTube and web browsing could squash the performance of a video conference call. This would negatively impact video streaming users, but web browsing users may not even notice. YouTube users might have to drop quality, but the videos still would play perfectly fine.
This is what is meant by QoS in the Sophos UTM context. It is the various configurations enabling us to use selective QoS control.
For QoS to be effective over a network interface, you first need to specify the available bandwidth. Then, you need to explicitly enable QoS on the interface. Because QoS does incur some overhead, it is not advisable to turn it on for a network interface that does not require it.
As an example, the WAN link typically is significantly slower than the internal link. It would therefore be impossible to saturate the internal link with traffic from the WAN because having QoS on the WAN implicitly means you have QoS on the internal network.
These steps will allows you to configure a very basic QoS deployment that you can use to limit YouTube traffic:
There is some confusion in the non-technical audience when it comes to kb vs KB. The capital B is a byte, and a byte is 8 bits. Data size is measured in bytes, while network speeds are measured in bits/second. What this means is that a 10Mb/s Internet line can transfer 1.25 MB/s, but, practically speaking and factoring in network overhead, I always work on a 10 to 1 ratio. 10Mb speed equals 1MB.
At this stage, you will have already made an improvement to your network. After specifying the limits for the interface, the UTM will now enforce fairness and equality when the limits are reached.
Specifically, the automatic QoS settings do the following:
Download Equalizer: If enabled, Stochastic Fairness Queuing (SFQ) and Random Early Detection (RED) queuing algorithms will avoid network congestion. If the configured downlink speed is reached, packets from the most downlink consuming stream will be dropped.
Upload Optimizer: If enabled, this option will automatically prioritize outgoing TCPClosed connection establishments (TCP packets with SYN flag set), acknowledgement packets of TCP connections (TCP packets with ACK flag set and a packet length between 40 and 60 bytes), and DNSClosed lookups (UDPClosed packets on port 53).
As mentioned above, different classes of traffic have different QoS requirements. Sophos UTM uses traffic selectors to allow you to select and group traffic types. There are several ways to use traffic selectors:
This demonstration will use an Application selector with to limit YouTube bandwidth. If you don’t already have application control enabled, you should do so by completing the following steps:
Now configure a traffic selector for YouTube:
Bandwidth pool is a bit of a vague term to use—a better name is "interface bandwidth guarantees and optional limits," but that's a bit of a mouthful. In this step, you can use one of the traffic selectors you created and guarantee a set amount of bandwidth for it, specific to an interface. By defining a bandwidth pool, you are reserving capacity. You also have the option to set a maximum amount of bandwidth that can be used.
The limits here guarantees YouTube will always have 128kb/s available but can never exceed 1024 kb/s. If you do not specify an upper limit, the traffic will be allowed to burst out and consume all available bandwidth.
The term that is often used to describe throttling by ISPs is shaping. Personally, I think it is just an attempt to make the phrase sound less brutal. Throttling gives you the ability to limit or choke traffic that can handle lower bandwidth and higher latency.
There are a few options available to enforce the limit. Selecting shared achieves the same result as setting the upper bandwidth limit in the bandwidth pool.
In this example, we selected each source address to make sure that no single IP can consume more than 256 kbits/s for YouTube, meaning that any YouTube stream is limited to 256 kbits per second and multiple streams from the same IP would have to share the limits.
The combination of the bandwidth pool and the download throttle gives you a global limit and individual limits. I did some basic calculations to determine approximately how much bandwidth is required for each of the different YouTube quality streams. The results are as follows:
From this list, we can see that the network QoS setting defined above would allow video quality of up to 480P per user for up to 4 concurrent users.
QoS does not magically give you more bandwidth, and any benefits you see from it are achieved by stealing from Peter and giving to Paul. Trying to enforce overly complex QoS rules will not have the desired result. Having a clear, simple view of what you want to achieve is the most prudent way to proceed. All that remains now is for you to test your deployment and see whether it is working as expected.
Because we specified throttles per source IP, you might want to use a few machines in your testing. You should now be able to start YouTube videos, and they should run fairly smoothly until you start adding more than 4 streams from 4 separate sources and IPs. The YouTube player should then start stepping down the quality automatically or start experiencing buffering delays. This is because, despite how hard you might be trying, the bandwidth pool will keep the YouTube traffic pegged to 1mbit/s.
This means that even with everyone trying to view YouTube at the same time, you should be able to have a decent-quality Skype video call!
I hope this article has been useful for you, and I'd love to hear about your experience with Sophos UTM QoS in the comments!
Download the free 30 day trial, or schedule a demo and we'll show you how it works!
Filtering and Forwarding Sophos UTM Syslog Data with Syslog-ng
How to Configure Multiple Site-to-Site SSL VPNs with Sophos UTM