Flex700 V5.40(ABWD.0) unable to get BWM working.

peter2cfts
peter2cfts Posts: 7  Freshman Member
First Comment Friend Collector
in Security

I'm sure I'm missing something, I have read the various sections but nothing I do seems

to have an impact one way or another, I'm trying to limit bandwidth in 5,10,20 and 40mbps chunks, below a snapshot of my BWM config.

USG700-BWM.png

IP's used are Public IP's no SNAT, below the text of the relevant part of the config for ease.

Be good to know what I've missed, if you need more information let me know.

«1

All Replies

  • PeterUK
    PeterUK Posts: 4,023  Guru Member
    250 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited September 8

    It is recommend to limit with correct incoming interface and outgoing interface then any like incoming LAN/DMZ to outgoing WAN

    It would help to know the IP's or do you mean your LAN IP's are not rfc1918?

    Test without source/destination.

    Is maximum box set? not just inbound out outbound

    I also recommend enabling this option by SSH
    configure terminal
    bwm control-tcp-ack
    write

  • Zyxel_Tina
    Zyxel_Tina Posts: 203  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 50 Answers First Comment

    Hi @peter2cfts,

    Regarding your problem, please make sure to uncheck Maximize Bandwidth Usage.

    image.png

    In addition, if the initiating side of the download session is VM_download or VPS_Malicard, then it is correct to configure the source as VM_download or VPS_Malicard, just like in the 2nd, 4th, and 6th rules shown in your screenshot.

    If you have already verified these settings and the issue still persists, could you please provide more details about your application scenario, along with a scenario diagram or related information? This will help us better assist you.

    Zyxel Tina

  • peter2cfts
    peter2cfts Posts: 7  Freshman Member
    First Comment Friend Collector
    https://community.zyxel.com/en/discussion/comment/79974#Comment_79974

    These are unchecked for all but one.

    USG700-BWM-Detail.png

    [Public IP]>Flex700(Not NATed)>ISP Switch(vlan)>ESXi-HOST>ESXI Switch>VM [Public IP]

    Does this help.

  • peter2cfts
    peter2cfts Posts: 7  Freshman Member
    First Comment Friend Collector
    edited September 8
    Flex700_startup-config_tidyup and security_07-09-25.png

    Here's a physical look at the switch eth ports.

    image.png

    BCP and LIQ are Zoned

  • PeterUK
    PeterUK Posts: 4,023  Guru Member
    250 Answers 2500 Comments Friend Collector Seventh Anniversary

    For rate limiting you need to set maximum boxes the the  inbound out outbound boxes are guarantee settings

  • peter2cfts
    peter2cfts Posts: 7  Freshman Member
    First Comment Friend Collector
    edited September 8

    Current BWM settings

    image.png

    Still seems to make no impact changing the max bandwidth

    image.png

    So I guess we may need to got back to basics

    I have as a test link 100Mpbs which I believe = 100000 kilobytes per second (kbps) is that correct?

  • PeterUK
    PeterUK Posts: 4,023  Guru Member
    250 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited September 8

    How are you testing to see if its limiting?

     100000 kilobytes per second (kbps) is 97.66 Mb

  • peter2cfts
    peter2cfts Posts: 7  Freshman Member
    First Comment Friend Collector
    https://community.zyxel.com/en/discussion/comment/79986#Comment_79986

    just needed to make sure I was not being daft, I assume to mean Mbps.

  • PeterUK
    PeterUK Posts: 4,023  Guru Member
    250 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited September 9

    Yes Mbps you can use this site to convert a given bandwidth

    https://www.aqua-calc.com/rate/bandwidth-calculator

  • PeterUK
    PeterUK Posts: 4,023  Guru Member
    250 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited September 9

    You have to understand that when limiting like from LAN to WAN your Inbound is when you make the connection out from LAN to WAN it be your download but outbound is when you make the connection out from LAN to WAN it be upload. And then you got WAN to LAN when something comes from WAN to LAN where inbound is you uploading from a connection that from WAN to LAN and outbound is you receiving from a connection that from WAN to LAN.

    Are you try to limit from one LAN subnet to another LAN subnet?

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）