Description:

Some scenarios require the prioritization of certain data traffic (e.g. real-time data traffic) along with guaranteed bandwidths. This can be implemented on a Unified Firewall using the Traffic Shaping feature.

This article describes how to configure Traffic Shaping on a LANCOM R&S®Unified Firewall.

Requirements:

• LANCOM R&S® Unified Firewallwith LCOS FX as of version 10.8 REL
• A configured and functional network with Internet connection on the Unified Firewall
• Web browser for configuring the Unified Firewall
  
  The following browsers are supported:
  • Google Chrome
  • Chromium
  • Mozilla Firefox

Scenario:

In this example scenario, VoIP data traffic should be treated with priority.

Procedure:

1) Creating a Traffic Group (required):

1.1) Connect to the Unified Firewall, go to the menu Network → Traffic Shaping → Traffic Groups and click on the "+” icon to create a new traffic group.

1.2) Adjust the following parameters to create a group for VoIP traffic and click Create:

• Name: Enter a descriptive name for the group (in this example VoIP).
• Incoming DSCP: Choose an appropriate DSCP value for the group (in this case for VoIP, the flag EF (Telephony) is used).

2) Creating a Shaping Configuration (optional):

2.1) Go to the menu Network → Traffic Shaping → Shaping Configurations and click the “+” icon to create a new Shaping Configuration.

2.2) Change the following parameters:

• Interface: Select the Interface used for the Internet connection from the drop-down menu. Only one Shaping Configuration can be created per interface at any time.
• Maximum Download Bandwith: Enter the Maximum Download Bandwidth of the Internet connection (in this example 100 Mbps).
• Maximum Upload Bandwith: Enter the Maximum Upload Bandwidth of the Internet connection (in this example 40 Mbps).

2.3 For the inbound traffic adjust the following parameters under Inbound Rules and click the “+” icon to accept them:

• Traffic Group: From the drop-down menu, select the Traffic Group created in step 1 (in this case VoIP).
• Priority: From the drop-down menu, set a priority between 1 and 7, where 1 is the highest and 7 the lowest priority. Data traffic that does not match any of the rules has the lowest priority, and bandwidth is not guaranteed. Multiple rules can have the same priority. In this case, the transmission medium is shared out “fairly”.
• Guaranteed Bandwith: Enter the guaranteed bandwidth for inbound traffic. This is then reserved for the selected connection and is not available elsewhere. 
• Maximum Bandwith: Enter the maximum bandwidth for inbound traffic. If this bandwidth is exceeded, the Unified Firewall discards the relevant packets.

2.4) For the outbound traffic adjust the following parameters under Outbound Rules and click the “+” icon to accept them:

• Traffic Group: From the drop-down menu, select the Traffic Group created in step 1 (in this case VoIP).
• Priority: From the drop-down menu, set a priority between 1 and 7, where 1 is the highest and 7 the lowest priority. Data traffic that does not match any of the rules has the lowest priority, and bandwidth is not guaranteed. Multiple rules can have the same priority. In this case, the transmission medium is shared out “fairly”.
• Guaranteed Bandwith: Enter the guaranteed bandwidth for outbound traffic. This is then reserved for the selected connection and is not available elsewhere.
• Maximum Bandwith: Enter the maximum bandwidth for outbound traffic. If this bandwidth is exceeded, the Unified Firewall discards the relevant packets.

2.5) Then click Create.

3) Working with the Shaping Configuration:

3.1) Using the Shaping Configuration in a desktop connection:

On the desktop, click the network object, select the connection tool, and click the Internet object to open the desktop connection.

3.1.1) Using the Shaping Configuration for the whole desktop connection:

Go to the Traffic Shaping tab and, using the drop-down menu Traffic Group, select the Traffic Group created in step 1 (in this example VoIP) and click Save.

3.1.2) Using the Shaping Configuration for individual protocols of a desktop connection:

3.1.2.1) Under Options for the relevant protocol (in this example the user-defined service SIP), click NAT to reach the advanced settings.

3.1.2.2) Go to the Traffic Shaping tab, select the option Use Service Specific Settings and, using the drop-down menu Traffic Group, select the traffic group created in step 1 (in this example VoIP).

Then click OK.

3.1.2.3) Then click Save.

3.1. 3) Activate the configuration changes:

Finally, implement the changes by clicking Activate.

3.2) Using the Shaping Configuration on an IPsec connection:

3.2.1) Switch to the menu VPN → IPsec → Connections and, for the connection to be adjusted, click the pencil icon to edit the connection.

3.2.2) Go to the Traffic Shaping tab, use the drop-down menu to select the Traffic Group created in step 1 (in this example VoIP) and click Save.

3.3) Using the Shaping Configuration in an Application Routing profile:

3.3.1) Switch to the menu UTM → Application Management → Routing Profiles and click the desired routing profile to edit it.

3.3.2) Use the drop-down menu to select the Traffic Group created in step 1 (in this example VoIP) and click Save.