The bandwidth resources of the enterprise network are limited, and if not controlled, a few users may have large traffic downloads, video viewing, file transfer that can take up a lot of bandwidth and affect other users’ normal operations."Who can access the network?"The network access certification system is also able to perform a fine-tuning control and quota management of user bandwidth and network resources based on user identification, end type, access location, etc.
Why bandwidth control and quota management?
The bandwidth resources of the enterprise network are limited, especially Internet export bandwidth, which is often an important component of the cost of the enterprise network. Without bandwidth control, problems may arise as a result of: a small number of users occupying large bandwidths, such as individual staff viewing online videos for long periods of time, downloading large files and using P2P download tools, which slows down access to networks by other users and affects normal office operations; and a lack of security of bandwidth for critical operations, such as videoconferencing, cloud desktops, ERP systems, which are sensitive to network quality and may cause karton to be delayed and affect productivity through the use of bandwidth; Third, network costs are wasted, some users ' non-operational flows consume large bandwidths, and enterprises have to expand export bandwidth and increase network operating costs; fourth, security risks. The unusual transfer of large traffic may be a sign of data leakage or malicious software communications that need to be detected and controlled in a timely manner. Bandwidth control and quota management aims at guaranteeing the quality of key operations under limited bandwidth resources, limiting the misuse of non-business flows, increasing overall network use efficiency and reducing network operating costs."Staff restrictions"But..."Rational allocation of resources"Let the limited bandwidth be used against the blade.
Differently-based bandwidth control
The network access certification system has bandwidth control capabilities that are based at core on differentiated user identity controls. After the user certification, the system allocates different bandwidth ceilings and priorities to users based on their identification information such as department, role, position. For example: senior managers and staff in core operations receive higher bandwidth caps and priority levels (e.g. 100 Mbps, high priority), ordinary staff have standard bandwidth (e.g. 20 Mbps, medium priority) and visitors and temporary users have lower bandwidth (e.g. 5 Mbps, low priority). This ensures the quality of networks for key personnel and critical business while avoiding over-banding by both ordinary users and visitors. Identity-based bandwidth controls are usually given to switches or wireless controllers through RADIUS bandwidth properties (e.g. Filter-Id, Bandwidth-Limit etc.), and bandwidth restrictions are implemented by network devices. Some systems also support application-based bandwidth control: recognition of applications (e.g. video, download, web page, mail, etc.) through in-depth package testing, assigning different bandwidth scales to different applications, such as limiting bandwidth for videos and P2P downloads, safeguarding web pages and mail bandwidth. It is important to note that bandwidth control strategies should be configured in a manner appropriate to the realities of an enterprise: they are too high for control, too low for user experience and require comprehensive assessments based on export bandwidth, number of users, business needs etc.
Flow quota and usage management
In addition to bandwidth control, the network access certification system supports traffic quota management: a monthly/week/day flow quota is set for each user or user group, within which users can use the network normally and take measures in excess of the quota (scaling, disconnection, extra charges, etc.). The traffic quota management is appropriate for scenarios requiring strict control over the use of network resources, such as visitor networks, public WiFi, traffic-based networks, etc... The system allows real-time measurement of traffic usage (upstream, downstream, total traffic) per user and alerts users through Portal pages, text messages, mail, etc. when the user flows are close to the quota; When users exceed their quota, it is handled according to a predefined strategy: speed (reduce bandwidth to a lower level, guarantee basic page views and mail reception and distribution), break-up (banning Internet access, only access to internal resources), extra charges (in excess of the quota, chargeable for usage, suitable for an operational network). The advantage of traffic quota management is that it can effectively control overall network flows and avoid excessive resource consumption by a few users; the disadvantage is that it may affect normal user use, requiring rational establishment of quota thresholds and overdose strategies. For the enterprise office network, strict traffic quotas (which may affect normal work of staff) are not usually recommended, but rather bandwidth control + application recognition to limit non-business flows while safeguarding operations. For visitors’ networks and public WiFi, flow quota management is an effective resource control tool.
