Bandwidth Management

Overview

Bandwidth management controls how much network capacity each user or group consumes. IronWiFi uses RADIUS reply attributes to instruct access points and controllers to enforce bandwidth limits, ensuring fair access and preventing any single user from degrading the network for others.

This guide covers bandwidth limiting, per-user and per-group policies, data caps, and QoS enforcement through IronWiFi RADIUS attributes.

How Bandwidth Limiting Works

RADIUS-Based Bandwidth Control

The AP or controller is responsible for enforcing the limits. IronWiFi tells the AP what limits to apply, and the AP handles the actual traffic shaping.

note

Bandwidth enforcement happens on the access point or controller, not on IronWiFi's servers. The AP must support the RADIUS bandwidth attributes you configure. Most enterprise APs support WISPr bandwidth attributes.

Configuring Bandwidth Limits

Bandwidth Attributes

Attribute	Type	Value	Description
WISPr-Bandwidth-Max-Down	reply	bits per second	Maximum download speed
WISPr-Bandwidth-Max-Up	reply	bits per second	Maximum upload speed
Mikrotik-Rate-Limit	reply	string	MikroTik-specific rate limit format
Cisco-AVPair	reply	string	Cisco-specific QoS attributes

Common Bandwidth Values

Speed	Value (bps)	Value to Use
1 Mbps	1,000,000	1000000
2 Mbps	2,000,000	2000000
5 Mbps	5,000,000	5000000
10 Mbps	10,000,000	10000000
25 Mbps	25,000,000	25000000
50 Mbps	50,000,000	50000000
100 Mbps	100,000,000	100000000

Setting Per-User Bandwidth

Apply bandwidth limits to an individual user:

1. Navigate to Users in the IronWiFi Console
2. Select the user
3. Under Reply Attributes, add:

This limits the user to 10 Mbps download and 5 Mbps upload.

Setting Per-Group Bandwidth

Apply bandwidth limits to all users in a group:

1. Navigate to Users > Groups
2. Select or create a group
3. Under Reply Attributes, add the bandwidth attributes

All members of this group inherit these bandwidth limits.

See Groups for detailed group configuration.

tip

Use group-level bandwidth policies for consistent management. Only set per-user attributes when a specific user needs an exception to their group policy.

Bandwidth Tiers

Designing Bandwidth Tiers

Create multiple groups representing different bandwidth tiers:

Tier	Use Case	Download	Upload	Group Name
Basic	Guest WiFi	5 Mbps	2 Mbps	bandwidth-basic
Standard	Employees	25 Mbps	10 Mbps	bandwidth-standard
Premium	Executives, VoIP users	50 Mbps	25 Mbps	bandwidth-premium
Unlimited	IT administrators	No limit	No limit	bandwidth-unlimited

Configuring Each Tier

Basic Tier (Guest WiFi):

Standard Tier (Employees):

Premium Tier (Executives/VoIP):

Unlimited Tier (IT Admin):

(No bandwidth attributes = no RADIUS-enforced limit.)

Assigning Users to Tiers

1. Navigate to Users > select a user
2. Under Groups, add the user to the appropriate bandwidth tier group
3. The user inherits the group's bandwidth attributes on next authentication

Data Caps

Implementing Data Caps

Data caps limit the total amount of data a user can transfer during a session or billing period. Data caps require RADIUS accounting to track usage.

Session-Based Data Caps

Limit total data per session using check attributes:

Volume-Based Limits

Some AP vendors support volume-based disconnection:

note

Volume-based limits depend on AP vendor support. WISPr bandwidth attributes are the most universally supported method for bandwidth control. For data caps on vendors that do not support volume attributes, implement cap enforcement at the network/firewall layer.

Monitoring Data Usage

Track user data consumption via RADIUS accounting:

1. Ensure RADIUS accounting is enabled on your APs
2. Set the accounting interim interval:

Reply Attribute: Acct-Interim-Interval := 300

3. View usage in the IronWiFi Console:
   • Navigate to Logs > Accounting
   • Filter by username
   • Review

     Acct-Input-Octets

     (upload) and

     Acct-Output-Octets

     (download)

Vendor-Specific Configuration

MikroTik Rate Limiting

MikroTik supports a rich rate-limit syntax via the

Mikrotik-Rate-Limit

attribute:

Format:

Simplified example (10 Mbps down / 5 Mbps up):

Mikrotik-Rate-Limit := "5M/10M"

note

MikroTik uses

rx/tx

from the router's perspective, where

rx

is upload from the user and

tx

is download to the user. This is the reverse of the user's perspective.

Cisco/Meraki QoS

Cisco and Meraki APs support bandwidth limiting via:

Meraki also supports QoS marking:

UniFi Bandwidth

Ubiquiti UniFi supports WISPr bandwidth attributes:

UniFi also supports rate limiting at the controller level (per SSID or per user group), which can complement RADIUS-based limits.

