How do I limit bandwidth on ipsec VPN in NGAF?

Hello All

How do I limit bandwidth on ipsec VPN in NGAF?

Thanks before

HiHi,

Pls find below the link for the NGAF Bandwidth Management Configuration Guide:

https://knowledgebase.sangfor.com/detailPage?articleData=%7B%22articleType%22%3A1,%22articleId%22%3A%22a6a32bdf1fba4215a66870ed48a57af4%22,%22keyword%22%3A%22%22%7D

To limit bandwidth on IPSec VPN in Sangfor NGAF, you can use the Bandwidth Management feature. This feature allows you to define bandwidth channels and apply them to specific interfaces, objects, and applications.

To limit bandwidth on IPSec VPN, follow these steps:

• Go to Policies > Bandwidth Management > Line Definition.
• Click Add to create a new line.
• Enter a name for the line and select the WAN interface that the IPSec VPN is using as the egress interface.
• Enter the actual bandwidth of the ISP in both inbound and outbound bandwidth.
• Click OK to save the line.
• Go to Line Policy.
• Click Add to create a new bandwidth channel.
• Enter a name for the channel and select the line created in the previous step as the target line.
• Select Limited Channel as the channel type.
• Enter the maximum bandwidth that you want to limit the IPSec VPN to in the Use and Max Bandwidth field.
• Click OK to save the bandwidth channel.
• Go to Applicable Objects.
• Select the IPSec VPN interface as the source object.
• Select the destination network as the destination object.
• Click OK to apply the bandwidth channel to the IPSec VPN.
  
  

Once you have completed these steps, the bandwidth of the IPSec VPN will be limited to the value that you specified in the Use and Max Bandwidth field.

Create the object of IPSec Peer IP address and Local IP address
then create the Bandwidth policy
Go to the Policies -> bandwidth management -> Lines then Create the line (selecting the interface on which IPsec is established)
then go bandwidth channel and create the policy by add button
you can limit the channel and also set the per user bandwidth.
the go to applicable object -> the select the object you created 1st
screenshot is attached for reference

thanks for all, have a nice day

To limit bandwidth on IPsec VPN connections in NGAF, access the firewall's web-based management interface and navigate to the VPN configuration section. Within the VPN configuration settings, locate the traffic policies or access control rules. Create a new policy or modify an existing one associated with your IPsec VPN connections. In the policy settings, look for options related to bandwidth or rate limiting. Specify the desired bandwidth limits for incoming and outgoing traffic for the IPsec VPN connections, typically in kilobits per second (Kbps) or megabits per second (Mbps). Some firewalls allow customization based on criteria like source and destination IP addresses or application types. Save the configuration changes and apply them, ensuring you follow the specific procedure for your NGAF device. Test the IPsec VPN connection using network monitoring tools to confirm that the configured bandwidth limits are enforced effectively.

Create a bandwith policy and assign it to IPSec tuneel

The Sangfor NGAF is a next-generation firewall that can be used to limit the bandwidth available to an IPsec VPN. This can be useful for a variety of reasons, such as preventing a particular user or group of users from using too much bandwidth, or to prevent the VPN from saturating the available bandwidth.

To limit the bandwidth available to an IPsec VPN on the Sangfor NGAF, you will need to create a bandwidth channel. A bandwidth channel is a group of objects that share the same bandwidth limit. To create a bandwidth channel, go to Policies > Bandwidth Management > Line Definition. In Lines, configure the WAN interface as egress interface and fill in the actual bandwidth of the ISP in both outbound and inbound bandwidth. After done settings, click “OK”.

Next, go to Line Policy and select the line that you created in the previous step. Click on “Add” to add a new bandwidth channel. A new window will pop up. Name the channel and select the line created in the previous step as target line. In the Channel type, you can configure guaranteed channel, limited channel. You can also configure per-user max bandwidth.

Once you have created the bandwidth channel, you need to apply it to the IPsec VPN. To do this, go to Policies > VPN > IPsec VPN. Select the IPsec VPN that you want to limit the bandwidth of and click on “Edit”. In the Bandwidth Management section, select the bandwidth channel that you created in the previous step. Click on “Save” to save your changes.

After you have applied the bandwidth channel to the IPsec VPN, the bandwidth available to the VPN will be limited to the amount that you specified. This will help to prevent the VPN from saturating the available bandwidth and will also help to ensure that all users have access to a fair amount of bandwidth.

Here are some additional tips for limiting bandwidth on an IPsec VPN:

    Consider using a QoS (quality of service) policy to prioritize traffic over the VPN. This will help to ensure that critical traffic, such as voice and video, is not impacted by the bandwidth limitation.
    Monitor the bandwidth usage of the VPN and adjust the bandwidth limit as needed. This will help to ensure that the VPN is not saturated and that all users have access to a fair amount of bandwidth.
    Consider using a different type of VPN, such as a SSL VPN, if bandwidth is a major concern. SSL VPNs typically use less bandwidth than IPsec VPNs.

Based on the current firmware version, you may limit the bandwidth on an IPsec VPN in NGAF by imp,ementing QoS policies to control the traffic traversing the VPN tunnel. Steps might vary depending on the version, but you may refer to the general guidelines below:

- Access the NGAF Interface through the web interface or command-line interface (CLI).
- Check which VPN traffic you want to limit. you may also specify the source and destination IP address, ports, or specific apps.
- specify QoS policy
- create classification policy that matches VPN traffic that you want to limit. You may also define access rules matching the specified source or destination IP addresses, ports, or application traffic. you can also create a traffic shaping policy specifying the bandwidth limits per second. Apply the traffic shaping policy to specific interface to where the VPN traffic passes through to ensure that the policy is enforced on the VPN traffic.
- save and apply the changes.
- testing and monitoring

Sangfor NGAF is a next-generation firewall that can be used to restrict the amount of bandwidth that is available to an IPsec VPN. There are a number of reasons why this might be beneficial, including preventing excessive bandwidth usage by a specific user or group of users or preventing the VPN from using up all of the available bandwidth.

You must establish a bandwidth channel in order to restrict the amount of bandwidth that an IPsec VPN on the Sangfor NGAF may use. A collection of items with the same bandwidth restriction is called a bandwidth channel. Go to Policies > Bandwidth Management > Line Definition to establish a bandwidth channel. Set the WAN interface in Lines to be the egress interface and enter the ISP's real bandwidth for both outgoing and incoming traffic.