QOS (BWM) for MS Teams

Options
jw708
jw708 Posts: 16  Freshman Member
First Anniversary 10 Comments Friend Collector
edited January 2023 in Security
Hello, are there any guides for setting up QOS for MS Teams on ZyXel firewalls? In particular I'm interested in the USG 210. 

I can see some guidance for QOS/BWM but was wondering if anything specific had already been written up for Teams.

Accepted Solution

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,083  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Answer ✓
    Options
    Hi @jw708

    jw708 said:
    Thanks, the licences are expired and looks like the signatures for apps were never updated (last updated 2013). Searching for Teams only brings up TeamSpeak (Authority). Could I use the Skype options or am I better off just setting up BWM using port ranges?

    Maybe you could use the BWM rule to apply Teams-related services to meet your requirement.

    To define a Teams service group that includes HTTP, HTTPS, and UDP ports 3478 to 3481.
     

    To add a BWM rule and its service type chosen to the Teams service group.


    The BWM rule is done.

    Make sure the services could be passed by the security policy.


    jw708 said:
    Another question came up when looking at BWM. Is it necessary to set a guaranteed bandwidth or can we just set priority? 

    If you want to restrict the bandwidth, you could set a guaranteed bandwidth of Inbound and Outbound bandwidth,  I set them to 10000 kbps with high priority 1, as in the below screenshot:


    If you want to prioritize the bandwidth to the maximum and the most top, you could enable "Maximum Bandwidth Usage" with high priority 1, as in the below screenshot:


    The help page seems to suggest if guaranteed bandwidth is set to 0 the rule is ignored.
    If the Inbound bandwidth is set to 0 means it will be treated as the lowest priority 7.



    The more information about BWM, please refer to the USG210 user guide from P.701 to P.715.

All Replies

  • PeterUK
    PeterUK Posts: 2,811  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    I don't use teams but did a quick test and found it uses UDP 3478 not sure if thats for video with chat.

    You need to setup limits on the interfaces (not in BWM) as to your max bandwidth for sending receiving for WAN egress should be -1Mb less then your upload speed and LAN -10Mb download for BWM to work in that range.

    https://www.aqua-calc.com/rate/bandwidth-calculator

    Suggest you run the web console

    configure terminal

    bwm control-tcp-ack

    write


    You can then add a rule for BWM

    incoming LAN

    outgoing WAN

    service object add UDP port 3478


    inbound set for you to receive traffic depending on number in meet x 5120Kb depending on quality of videos

    priority 7

    maximize usage checked

    outbound set for you to send traffic likely 5120Kb depending on quality of video

    priority 7

    maximize usage checked


  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,083  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Options
    Hello @jw708

    You could refer to the below steps to set up it.
    STEP1. To add an application object of Teams.


    STEP2. To add BWM rule for Teams.

    BWM rule:


    STEP3. Make sure the Teams service could be passed by the security policy.


    Thanks.
  • jw708
    jw708 Posts: 16  Freshman Member
    First Anniversary 10 Comments Friend Collector
    Options
    Thanks, I'm not seeing Teams in the options, does this require an IDP licence?
  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,083  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Options
    Hi @jw708

    May I know if your App Patrol and IDP licenses were expired? If none, you could add an application object as below steps:

    STEP1. Add an application object.



    STEP2. Search "teams" by Service category and check options.


    STEP3. Click OK to create an application.


    Thanks.
  • jw708
    jw708 Posts: 16  Freshman Member
    First Anniversary 10 Comments Friend Collector
    Options
    Thanks, the licences are expired and looks like the signatures for apps were never updated (last updated 2013). Searching for Teams only brings up TeamSpeak (Authority). Could I use the Skype options or am I better off just setting up BWM using port ranges?
  • jw708
    jw708 Posts: 16  Freshman Member
    First Anniversary 10 Comments Friend Collector
    Options
    Another question came up when looking at BWM. Is it necessary to set a guaranteed bandwidth or can we just set priority? The help page seems to suggest if guaranteed bandwidth is set to 0 the rule is ignored.
  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,083  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Answer ✓
    Options
    Hi @jw708

    jw708 said:
    Thanks, the licences are expired and looks like the signatures for apps were never updated (last updated 2013). Searching for Teams only brings up TeamSpeak (Authority). Could I use the Skype options or am I better off just setting up BWM using port ranges?

    Maybe you could use the BWM rule to apply Teams-related services to meet your requirement.

    To define a Teams service group that includes HTTP, HTTPS, and UDP ports 3478 to 3481.
     

    To add a BWM rule and its service type chosen to the Teams service group.


    The BWM rule is done.

    Make sure the services could be passed by the security policy.


    jw708 said:
    Another question came up when looking at BWM. Is it necessary to set a guaranteed bandwidth or can we just set priority? 

    If you want to restrict the bandwidth, you could set a guaranteed bandwidth of Inbound and Outbound bandwidth,  I set them to 10000 kbps with high priority 1, as in the below screenshot:


    If you want to prioritize the bandwidth to the maximum and the most top, you could enable "Maximum Bandwidth Usage" with high priority 1, as in the below screenshot:


    The help page seems to suggest if guaranteed bandwidth is set to 0 the rule is ignored.
    If the Inbound bandwidth is set to 0 means it will be treated as the lowest priority 7.



    The more information about BWM, please refer to the USG210 user guide from P.701 to P.715.
  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,083  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Options
    Hi @jw708

    Here is a FAQ article( How to Configure Bandwidth Management for FTP and HTTP Traffic?) that could give you some hints as well.  Thanks.

  • jw708
    jw708 Posts: 16  Freshman Member
    First Anniversary 10 Comments Friend Collector
    Options
    Thanks very much for your help, Jeff.
  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,083  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Options
    Hi @jw708

    You are welcome :3 .

Security Highlight