Bandwidth capping at Source

Transcription

1 Bandwidth capping at Source Issue The Web has become a vital method of communication for Businesses and Organizations worldwide. Although an extremely valuable communication tool, the Web also provides a way for Viruses to enter Networks. The same Network used to save money and make Organizations more efficient is also the entry point for the potentially dangerous viruses. Apart from the Viruses, Abusive applications and Users are also the threat to the Network security and play major role in congesting Network. Because it generate voluminous traffic and spreads very fast, it is very difficult to troubleshoot. This results into loss of business, frustration, higher costs and Network downtime and affects other essential services in the Network. Solution In response to this growing threat of virus infection and the difficulties of maintaining security services, it becomes necessary to tackle the problem at the root itself. A managed approach to this is to place protection at the root level i.e. the Client itself and still be controlled centrally. The goal of this approach is to keep harmful content outside the Network. Elitecore once again has come up with an Innovative solution in 24online to protect Ethernet networks against congestion due to virus attacks and abusive IP traffic. This solution comes as a network level driver which is installed along with the 24online client. It caps the bandwidth at the source i.e. on the client computer itself as per the server side configuration. In addition to this the bandwidth cap can be controlled centrally from the 24online server which would be propagated to the 24online clients. Congestion in the Network occurs due to the excessive traffic generated by 1. Virus attacks 2. Network Abusers The 24Online Client solution residing at the Client caps the bandwidth allocated to the Client.

2 Benefits Capping the bandwidth of the Client makes sure that even if the virus attacks: 1. Reduced essential servers downtime 2. Reduced downtime 3. Reduce Attack impact 4. Reduce trouble shooting cost 5. High Network Control 6. Abusers will not be able to choke the bandwidth

3 Implementation Bandwidth policy is used to restrict the bandwidth of the User at server side. Even with this restriction it is possible for the user to generate traffic on the internal network and clog the network. After installing the new bandwidth control enabled client the upstream bandwidth will be capped at the client side which will stop the client from clogging the network with malicious traffic. The following paragraphs introduce the different parameters and scenarios of client side bandwidth restriction. Default Bandwidth value Default bandwidth is the bandwidth value that will be applicable when User is not logged on. By default it is 32 kilobits/sec. After the user logs on the session bandwidth value is applied. Session Bandwidth value Session bandwidth is a value relative to the actual bandwidth assigned to the every user through Bandwidth policy. For every bandwidth policy, a Client side bandwidth factor value is to be defined which will calculate the Session bandwidth according to the restriction placed. Bandwidth restriction is placed by Bandwidth policy or at the time of scheduling the policy for the individual User. Session bandwidth is applied only after User logs on. Session Bandwidth value is calculated as follows: Session Bandwidth = Client side bandwidth factor * burstable bandwidth The client side bandwidth factor can be configured in the bandwidth policy configuration screen as explained later. How it works After installing/upgrading the new 24online client software the 24online client contacts the server to get the default bandwidth value. Immediately the bandwidth will be capped to the default bandwidth value. This means that the user won t be able to generate any traffic above default bandwidth value. After the user logs on the session bandwidth value will be applied. After the User logs out, the default bandwidth value will again be applicable. Creation of Bandwidth policy Select Policy Management! Bandwidth Policy! Create to open the create policy window Common Screen Elements Screen Elements Bandwidth restriction details Policy name Assign name to the policy. Choose a name that best describes the policy to be created Can be any combination of A Z, a z, _, 0-9 Full description of the policy 3

4 Create button Cancel button Can be any combination of A Z, a z, _, 0-9 Creates the policy Cancels the current operation Creation of Strict Bandwidth policy Screen Elements Bandwidth Restriction Details Policy based on Creates policy Policy type Implementation on Click Pool to create Pool based policy Click User to create User based policy Click IP Address to create IP address based policy Type of bandwidth restriction Click Strict to apply strict policy Implements Bandwidth restriction depending on the selection Click Total to implement bandwidth restriction on the Total (Upstream + Downstream) Total bandwidth (Only for TOTAL Upload Bandwidth Click Individual to implement bandwidth restriction on the Individual Upstream and Individual Downstream bandwidth Allocates maximum amount of Total bandwidth, expressed in terms of KBps Specifies maximum amount of Upstream Bandwidth, expressed in 4

