Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 4 subscribers
  • Views 21114 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

QoS to reserve bandwidth for traffic on a given port?

ShadGates

 I'm trying to resolve a problem with transfering large files between two datacenters.  One is behind a Sophos SG-230 appliance, the other a VM running the Sophos image (both on latest firmware 9.501-5).  There's an IPSec VPN connecting the two sites, both have GB Internet connections, thanks to the datacenters they're located in.

The problem is that when I'm transferring a large database backup file ( > 10GB ), via one of several protocols, it seems to be choking off other traffic, in particular SQL queries over port 1433 from one data center to the other, resulting in execution timeouts, and it starves the MS Remote Desktop protocol, causing me to lose access to the machines during these large copy jobs.

There isn't a lot of this SQL traffic, so I went through the QoS setup to define a traffic selector for MS SQL Server traffic (TCP 1433/1434), then setup a Bandwidth Pool for that traffic selector, giving it 1024 kbps (our SQL Server is seldom handling more traffic than that).  I enable that bandwidth pool, and enable all of the NICs in the QoS/Status page -- I do this in the Firewalls at both sites.

Initiating the large file copy, through FTP, for instance, still results in a large number of SQL Timeouts.

I also loose RDP connectivity between sites when the large copy is running, so I tried setting up a similar QoS rule for MS Remote Desktop (TCP 3389), but it also still gets knocked out during the transfer.

This is making me think that I'm misreading/misunderstanding how QoS is really supposed to work.

My understanding was that doing what I've described above would result in reserving 1Mbit/sec of traffic space for SQL and 1Mbit/sec for RDP, out of the available 1Gbp/sec available, leaving plenty of space for my undefined/unshaped traffic (e.g. FTP/DFS/SMB etc...).... but it's just not behaving as expected.

Can someone set me straight on this?

Thanks! 



This thread was automatically locked due to age.
Parents
  • 0

    Perhaps another way to look at it:  Can I just specify that SQL Server and RDP traffic always get highest routing priority, rather than trying to designate a minimum bandwidth for them?

  • 0 in reply to ShadGates

    In both UTM's, confirm that you have selected 'Keep classification after encapsulation' on the 'Advanced' tab of QoS.

    The "MS SQL" Service is "TCP/UDP 1:65535 → 1433:1434" in the UTM from the factory.  You probably need "MS SQL Response" = "TCP/UDP 1433:1434 → 1:65535" in addition.

    The way to prioritize traffic is the way you're doing it - with a Bandwidth Pool.  Any better luck now?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Bob,

    Thanks for the suggestions.  

    I have now set the "Keep Classification after encapsulation" checkbox on both UTMs.  

    I added a new traffic selector for the newly created MS SQL Response service, and added it to the bandwidth pool.

    Services:

    Traffic selectors:

    Bandwidth Pool:

    Advanced tab:

    Same setup at both UTMs, and I still get timeouts from SQL Executions while FTPing large files.

Reply
  • 0 in reply to BAlfson

    Bob,

    Thanks for the suggestions.  

    I have now set the "Keep Classification after encapsulation" checkbox on both UTMs.  

    I added a new traffic selector for the newly created MS SQL Response service, and added it to the bandwidth pool.

    Services:

    Traffic selectors:

    Bandwidth Pool:

    Advanced tab:

    Same setup at both UTMs, and I still get timeouts from SQL Executions while FTPing large files.

Children
  • 0 in reply to ShadGates

    Are the large files also being copied through the same tunnel?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Yes, there is one IPSec tunnel between the two UTMs.  

    The FTP and SQL Connections are happening between the machines using their internal IP addresses.

  • 0 in reply to ShadGates

    And these are MS SQL, not Oracle, PostgreSQL or other?  This should work!

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Ah, I missed it before.  Bind the Bandwidth Pools to the External interface.  Any better luck with that?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Yes, real MS SQL Server endpoint.

    The bandwidth pools have the interface option greyed out.

    I was thinking that the interface would never see the traffic on the ports anyway, since it would be encapsulated in the IPSec tunnel -- or is that what the Advanced checkbox was all about?

    Some other firewalls I've used (low-end Zywall USGs), put the VPN endpoints in the Interface list, so you could specify things within the VPN.

  • 0 in reply to ShadGates

    Shad, I added another post while you were working on that one.  Check just above your last post.  You have to create the Bandwidth Pools on the External Interface - you can't move them between interfaces.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    I saw it, that's why I mentioned that the Bandwidth Pools had their Interface selection greyed out and included the screen cap.

    Took me a bit to notice the "bind to interface" at the top of the bandwidth pool screen. 

Cookie Information Banner