5.4 Bandwidth Management & Traffic Shaping
Key Takeaways
- ZIA Bandwidth Management provides cloud-delivered traffic shaping across GRE, IPsec, and SD-WAN branch connections to prevent recreational media from saturating mission-critical SaaS links.
- Traffic is organized into Bandwidth Classes (e.g., Business Critical, Standard Business, Streaming Media, Large Downloads) mapped to specific URL categories and cloud applications.
- Traffic shaping policies define Guaranteed Bandwidth percentages (minimum reserved throughput during link congestion) and Maximum Bandwidth percentages (hard ceiling throttles).
- Dynamic bandwidth borrowing permits lower-priority classes to burst beyond their guarantee up to their maximum ceiling when higher-priority business classes are idle.
- Quality of Service (QoS) Differentiated Services Code Point (DSCP) preservation and re-marking ensure that Layer 3 IP precedence bits (e.g., EF for VoIP, AF41 for Video) are preserved across cloud tunnels.
5.4 Bandwidth Management & Traffic Shaping
Architectural Premise: In direct-to-cloud enterprise architectures, branch offices utilize local Direct Internet Access (DIA) breakouts rather than costly, backhauled MPLS circuits. However, unmanaged internet links can easily become congested when high-bandwidth consumer traffic (4K streaming video, social media, operating system updates) competes with latency-sensitive business applications (Microsoft Teams, Zoom, ERP, Salesforce). ZIA Bandwidth Management delivers cloud-native traffic shaping, guaranteed bandwidth reservations, maximum throttles, and DSCP QoS preservation directly at the Public Service Edge.
1. Cloud-Delivered Traffic Shaping Architecture
Traditional branch Quality of Service (QoS) relies on edge routers attempting to shape egress traffic. However, traditional routers struggle with two fundamental limitations:
- Asymmetric Inbound Saturation: Routers can only queue traffic they transmit (outbound); they cannot prevent an ISP or SaaS provider from flooding their inbound download pipe.
- Encrypted HTTPS Blindness: Routers cannot inspect encrypted TLS flows to distinguish between a critical Microsoft Teams video conference and a 4K YouTube stream without intensive on-premises compute.
+-----------------------------------------------------------------------------+
| ZIA CLOUD-DELIVERED BANDWIDTH SHAPING |
+-----------------------------------------------------------------------------+
Branch Office (100 Mbps Link) ZIA Public Service Edge (Cloud)
+--------------------------+ +-----------------------------------+
| [ Microsoft Teams (VoIP)]| <======== | [ Class 1: Guaranteed 40% (VoIP) ]|
| [ Salesforce / SAP ERP ] | <======== | [ Class 2: Guaranteed 30% (ERP) ]|
| [ YouTube 4K Video ] | <-Thrott- | [ Class 3: Max Cap 15% (Stream) ]|
+--------------------------+ +-----------------------------------+
| ^
+==== GRE / IPsec Site Tunnel (100 Mbps) ==+
How ZIA Shapes Inbound & Outbound Traffic
Because the ZIA Public Service Edge acts as the inline proxy terminating user sessions in the cloud, it controls the rate at which data is fetched from origin web servers and pushed down the GRE or IPsec tunnel to the branch office. By modulating TCP window sizes and rate-limiting egress buffers in the cloud, ZIA prevents link saturation before packets reach the physical branch circuit.
2. Bandwidth Classes & Traffic Classification
Bandwidth Management in ZIA is built around Bandwidth Classes. A Bandwidth Class is a logical container that groups URL categories, specific Cloud Applications, and file types into shared priority tiers.
