Can I limit bandwidth (download / upload)?

Short answer

Yes. The total traffic of the vService going to the clients is limited with Details → Bandwidth → Total limit; this field exists in HTTP and L7 TCP vServices and covers only the download direction. If separate limits for download and upload, or per-user or condition-based limiting, are needed, the Bandwidth Limitation action is used on the HTTP vService. Limiting by country or network type is done in the Country Control card of L7 DDoS Protection, and limiting by bot policy is done in AGS Bot Protection Policies. When the limit is exceeded, the traffic is not blocked; it is slowed down.

Problem: A Service or User Consumes All of the Bandwidth

When large file downloads, backup traffic or the heavy usage of a single user fill the entire line, the other services and users slow down. The traffic is wanted to be limited on a vService, user or request type basis.

Solution: Five Methods

Your situation	Suitable method
The total download traffic of the vService	Method 1: Details → Bandwidth → Total limit
Download and upload, per user or condition-based	Method 2: Bandwidth limitation action
By country or network type (L7 DDoS protection)	Method 3: L7 DDoS Protection → Bandwidth limit
By bot policy on an AGS-enabled vService	Method 4: AGS Bot Protection Policies → Bandwidth Limit
From the command line	Method 5: WEB-CLI

Method 1: Details → Bandwidth → Total Limit Recommended

• How it works All the clients of the vService share a single download limit.
• Where it is openedLoad Balancer → Load Balancer vService List → vService → Edit → Details → Bandwidth
• Requirement None
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

2

Adım 2 Check Bandwidth

In the Details panel, the Bandwidth box is checked.

3

Adım 3 Enter the limit

A value is written in the Total Limit field and the unit (Kbps, Mbps, Gbps) is selected; the range is 1 Kbps – 32 Gbps.

4

Adım 4 Save

Save is clicked. The change is applied without dropping open connections. In a cluster, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.

Verification

1SpeedClient side

The download speed is measured with curl -o /dev/null -w '%{speed_download}\n' https://www.example.com/buyuk-dosya (the result is in bytes/second).

ExpectedSpeed around the limit

2SettingTR7 side

The limit is seen in the Resources section of the Load Balancer Management tab of the vService; the Frontend Bandwidth chart on the dashboard flattens at the limit.

ExpectedThe defined Total limit

Method 2: Bandwidth Limitation Action

• How it works Separate limits are applied for download and upload; in the Dynamic type, requests with the same key (e.g. the client IP) share the limit, and in the Stream type, each stream gets a separate limit.
• Where it is openedLoad Balancer → Actions → Add → Bandwidth Limitation
• Requirement If TR7 is behind a CDN or proxy, the real IP must be resolved before the client IP is made the key
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the action form

Load Balancer → Actions → Add is clicked (how to add); the Action Name is entered, and Action Type = Bandwidth Limitation is selected.

2

Adım 2 Enter the limits

Download Limit and/or Upload Limit is entered; at least one of them is required.

3

Adım 3 Select the limit type

Limit Type = Dynamic (default) or Stream is selected. In Dynamic, the grouping Smart Variable (e.g. the client IP) is selected with fx in the Key field.

4

Adım 4 Add a condition if necessary

If only certain paths will be limited, a condition is selected in the Conditions field; if the condition is empty, the action is applied to all the traffic of the vService.

5

Adım 5 Save the action

Add is clicked.

6

Adım 6 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

7

Adım 7 Add the action to the Actions field

The action is selected in the Details → Actions field.

8

Adım 8 Save

Save is clicked. The change is applied without dropping open connections; in a cluster, it is also sent to the peer device with the default auto-sync.

Verification

1SpeedClient side

The download speed is measured with curl -o /dev/null -w '%{speed_download}\n' https://www.example.com/buyuk-dosya.

ExpectedSpeed around the Download limit

Method 3: L7 DDoS Protection → Bandwidth limit

• How it works A bandwidth limit is applied to the traffic that matches the country or network type rules of the L7 DDoS protection.
• Where it is openedLeft Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management → L7 DDoS Protection
• Requirement L7 DDoS & Threat Protection must be on in the vService and DDoS protection must be Active
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Turn on Bot/DDoS protection (if needed)

If the protection is not on in the vService, the vService is edited, and the L7 DDoS & Threat Protection box under Details is checked and saved; for more than one vService, Enable is used in the protected vService list in the Bot/DDoS menu (two ways). When the protection is turned on, IP Reputation Protection starts in Active mode (starting modes).

