Post-NAT Bandwidth management

[colebert]

Wanted to get some quick advice about doing bandwidth management after NAT has been performed.

We use a Sonicwall in my organization for IPS, SPA, WAN failover, firewall, and content filtering. It otherwise sucks but I can’t get rid of it.

I have an RB1100 sitting in front of the Sonicwall. I would like to but an RB750 on the wire inbetween the Sonicwall & our T1 modem to do some bandwidth management on traffic coming out of the Sonicwall. Problem is that the Sonicwall is doing NAT so the RB750 has no idea about the private IP creating the traffic. I do most of my traffic management by internal IP address.

Is there some way I can configure the RB1100 to mark the traffic such that the mark will survive the Sonicwall NAT and be intelligible to the RB750 so it can traffic shape?

I don’t need to be hand-held, just pointed in the right direction. Is QoS/DSCP tagging the best way?

[MCT]

The DSCP values would be a reasonable choice. You can use mangle on the 1100 to change it to certain values to tag the traffic and then mark the connection and packets in the 750 based on those tags so you can shape the traffic and set the DSCP back to it’s proper value.

[colebert]

@MCT

The DSCP values would be a reasonable choice. You can use mangle on the 1100 to change it to certain values to tag the traffic and then mark the connection and packets in the 750 based on those tags so you can shape the traffic and set the DSCP back to it’s proper value.

Awesome. I’ll try that this weekend.

Appreciate it!