+-----------------------------------------------------------------------------+
| STANDARD BANDWIDTH CLASS ARCHITECTURE |
+-----------------------------------------------------------------------------+
CLASS 1: BUSINESS CRITICAL (High Priority)
* VoIP & Video Conferencing: Microsoft Teams, Zoom, Cisco Webex
* Core ERP / CRM: Salesforce, SAP, Oracle, Workday, ServiceNow
CLASS 2: STANDARD BUSINESS (Normal Priority)
* General Web Browsing, Business Portals, Search Engines, Corporate Email
CLASS 3: RECREATIONAL & NON-BUSINESS (Low Priority / Throttled)
* Streaming Media (YouTube, Netflix, Spotify), Social Media, Online Gaming
CLASS 4: LARGE DOWNLOADS & SYSTEM UPDATES (Bulk Priority / Heavy Throttle)
* Windows Updates, macOS Updates, Executables, Large ISO Images, Archives
Defining Bandwidth Rules
Once Bandwidth Classes are configured, administrators create Bandwidth Control Rules linking classes to specific Locations, Sub-locations, and Time Schedules (e.g., applying aggressive throttling only during business hours 08:00 - 17:00).
3. Guaranteed vs. Maximum Bandwidth Allocation & Dynamic Borrowing
For each Bandwidth Class within a rule, administrators configure two distinct percentage-based thresholds:
+-----------------------------------------------------------------------------+
| BANDWIDTH ALLOCATION THRESHOLD METRICS |
+-----------------------------------------------------------------------------+
| |
| [1] GUARANTEED BANDWIDTH (%): |
| The minimum percentage of total link capacity permanently reserved |
| for this class during periods of network contention. |
| |
| [2] MAXIMUM BANDWIDTH (%): |
| The absolute upper ceiling percentage this class is allowed to consume |
| during periods of network contention. |
| |
+-----------------------------------------------------------------------------+
The Dynamic Bandwidth Borrowing Mechanism
ZIA does not waste bandwidth by creating rigid, static time-division slots. Instead, it utilizes an intelligent Dynamic Bandwidth Borrowing algorithm:
+-----------------------------------------------------------------------------+
| DYNAMIC BANDWIDTH BORROWING BEHAVIOR |
+-----------------------------------------------------------------------------+
SCENARIO A: LINK IDLE / LOW CONTENTION
+---------------------------------------------------------------------------+
| Class 1 (VoIP) is using only 5 Mbps. |
| Class 3 (Streaming) is permitted to BURST up to its configured MAXIMUM |
| Bandwidth limit (e.g., 40 Mbps), maximizing WAN utilization. |
+---------------------------------------------------------------------------+
|
v
SCENARIO B: LINK CONGESTED (VoIP / Business Traffic Spikes)
+---------------------------------------------------------------------------+
| Class 1 (VoIP) demand spikes to 40 Mbps. |
| ZIA instantly throttles Class 3 down toward its GUARANTEED minimum |
| (e.g., 5 Mbps), ensuring zero packet loss and minimal jitter for VoIP. |
+---------------------------------------------------------------------------+
| Operational State | High-Priority Traffic (Class 1) | Low-Priority Traffic (Class 3) | Shaping Behavior |
|---|---|---|---|
| No Congestion | Under guaranteed limit | Bursts above guarantee up to Maximum limit | Full link utilization; no artificial throttling. |
| High Congestion | Saturated; claims full guaranteed limit | Throttled down to guaranteed minimum | Business traffic protected; recreational traffic compressed. |
4. Location Bandwidth Sizing & Sub-Location Granularity
For percentage-based traffic shaping to operate accurately, ZIA must know the physical capacity of the underlying circuit. Administrators configure explicit link parameters within each Location Profile in the ZIA Admin Portal:
Location Configuration Parameters:
- Location Name: "Chicago-Branch-Office"
- Upstream Bandwidth: 20 Mbps (Upload Capacity)
- Downstream Bandwidth: 100 Mbps (Download Capacity)
- Bandwidth Control: [ Enabled ]
[!WARNING] Critical Sizing Requirement: If the configured bandwidth in the Location profile is set higher than the actual ISP circuit speed (e.g., configured as 100 Mbps, but the ISP delivers only 50 Mbps), ZIA will not detect congestion when the physical link saturates, causing packet drops at the ISP gateway. Always configure Location bandwidth to match the true, verified circuit throughput.
