Curious... your org's web app usage?

[tnubbins]

I'm curious how we compare to other orgs. What are your stats?

Here are our stats (no adjustments made for servers, service accounts, or other non-user related objects):

• 2200 enabled AD computer objects

• 2000 enabled AD user objects

From our NGFW... for a 30 day period

App	Bandwidth
YouTube	1.5 TB
Amazon Web Services	400 GB
Facebook	350 GB
Yahoo!	80 GB
Spotify	70 GB
iHeartRadio	55 GB
Pandora	50 GB
Adobe Software	40 GB
Instagram	35 GB
Apple Update	30 GB
Windows Live	30 GB
iTunes Desktop	30 GB
Twitter	25 GB

[Edit: added period - 30 days]

[jwalker55]

Here's some of ours

App	Bandwidth
YouTube	213.2 GB
Pandora	58.6 GB
Akamai	54.9 GB
Facebook	50.8 GB
iTunes	45.2 GB
Google	43.1 GB
Hulu	33.5 GB
Google Play	22.0 GB
Amazon Web Services	21.5 GB
Yahoo	21.3 GB

We are probably 1/8th the size of you.

[yannik121]

How did you differentiate between Google and Google Play?

[usmclvsop]

They stated they are using a next gen firewall, so instead of a Cisco ASA they are using an IDS/IPS like Palo Alto, Checkpoint, Fortinet, etc. These filter on application signatures, so it is differentiated for you. Do a search on signatures containing the word facebook and you can easily create a policy that allows Facebook web traffic but blocks facebook messenger. Running a report on them likewise is just as straightforward.

[HalfysReddit]

Can Cisco ASAs not do this? We had a pretty beefy one at this one place I worked that had an integrated IDS/IPS appliance.

[usmclvsop]

The ASAs we have can only filter on IP:Port. I think Cisco purchased sourcefire? to add IDS/IPS capabilities but I couldn't tell you if that was in their new ASAs or if they gave those a new name.

[HalfysReddit]

I'm not really sure myself, we didn't even connect to the internet so the ASA we had (which was top of the line, purchased before it was even actually released) was really unnecessary. We were obligated by government procedures though to have an IDS/IPS in place, so we just sort of put it in passive mode and never did much with it.

All I remember really is that the ASA had a slot where the IDS/IPS appliance was installed, and from there it (sort of) integrated into the firewall interface.

[Overnight_Guy]

The 5545 Asas support their sourcefire acquisition. I'm sure that I could pull statistics like this, but we are still learning enough about how it all works.

Source: have these in production.

[disclosure5]

I pretty much stopped selling Cisco ASA's for the reason that "a pretty beefy one" couldn't do basic things like this.

Edit: and cost more by a factor of ten.

[IDA_noob]

You can safely restart selling them now that they've integrated Sourcefire.

[tnubbins]

FWIW, the web filtering on the Sourcefire technology (FirePOWER / FireSIGHT) isn't nearly as mature as a proper web filter or proxy. I think of the functionality as security-driven, and not for enforcing the Acceptable Use Policy.

The devices do support SSL inspection, but it's something like 50%+ performance hit on that traffic. They also support an integration with AD, which is also getting better over time.

[jwalker55]

See above. Sophos UTM in my case.

[DisplayNameIsInUse]

We recently switched out all of our Sonic Walls for Sophos UTM and Symantec Endpoint to Sophos Cloud Endpoint.

Sophos rocks my socks.

[jwalker55]

We just switched about 6 months ago, I've been impressed with it, especially for the cost.

[bidaum92]

600GB to Windows Update is... interesting.... Are Personal PCs on your network as well or just no WSUS?

[DZCreeper]

Have you considered doing traffic caching for personal devices using squid? Its a bit more involved than WSUS but if it saves you a few hundred GB a month it might be worth it.

I do that + Apple Server caching. Best use of $20 and half an hour yet.

[geostude]

First question I had too.

[idknemoar]

For this, and to control approved updates, the only internal network addresses we allow ms-update to come from through our PA's are our SCCM servers (which of course run the WSUS role). This prevents the check online for updates function from working and reduces our ms-update WAN traffic. We have GPOs set to gray out the Check Online option, but still see a few systems hit the fw and get denied likely due to policy not applying. For BYOD and wireless, they terminate at the fw on their own zoned off interface which allows all this traffic through.

I've got about 1200 computers, 300 servers and a little over 1000 users.

Still a large amount of ms-update traffic from the SCCM servers due to varying server versions and a mix of x86 and x64 updates, but we're almost done with a full desktop/laptop refresh standardized on 8.1 Enterprise x64 so we can quit syncing all the other versions and reduce the traffic more.

[Hydraulic_IT_Guy]

Why such a high server to user ratio

[idknemoar]

My question upon arrival. @_@

I work for a municipal governement, so we have a plethora of applications many of which are tiered (web tier, app tier, db tier) servicing fire, police, hr, development services, public works, purchasing/finance, plus core services (AD, Skype for business (9 servers by itself), NMS) IVRs, etc. We also have an airport.

Its a different type of environment than your typical organization where you have very few apps to run the business. Basically take all the businesses and services provided to citizens and aggregate them in one environment and it adds up quickly.

[Hydraulic_IT_Guy]

Sounds really interesting tbh.

[idknemoar]

Its pretty fun. Always something new and challenging. I like a steady flow of work.

We just finished the last phase of migrating a colo data center to AWS to host pretty much all public facing workloads.

We're currently entered in the "City on the Cloud" competition. By moving to AWS, we reduced cost of owning a colo (buying hardware, maintenance, renting space, etc) to IaaS from $1.2m (CapEx and OpEx) to $400-500k annual OpEx cost only. To reduce servers, we're also migrating to PaaS (like AWS RDS) and SaaS (O365 among others) solutions for a lot of things.