2

Adım 2 Open the management screen

The Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management tab is opened (accessing the screen).

3

Adım 3 Set L7 DDoS Protection to Active

With the Edit link of the L7 DDoS Protection card, DDoS Protection = Active is selected; in the default Monitor, actions are only recorded and the traffic is not limited.

4

Adım 4 Open the rule window

The window is opened with the pencil icon of the Country Control block, and a rule row is added with Rules → + Add (Country Control Edit screen). For limiting by network type, the same operation is done in the Network Type Group Control block.

5

Adım 5 Select the match

Match and the countries are selected.

6

Adım 6 Enter the bandwidth limit

Action = Bandwidth limit is selected and Bandwidth limit (Mbit/s) is entered (default 10).

7

Adım 7 Save

The window is saved.

Verification

1EffectTR7 side

The DDoS bandwidth limiting chart on the Bot/DDoS dashboard is checked.

ExpectedThe limited traffic appears

Method 4: AGS Bot Protection Policies → Bandwidth Limit

• How it works On an AGS-enabled vService, the bot policy applies a download and upload limit to the matching clients.
• Where it is openedAGS → Protection Policies → Bot Protection Policies
• Requirement AGS-enabled vService
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Enable AGS (if needed)

If AGS is not on in the vService, it is turned on with Enable in the enabled vService list in the AGS menu or from the Details list of the vService form (two ways). When AGS is turned on, users do not reach the Backend Service until the default login flow is edited.

2

Adım 2 Open the policy form

AGS → Protection Policies → Bot Protection Policies → Add is clicked (how to add); the Bot Protection Policy Name is entered and the Trigger Type is selected.

3

Adım 3 Define the bandwidth limit

Action = Bandwidth Limit is selected; Download Limit (kbps) and Upload limit (kbps) are entered.

4

Adım 4 Save the policy

Add is clicked.

5

Adım 5 Open the Protection window

In the AGS Management tab of the vService, the Edit link of the Protection section is clicked; the Edit / Protection window opens.

6

Adım 6 Select the policy

The policy is selected in the Bot Protection Policies field.

7

Adım 7 Save

The window is saved.

Verification

1SpeedClient side

The download speed is measured with curl -o /dev/null -w '%{speed_download}\n' https://www.example.com/buyuk-dosya from a client for which the policy is triggered.

ExpectedSpeed around the Download limit

Method 5: WEB-CLI

• How it works The total download limit of the vService (Method 1) is turned on from the command line.
• Where it is opened TR7 WEB-CLI → lb service update
• Requirement WEB-CLI access; the value is an integer in Kbps (1 Mbps = 1024 Kbps, at most 33554432)
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Write the limit

For 100 Mbps (protection and processing switches):

lb service update id <vService> --bw true --downloadBwPool 102400

Verification

1SpeedClient side

The download speed is measured with curl -o /dev/null -w '%{speed_download}\n' https://www.example.com/buyuk-dosya.

ExpectedSpeed around the limit

Common Mistakes

• Expecting a speed-up from Bandwidth. These features limit the traffic; for acceleration, caching and compression are used.
• Thinking that Total limit also limits the upload. Details → Bandwidth covers only the direction going to the client; for upload, the Upload limit field of the Bandwidth limitation action is used.
• Selecting the client IP as the Key behind a proxy. If TR7 is behind a CDN or proxy, all users share the same IP; first, the real client IP is resolved (There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?).
• Mistaking the notification threshold for a limit. The bandwidth value in the Notification profile is a warning threshold; it does not limit the traffic.
• Adding the action without a condition. If the condition is empty, the limit is applied to all the traffic of the vService.

How it is done in the documentation

• HTTP (L7) vService · Bandwidth
• Bandwidth Limitation · What Is the Bandwidth Limitation Action?
• Bandwidth Limitation · Scenario 1: Limiting the File Download Speed per User

Related questions

• Which features does TR7 offer to speed up my application?
• The site is slow; how do I tell whether the problem is in TR7 or in the backend?
• What is QoS; how do I reserve dedicated CPU/memory resources for critical vServices?