5 (Only for INDIVIDUAL Download Bandwidth (Only for INDIVIDUAL Bandwidth usage Client side bandwidth factor terms of KBps Specifies maximum amount of Downstream Bandwidth, expressed in terms of KBps Bandwidth specified can be for a particular User or Shared among all the users who have been assigned this policy Click Individual for a particular User Click Shared to be shared among the users Value which will be used to calculate the session bandwidth value and default bandwidth value. Session bandwidth is applied only after User logs on. Once the User logs off, the default bandwidth value will be applicable. For the Strict Total bandwidth policy: Session bandwidth = Client side bandwidth factor * Total bandwidth For the Strict Individual bandwidth policy: Session bandwidth = Client side bandwidth factor * Upload bandwidth 5

6 Creation of Committed Bandwidth policy Screen Elements Bandwidth Restriction Details Policy based on Creates policy based on the selection Policy type Implementation on Click Pool to create Pool based policy Click User to create User based policy Click IP Address to create IP address based policy Type of bandwidth restriction Click Committed to apply committed policy Implements Bandwidth restriction depending on the selection Click Total to implement bandwidth restriction on the Total (Upstream + Downstream) Guaranteed (Min)/Burstable(Max) (Only for TOTAL Guaranteed (Min)/Burstable(Max) Upload Bandwidth (Only for INDIVIDUAL Click Individual to implement bandwidth restriction on the Individual Upstream and Individual Downstream bandwidth Allocates Guaranteed (minimum) and Burstable (maximum) amount of Total bandwidth, expressed in terms of KBps Specifies Guaranteed (minimum) and Burstable (maximum) amount of Upstream Bandwidth, expressed in terms of KBps 6

7 Guaranteed (Min)/Burstable(Max) Download Bandwidth (Only for INDIVIDUAL Bandwidth usage Client side bandwidth factor Specifies Guaranteed (minimum) and Burstable (maximum) amount of Downstream Bandwidth, expressed in terms of KBps Bandwidth specified can be for a particular User or Shared among all the users who have been assigned this policy Click Individual for a particular User Click Shared to be shared among the users Value which will be used to calculate the session bandwidth value. Session bandwidth is applied only after User logs on. Once the User logs off, the default bandwidth value will be applicable. Value 0 means no restriction on client side bandwidth For the Committed Total bandwidth policy: Session bandwidth = Client side bandwidth factor * burstable bandwidth For the Committed Individual bandwidth policy: Session bandwidth = Client side bandwidth factor * Upload burstable bandwidth 7

8 Exclusion list Exclusion list is a list of destination IP addresses and ports which have to be excluded from client side bandwidth control. Any traffic from the client to the destination IP addresses and ports in the Exclusion list will not be capped at client side. E.g. If you have an internal mail server <mail server IP>:25 TCP port should be included in the exclusion list. This will allow the user to communicate with the mail server without any bandwidth restriction. Bandwidth restriction does not apply on the following IP address and port combinations online Logon Server - <24online Server IP address>:6060 over UDP 2. My Account HTTP site <24online Server IP address>:80 over TCP 3. My Account Secure HTTP site <24online Server IP address>:443 over TCP Administrator can add entries in the list from Administrator GUI as follows: Select System Management! Client Services! Exclusion list and click Add Host 8

9 Screen Elements Exclusion list Host type IP address Or NetworkID/Netmask Protocol Port Create button Cancel button Host for which the bandwidth will not be restricted Specify the host type i.e. Single IP address or Network Specify the IP address of the host Specify the Netowrk Id and mask Protocol for which the bandwidth will not be restricted Select the protocol Port for which the bandwidth will not be restricted Specify the port number Creates the policy Cancels the current operation 9