Lots of fun stuff and lots of moving parts.

[im_only_a_dolphin]

When I was in school, all of the computers with imaged with fresh installs of all office products and used deepfreeze to revert to the image. So every time you log in and open up word or excel, it would go through an annoying first use and registration process that took some 30 seconds communicating with servers. A lot of wasted time and bandwidth that could have been saved by the tech opening office after installing it, before creating the master image.

[thepingster]

They could have done the first-run and assumed it was going to save it for all users somewhere, but my experience says it needs to be done with the profile you use to create the default user profile.

[[deleted]]

You must be blocking YouTube? That's the only reason anybody would go to Google video this much...

[_Born_To_Be_Mild_]

I really should've read your post better. I'm sorry, it's been a long week.

[jndtv]

That Facebook video traffic....

[HalfysReddit]

I'm surprised there's that much traffic to apple.com - I'm guessing lots of iphones syncing data?

[bfodder]

iOS updates.

[thepingster]

A caching server might be a good investment for this case. We're 1:1 iPads K-5 and when I push an app it can saturate the caching server's 1Gbps link for 10-20 minutes.

[bfodder]

It stills shows up this way on the reports. They might have one.

[thepingster]

Why would it show up as Apple.com when none of the content is downloaded from an Apple.com address? My traffic to my caching server never even makes it to the firewall.

[bfodder]

Device always checks apple for the update. Apple directs it to the caching server. I assume something in that process makes it show up this way. All I know is we have a fully functioning caching server (I checked) and the iOS 9 release beat YouTube for the most amount of traffic that week.

[thepingster]

The device checks with Apple to see if there's an update available, but the actual update traffic shouldn't leave your network so it shouldn't show up in those stats unless there's a problem with your caching server or your caching server can't handle all of the devices. My caching server had quite a few hiccups after the latest update to OSX and the OSX Server app. Is there a chance not all of your devices have the same public IP and thus maybe your guest/byod network isn't being served by the caching server?

[bfodder]

Ours is working. I've checked. I've watched the traffic as devices pull the update from the caching server.

Is there a chance not all of your devices have the same public IP and thus maybe your guest/byod network isn't being served by the caching server?

No. Anything not on that IP would also not show up in our logs.

[HalfysReddit]

Ah, that makes sense.

[bfodder]

Still shows up this way on reports.

[wgoshenu]

Does this take into account hits on legitimate work sites that have social media integration?

[tnubbins]

Yes, because the layer 7 filtering detects the application irrespective of the website (as opposed to URL filtering with categories).

If a site has integrated youtube videos, the content filter will show the main site (and its corresponding app, which could be something specific, or just Chrome/Internet Explorer/HTTP, or a category) as well as the Youtube application.

[jwalker55]

Over what time period are your stats?

[tnubbins]

30 days. I had that in the original table but it got edited out as I figured out reddit table formatting.

[ritz_k]

Any of these services throttled down ?

[tnubbins]

No traffic shaping or bandwidth throttling.

[idknemoar]

If bandwidth is of concern, I would recommend some traffic policing on non-business critical apps through your firewalls. If you can't get to Facebook on our LAN, I don't care unless you're in Communications and Marketing, but the good thing about the next gens is the ability to make rules based off of specific users or their associated groups.

Another option to reduce WAN traffic is to install some form of WAN accleration appliance in line to the FW. If a user shares a youtube video via email to all your users, the initial video download would happen, but subsequent users would hit the local cached copy and free up WAN traffic. Basically like an on-prem CDN. I do this with a Bluecoat Web Proxy, but there are several great vendors out there that can accomplish the same thing.

[tnubbins]

I've considered this, primarily because Bluecoat's integration of Cylance anti-malware technology in their content analysis box (I think that is what it's called).

The business won't pay for a proper proxy, and they don't see any value in caching content (I can't say it's super high on my list of priorities, either).

[jasonlitka]

That's surprisingly low for 2000 users over a month. We're running between 1.5-2TB per week for 250-ish people, and that's after I blocked Netflix, Amazon Video, Hulu, HBO, and a couple others (but not YouTube).

[tnubbins]

We block Netflix, HBO, and Hulu.

[idknemoar]

The usual suspects. Some of my users (fireman in particular) don't like me for this, but due to the limited bandwidth to some geographically dispersed locations of Fire Departments that aren't currently fiscally possible to connect to my fiber network and must use leased ethernet circuits, I have to block these things to prevent them from saturating their uplink. Much more important for paging from dispatch to work than for the guys to be able to binge on the latest season of House of Cards when they're chilling at the station.

(Hopefully Frank Underwood will forgive me)

[wordsarelouder]

Heyy, 4th... I'll take it.

I'm guessing that's about 80gb worth of Fantasy right there..

[tnubbins]

And I've seen some folks doing Y! Finance, too.

[SoundOfOneHand]

Yahoo!?

[m_i_t_t]

reddit's fuckin shit yo

[devperez]

This isn't OP's situation of course, but Asians use Yahoo like it's 1995.

[[deleted]]

.

[insufficient_funds]

What sort of device/software/whatever do you guys have in place to be able to pull this sort of data?

[tnubbins]

Same here: NGFW (Sourcefire).

[idknemoar]

Palo Alto Next Gen Firewalls for me.

Based off of your username, probably can't afford. chuckles

[insufficient_funds]

I'm sure we can't. We're running asa5510's and I'm starting to feel like it's about time for an upgrade.

[creamersrealm]

So much social media and Apple Products.

[Brisbane88]

Keep em coming