Aruba/HPE

Aruba APs support WISPr attributes and Aruba-specific attributes:

Aruba User Roles can define complex QoS policies including bandwidth limits, firewall rules, and application-layer filtering.

QoS Enforcement Strategies

Prioritizing Traffic Types

While RADIUS bandwidth limits control total throughput, QoS prioritization ensures critical traffic (VoIP, video conferencing) gets priority over bulk transfers:

Traffic Type	Priority	Recommended DSCP	Bandwidth Allocation
Voice (VoIP)	Highest	EF (46)	Guaranteed 1 Mbps per user
Video conferencing	High	AF41 (34)	Guaranteed 5 Mbps per user
Business applications	Medium	AF21 (18)	Best effort with guarantee
Web browsing	Normal	CS0 (0)	Best effort
Bulk downloads	Low	CS1 (8)	Remaining capacity

tip

QoS traffic prioritization is configured on the AP controller or network switches, not through RADIUS attributes. Use RADIUS to assign users to QoS roles/policies defined on the controller. See your AP vendor's QoS documentation for configuration details.

Combining RADIUS Bandwidth with Controller QoS

For the most effective bandwidth management:

1. RADIUS attributes set per-user maximum bandwidth
2. Controller QoS policies prioritize traffic types within that limit
3. VLAN-based policies segment networks with different overall bandwidth allocations

Example architecture:

Captive Portal Bandwidth for Guest WiFi

Bandwidth Tiers with Paid Access

For venues offering tiered WiFi access:

1. Free tier: Basic bandwidth with captive portal
2. Premium tier: Higher bandwidth after payment

Configure the free tier on the captive portal group:

Configure the premium tier as a separate group:

Integrate with payment gateways like Stripe to automatically upgrade users to the premium group after payment. See Vouchers for prepaid access codes with bandwidth tiers.

Fair Use Policies

Implement fair use policies to prevent abuse on guest networks:

1. Set reasonable bandwidth limits (5--10 Mbps for guest WiFi)
2. Configure session timeouts to periodically re-authenticate users
3. Set idle timeouts to free resources from inactive users
4. Use accounting data to identify high-usage users

Troubleshooting Bandwidth Issues

Bandwidth Limits Not Applied

Symptoms: User connects but speed tests show no bandwidth restriction.

Cause	Solution
AP does not support WISPr attributes	Check AP documentation for supported RADIUS attributes
Attribute name misspelled	Verify attribute name exactly: WISPr-Bandwidth-Max-Down
Value in wrong unit	WISPr values are in bits per second, not kilobits or megabits
Group attribute overridden by user	Check user-level attributes for conflicts
AP requires specific attribute format	Some APs need vendor-specific attributes (see vendor sections above)

Verification steps:

1. Check the IronWiFi authentication logs to confirm the bandwidth attributes are in the Access-Accept response
2. On the AP, verify the user's session shows the bandwidth limit
3. Run a speed test from the user's device

Inconsistent Speeds

Symptoms: Bandwidth varies significantly from the configured limit.

Cause	Solution
WiFi signal strength	Weak signal limits actual throughput regardless of RADIUS limits
Channel congestion	Too many devices on the same channel reduce per-user throughput
AP hardware limit	Budget APs may not achieve high per-user throughput
Speed test variability	Run multiple tests and average the results

Speed Higher Than Configured Limit

Symptoms: User achieves speeds above the configured bandwidth limit.

Cause	Solution
Burst allowed by AP	Some APs allow brief bursts above the limit
Attribute not being enforced	Verify the AP logs show the attribute was received and applied
Multiple connections	User may have multiple devices, each with their own limit

Best Practices

1. Start with group policies -- Define bandwidth tiers as groups, assign users to groups
2. Use consistent units -- WISPr values are always in bits per second
3. Set both up and down -- Always configure both download and upload limits
4. Enable accounting -- Required for monitoring actual usage against limits
5. Test after configuration -- Verify limits work with a speed test
6. Document your tiers -- Maintain a reference table of bandwidth tiers and their RADIUS attributes
7. Review regularly -- Adjust bandwidth tiers as network capacity and user needs change
8. Consider asymmetric limits -- Upload is typically used less, so a 2:1 or 3:1 down:up ratio is common

Related Topics

• Attributes -- Full list of RADIUS attributes
• Groups -- Creating groups with shared policies
• Session Management -- Session timeouts and concurrent limits
• Vouchers -- Prepaid access with bandwidth tiers
• Captive Portals -- Guest WiFi portal configuration
• Troubleshooting -- Bandwidth limits not working
• Networks -- Network configuration