Sub-Location Traffic Shaping (Guest Wi-Fi Governance)
Enterprises frequently partition branch bandwidth to prevent unmanaged visitor devices from degrading corporate operations. By creating a Sub-location for the Guest Wi-Fi subnet (172.16.100.0/24), administrators can apply dedicated shaping rules:
- Corporate Subnets (
10.0.0.0/16): Bandwidth Control Rule prioritizing ERP and Collaboration (Guaranteed 80%). - Guest Wi-Fi Sub-location: Bandwidth Control Rule setting Guaranteed Bandwidth = 0% and Maximum Bandwidth = 10% (Hard throttle).
5. Quality of Service (QoS) & DSCP Preservation
Differentiated Services Code Point (DSCP) is a 6-bit field in the Layer 3 IP packet header (within the Type of Service / ToS byte) used by network routers and SD-WAN switches to prioritize packet queuing.
When traffic enters a GRE or IPsec tunnel to the ZIA cloud, ZIA supports DSCP Preservation and Re-marking:
+-----------------------------------------------------------------------------+
| DSCP TUNNEL PRESERVATION FLOW |
+-----------------------------------------------------------------------------+
Endpoint Packet: [ Inner IP Header: DSCP 46 (EF) ] [ Payload (VoIP) ]
|
v (GRE / IPsec Encapsulation)
Tunnel Packet: [ Outer IP Header: DSCP 46 (EF) ] [ Inner IP ] [ Payload ]
|
v (ZIA Public Service Edge Processing)
Egress Packet: Preserves or remarks DSCP based on Cloud App Control policy
Standard Enterprise DSCP Mappings
| Traffic Category | Standard DSCP Name | DSCP Decimal (Binary) | Enterprise Queueing Priority |
|---|---|---|---|
| VoIP Audio (Teams / Zoom) | EF (Expedited Forwarding) | 46 (101110) | Highest priority; strict priority queuing (LLQ) with zero delay. |
| Video Conferencing | AF41 (Assured Forwarding) | 34 (100010) | High priority; low latency queue with guaranteed throughput. |
| Mission-Critical ERP/CRM | AF21 (Assured Forwarding) | 18 (010010) | Medium priority; bounded latency queue. |
| General Web Browsing | DF / CS0 (Default Forwarding) | 0 (000000) | Standard best-effort delivery. |
| Recreational / Bulk | CS1 (Class Selector 1) | 8 (001000) | Lowest priority; background scavenger queue. |
6. Practical Configuration Walkthrough: 100 Mbps Branch Office
Scenario: A regional branch office operates over a 100 Mbps symmetric DIA connection. The network engineer must implement traffic shaping to guarantee voice/video quality during business hours while preventing streaming media from degrading operations.
Production Bandwidth Policy Matrix
| Order | Bandwidth Class | Mapped Applications / Categories | Guaranteed (%) | Maximum (%) | DSCP Marking |
|---|---|---|---|---|---|
| 1 | Real-Time Collaboration | Zoom, Microsoft Teams, Webex | 40% (40 Mbps) | 80% (80 Mbps) | EF (46) |
| 2 | Mission-Critical SaaS | Salesforce, Workday, SAP, ServiceNow | 30% (30 Mbps) | 70% (70 Mbps) | AF21 (18) |
| 3 | General Business Web | Business & Productivity, News, IT | 20% (20 Mbps) | 90% (90 Mbps) | DF (0) |
| 4 | Streaming & Social Media | YouTube, Netflix, Spotify, Social Media | 5% (5 Mbps) | 15% (15 Mbps) | CS1 (8) |
| 5 | Large System Updates | Operating System Updates, Executables | 5% (5 Mbps) | 10% (10 Mbps) | CS1 (8) |
Under ZIA Bandwidth Management, what occurs when high-priority business applications are idle and low-priority streaming traffic demands bandwidth?
What is strictly required in the ZIA Admin Portal for percentage-based Bandwidth Management rules to calculate accurate traffic shaping at a branch location?
What is the key functional distinction between Guaranteed Bandwidth and Maximum Bandwidth in a ZIA Bandwidth Control rule?
How does ZIA ensure end-to-end Quality of Service (QoS) interoperability with on-premises SD-WAN and core network routers across GRE or IPsec tunnels?