In this example, traffic shaping for the HTTP Proxy service must be configured to ensure that HTTP, HTTPS, and FTP traffic is prioritized below other traffic, such as VPN. To make source-based traffic shaping possible, the traffic shaping engine uses the shaping connector of the matching inbound rule and replicates this shaping connector to the outbound session of the HTTP Proxy service for the Barracuda CloudGen Firewall.
Traffic for the CEO must be given the higher prioritization than that for other people in the company. Two firewall rules are required in the inbound ruleset, as illustrated in the following figure. Note that the QoS band for Rule 24: Band ID100 CEO is configured with higher priority than the QoS band for Rule 25: Band ID105 Staff. Also the source addresses for Rule 24: Band ID100 CEO are limited from 10.0.10.90 to 10.0.10.99.
With this configuration:
- The outbound ruleset is still default. No changes are necessary. The configured QoS bands are taken from the inbound ruleset.
- In the firewall interface, LOUT-sessions are tagged with the correct shaping band.
- These sessions are fed into the assigned shaping tree. This can be verified on the Firewall > Shaping page.