Wireless Access

Today (9/17/14) brings iOS 8 which many of us saw cripple our networks during the rollout of iOS 7.

 

Since that time, there are new features that can help you handle this traffic.

 

With AOS 6.4+ and any 7 series controller with DPI enabled (under global firewall settings), you can block or throttle iOS update traffic at the global level or by user-role.

 

Here are some examples:

 

BLOCK - USER-ROLE

 

Create a new ACL (like below) and apply it to a user-role(s). Also, make sure DPI is enabled for the user-role.

 

 

 

 

 

BLOCK - GLOBALLY

 

Under Security > Firewall Policies, find the "global-sacl" ACL.

 

 

 

 

THROTTLE - USER-ROLE

(Make sure you have a bandwidth contract defined - Advanced Services > Stateful Firewall > Bandwidth Contracts. You can also create one from the drop down.)

 

 

 

 

THROTTLE - GLOBALLY

 

This must be done at the CLI level

 

(config) # dpi global-bandwidth-contract app ios-ota-update downstream mbits 1
(config) # dpi global-bandwidth-contract app ios-ota-update upstream mbits 1
(config) # dpi global-bandwidth-contract app apple-update downstream mbits 1
(config) # dpi global-bandwidth-contract app apple-update upstream mbits 1

 

Is there any chance we have similar capabilities or options is 6.3 without a 7 series controller?

No there is not. The legacy hardware does not support deep packet inspection.

Normally you could go in and block certain DNS names and IP ranges but there are so many CDNs in use that this is not feasible.

What if we prioritized instead of throttled this traffic? Get it off the network as soon as possible.

I don't think many organizations have the internet pipe to be able to make non-business traffic a priority.

Gotcha. Solving the WAN bottleneck.

Right. Some organizations don't have any device near the internet border that can throttle or block with this granularity.

 

Also, I've always had the mindset of blocking the traffic closest to the source. Why let it go all the way through your core network just to be blocked or choked at the internet edge?