Traffic Shaping for VoIP usage in SFOS 19

Question

Hi, 
 regarding this thread , is there new features in version 19?

sanket.shah · Accepted Answer

Hello Andrea, 
 I agree it's little bit confusing user interface. Let me try to answer your query. 
 If you have 2 WAN interfaces (WAN A 90d/18u and WAN B 25d/3u) then you should consolidate all bandwidth and set total bandwidth as 136Mbps (90+18+25+3). Think of it as one common aggregated WAN pipe. 
 After that, based on different type of traffic shaping policies like application/web/user/firewall, you can orchestrate and divide your aggregated bandwidth between desired traffic. Along with it, if you can orchestrate your traffic using SD-WAN or static routing to particular WAN interface, you can decide usage of your WAN ISP link. That's how you can guarantee SIP (or any other) traffic. 
 If as admin, one make misconfiguration in traffic shaping policy, it's possible you won't be able to achieve desired results (limiting some traffic or guarantying some traffic). 
 Hope it clarifies. 
 Regards, 
 Sanket Shah

sanket.shah · Answer

Hello Andrea, 
 The configuration you mentioned makes sense if you have some identifier to distinguish between 2 SIP based firewall rules. For example, if you have 4 SIP clients and you use 2 SIP clients to use FW rule1 and for other 2 SIP clients, use FW rule2. In this case, you also need to create SDWAN rules with similar matching criteria and divert 2 SIP clients' traffic via WAN1 and for other SIP clients, create another SDWAN rule and divert traffic via WAN2. 
 Another use case could be - If you have a requirement where you want to use 10Mbps (out of 136Mbps) for SIP traffic then you can create single traffic shaping policy (FW type) and create single Firewall rule and let SIP traffic load balance between WAN1 and WAN2. 
 As I mentioned earlier, you first needs to decide your traffic shaping policies, map them with firewall rules and if requires WAN interface level granularity, you can map the same traffic with SDWAN rules. 
 As all subsystems are decoupled and have their own purpose. It's admin's responsibility to design their configuration, routing, security enforcement and deploy it. 
 Traffic shaping policy also allows you to choose different upload/download, share same bandwidth among multiple users/firewall rules kind of functionalities. It's quite flexible but at the same time confusing/complex too! 
 Regards, 
 Sanket Shah

sanket.shah · Answer

Hello Andrea, 
 After understanding your requirement, it sounds like per interface based traffic shaping policy requirement which Sophos firewall is not supporting as of now. However, I would suggest if you can try following configuration which I believe can help achieve your use case. 
 - Sophos Firewall supports "Gateway host" support (Routing >> Gateway) which you can add on top of default WAN gateways. 
 - You can replicate your default ISP gateway configuration. One additional support available in Gateway host is, you can apply "Zone" to it. 
 - You can create 2 custom zones (Network >> Zone) of type LAN or DMZ. Let's call it WAN1 and WAN2. 
 - You can associate WAN1 zone to Gateway Host1 (representing ISP1) and WAN2 to Gateway host2 (representing ISP2). 
 - Create SDWAN profile with Gateway Host1 as first gateway (low latency/jitter) and Gateway Host2 as second gateway 
 - Create SDWAN route for SIP traffic and attach SDWAN profile 
 - Create 2 traffic shaping policy for SIP traffic appropriate for ISP1 and ISP2. Let's call it SIP-ISP1 & SIP-ISP2 
 - Create 2 Firewall rules (assuming SIP clients are behind LAN zone) 
 (1) LAN > WAN1 - Allow SIP traffic - Apply SIP-ISP1 traffic shaping policy 
 (2) LAN > WAN2 - Allow SIP traffic - Apply SIP-ISP2 traffic shaping policy 
 This would help to choose different firewall rule in case of SDWAN failover/failback between ISP1/ISP2 link. 
 Please check out whether it works for you or not. 
 Regards, 
 Sanket Shah

LuCar Toni · Answer

You can do this in V19.0 and even better in the currently EAP Version of V19.5. 
 You need to specify your SD-WAN rule for VOIP and then tell the firewall, which gateway it should use.

Traffic Shaping for VoIP usage in SFOS 19

Top Replies