A branch link may be quiet most of the day, but it only takes one person sending a large file to the central server, Windows updates starting on several computers at once, or the branch backup kicking off early. At that moment, calls start breaking up and the finance software slows down. Upgrading the link costs money and only postpones the problem. The lasting solution is traffic prioritization, or QoS.
What QoS does and doesn’t do
QoS does not create extra bandwidth. It only decides, when the link is full, which packet goes first and which waits or gets dropped. So while the link is quiet, QoS has no effect; it proves its value exactly at the moment of congestion.
Another key point is that your internet provider usually ignores your traffic markings. You only control the queues on your own equipment, meaning the traffic leaving your firewall or router.
Step 1: Bring the queue onto your own device
If the branch firewall sends traffic to the modem at full port speed, for example 1 Gbps, the real queue forms on the modem or the provider’s equipment and your QoS has no effect. The solution is Shaping: set the outbound rate on the firewall slightly below the link’s actual, stable speed. The queue then forms on your own device, and the priority rules take effect. Measure the actual speed several times at different hours, rather than relying on the contracted figure.
Step 2: Keep traffic classes simple
For most branches, three or four classes are enough:
- Voice: VoIP calls get the highest priority, but with a defined cap so they never completely block other traffic.
- Interactive business applications: Remote Desktop, finance software and the sales system; low volume but sensitive to latency.
- Normal traffic: Web browsing, email and everything else.
- Bulk traffic: Backups, updates, file sync and large downloads; the lowest priority, but with a guaranteed minimum share so it never stops entirely.
Identify traffic by server address, port or DSCP marking. For example, all traffic to the phone system goes into the voice class and backup server traffic goes into the bulk class.
Step 3: Cover both ends of the link
Branch traffic flows in two directions. On the branch firewall, you manage outbound traffic toward headquarters. But traffic coming from headquarters to the branch, such as files being opened or the other party’s voice on a call, must be prioritized on the headquarters firewall, on its outbound path to that branch and matched to the branch’s download speed. Controlling inbound traffic at the branch itself is more limited and less effective.
QoS and VPN tunnels
Traffic inside the tunnel is encrypted, and after encryption the original ports and addresses are no longer visible. Classification must therefore happen before traffic enters the tunnel. Many devices copy the original packet’s DSCP marking to the tunnel’s outer header, but this behavior depends on the device and its configuration and should be verified.
Instead of constantly fighting bulk traffic, manage its timing too: move backups and file replication to after hours and set bandwidth caps for updates.
Common mistakes
- Setting Shaping above the link’s actual speed, which effectively disables QoS.
- Defining many complex classes that are hard to maintain.
- Putting too much traffic in the highest priority class; when everything is important, nothing is.
- Configuring QoS on only one end of the link.
Checklist
- The actual link speed of each branch has been measured at different hours.
- Shaping is set slightly below the actual speed.
- Three or four traffic classes with defined priorities and shares are in place.
- Voice has priority, but also a cap.
- QoS is applied on both ends of each branch link.
- Backups and updates are scheduled and rate-limited.
ITPlus724 engineers can analyze the traffic on your branch links and implement the right QoS policy on your headquarters and branch firewalls.