Amer Networks E5Web GUI - Manual (Page 658)

to the outer IP header of ESP packets of IPsec tunnels. The field can alternatively be set to a
fixed value in the outer tunnel packets as described in Section 9.4.6, “IPsec Advanced Settings”.
It is important to understand that cOS Core traffic shaping does not add new Diffserv information
as packets traverse a Clavister Security Gateway. The cOS Core traffic shaping priorities described
later in this chapter are for traffic shaping within cOS Core only and are not translated into
Diffserv information that is then added to packets.
The Traffic Shaping Solution
Architectures like Diffserv however, fall short if applications themselves supply the network with
QoS information. In most networks it is rarely appropriate to let the applications, the users of the
network, decide the priority of their own traffic. If the users cannot be relied upon then the
network equipment must make the decisions concerning priorities and bandwidth allocation.
cOS Core provides QoS control by allowing the administrator to apply limits and guarantees to
the network traffic passing through the Clavister Security Gateway. This approach is often
referred to as traffic shaping and is well suited to managing bandwidth for local area networks as
well as to managing the bottlenecks that might be found in larger wide area networks. It can be
applied to any traffic including that passing through VPN tunnels.
Traffic Shaping Objectives
Traffic shaping operates by measuring and queuing IP packets with respect to a number of
configurable parameters. The objectives are:
• Applying bandwidth limits and queuing packets that exceed configured limits, then sending
them later when bandwidth demands are lower.
• Dropping packets if packet buffers are full. The packets to be dropped should be chosen from
those that are responsible for the congestion.
• Prioritizing traffic according to administrator decisions. If traffic with a high priority increases
while a communication line is full, traffic with a low priority can be temporarily limited to
make room for the higher priority traffic.
• Providing bandwidth guarantees. This is typically accomplished by treating a certain amount
of traffic (the guaranteed amount) as high priority. The traffic that is in excess of the
guarantee then has the same priority as other traffic, competing with all the other
non-prioritized traffic.
Traffic shaping does not typically work by queuing up immense amounts of data and then
sorting out the prioritized traffic to send before sending non-prioritized traffic. Instead, the
amount of prioritized traffic is measured and the non-prioritized traffic is limited dynamically so
that it will not interfere with the throughput of prioritized traffic.
Note: Traffic shaping will not work with the SIP ALG
Any traffic connections that trigger an IP rule with a service object that uses the SIP ALG
cannot be also subject to traffic shaping.
10.1.2. Traffic Shaping in cOS Core
cOS Core offers extensive traffic shaping capabilities for the packets passing through the
Chapter 10: Traffic Management
658