Dynamic strategy based on time and location
The bandwidth control and quota management of the web access certification system also supports dynamic strategies based on time and location. Time-based strategies: different bandwidth control strategies are in place at different time frames, such as severe restrictions on video and P2P downloads during working hours (9:00-18:00), office operations; off-working hours (18:00 - 9 a.m.) and weekends ease restrictions to allow staff to use more bandwidth. Location-based strategy: different bandwidth control strategies are set in different access locations, such as standard bandwidth for staff in the office area, higher bandwidth for conference rooms and training rooms (safed videoconferences and training), lower bandwidth for visitor areas, high priority and high bandwidth for production areas and airframes (secured production operations)."One cut."The system also supports end-type strategies: PC and notebooks are given standard bandwidth, mobile phones and panels are given lower bandwidth (mobile equipment usually requires less traffic), and the network equipment is given minimum bandwidth and limited access (material networking equipment usually only needs a small amount of flow to the server). Dynamic strategy configuration requires a full understanding of business needs and network usage habits at the enterprise level. It is recommended that a period of network traffic analysis be undertaken to understand the use of traffic over different time periods, regions and users, and then that reasonable bandwidth control strategies based on the results be developed.
Bandwidth security for critical operations
Another important aspect of bandwidth control is bandwidth security for key operations. Key business (e.g. videoconferencing, cloud desktops, ERP, CRM, voice calls, etc.) has high demands on network bandwidth, delay, and drop-out rates, which could lead to operations Katon, delayed or even interrupted, with serious operational efficiency implications if the bandwidth is taken over by other traffic. Network access certification systems can be linked to the network equipment QoS (quality of service) functionality, providing bandwidth security for key operations: first, priority-level markers, system identification of traffic in critical operations (e.g. videoconferencing, voice calls), high priority for marking them (e.g. DSCP EF or AF41) and network equipment priority transmission of these flows according to priority; second, bandwidth provision, setting aside a percentage of export bandwidth for critical operations (e.g. 30 per cent bandwidth to videoconference and voice operations), and even if other traffic is large, the bandwidth of critical operations will be secured; Third is application recognition, which detects traffic from key operations through the DPI depth package, prioritizes their movement and bandwidth security, limiting non-critical operations (e.g. video, download). The bandwidth assurance for critical operations requires a network access system to match Qos functions of network equipment such as switches, routers, firewalls, which are responsible for identifying users and operations, issuing Qos strategies, and implementing QoS movements. It should be noted that the QoS strategy is more complex and requires in-depth knowledge of the QoS functionality of the network equipment, with recommendations for configuration and fine-tuning by professional network engineers. At the same time, QoS can only guarantee priority for key operations in cases where bandwidth is insufficient and if export bandwidth is severely inadequate, even if there is QoS will not be a complete solution to the problem and if necessary it needs to be expanded.
Surveillance and analysis of bandwidth use
The effectiveness of bandwidth control and quota management needs to be assessed and optimized through continuous monitoring and analysis. Network access certification systems usually provide surveillance and analytical functions for bandwidth use: one is real-time monitoring, showing in real time the rankings of each user, each department, each region on bandwidth usage and traffic; the other is historical statistics, recording and measuring trends in the use and flow of the history bandwidth per user, each department, and each region, supporting day, week, month, year-to-day query and comparison; Third, application analysis, through DPI, identifies the traffic ratios of different applications and identifies which of the enterprise networks occupy the largest bandwidth (e.g. video, download, web page, social software) to inform the development of bandwidth control strategies; fourth, unusual detection, automatic detection of anomalous user or terminal using bandwidth (e.g. a user suddenly produces large traffic and a terminal transmits data in an irregular time period), prompt warning, possibly as evidence of data disclosure or malicious software communications; fifth, report generation, regular production of bandwidth usage statements and flow analyses, support for export and sharing, and data support for network planning and decision-making. By analysing the trends in bandwidth use, enterprises can understand the growth of bandwidth demand and plan rationally for export bandwidth expansion; by analysing the application flow ratio, they can understand how workers use their networks and develop more targeted broadband control strategies.
Bandwidth control and quota management are important functions of the web access certification system, which enables enterprises to implement differentiated bandwidth controls and traffic quota management with limited bandwidth resources, based on user identity, end type, access location, time, etc., guaranteeing network quality in key operations, limiting non-business flow abuse, increasing overall network efficiency and reducing network operating costs. Through identity-based differential bandwidth control, traffic quota and usage management, time- and location-based dynamic strategies, bandwidth security for critical operations, bandwidth use monitoring and analysis, and enabling companies to achieve precision management and rational distribution of network bandwidth. For enterprises, the selection of a network access certification system with strong bandwidth control capacity, flexible strategies and well-controlled monitoring and analysis is an important means of improving network efficiency, safeguarding quality and reducing operating costs.