Bandwidth requirements for cloud deployment

[sjsedwards]

Apologies if this information is available elsewhere. Can anyone point me to real-world information on the Internet bandwidth required for reasonable performance with Azure AD in a school environment? We recently replaced an old RM network with a fully cloud-based MS365/Azure AD/Sharepoint instance. All works well with 35-40 PCs online around the school but we find, when students log into the IT Suite computers the login process kills the broadband (speed drops to 1-2Mbps), and it can take 15-20 minutes to recover. During this time we can see a fair amount of traffic on the network, which is to be expected, but the effect on the broadband seems excessive.

 

Our experience in other schools has been that a 100M Internet line handles this sort of thing with no noticeable impact on performance. This school has an 80/20 line so we know it's not quite as capable, but the drop in performance is completely unexpected. Before we shout at the ISP, I want to be sure we haven't underestimated the traffic, however I can't find any definitive information on what's required/recommended for an installation of this kind. Any advice would be most welcome.

 

Thanks,

Stuart

[atcoates]

I know this doesn't help but whoever suggested moving the school to the cloud without upgrading the connection and giving the school a backup connection feels like a mistake to me.

 

DFE guidelines are here and ideally what you should be looking at as an absolute minimum. The guidelines are probably also based on just internet use, not for a school that's pretty much serverless by the sound of it.

 

https://www.gov.uk/guidance/meeting-digital-and-technology-standards-in-schools-and-colleges/broadband-internet-standards-for-schools-and-colleges

[dmj]

It's a bit of a 'how long is a piece of string' question. Without knowing/measuring exactly what is being used it's difficult to say, but suffice to say what you have is clearly not enough.

One thing to consider is using an old pc/server as a caching proxy. It is simple to setup using squid. Your web filter may do this already - check it is caching and has capacity.

[pete]

If it's a small-medium sized primary, I'd bump it to 100/100. If it's a large primary or a secondary, go to a Gig-capable line and throttle it to the price/speed that does the job at an affordable price.

 

Also, check to see if the school's eligible for something like the Midlands Gigahubs project that'll pay for the cost of installation.

[nicholab]

Some of the Alt-Net's will provide very fast FTTP connection in both directions so it does not have to be a lease line. I used too be able to build a laptop as quick at home as in the Office using Intune on my 150mb connection. Edited November 16, 2023 by nicholab

[Steve21]

when students log into the IT Suite computers the login process kills the broadband (speed drops to 1-2Mbps), and it can take 15-20 minutes to recover. During this time we can see a fair amount of traffic on the network, which is to be expected, but the effect on the broadband seems excessive.

 

If I'm honest that sounds more like a bad/wrong configuration if it's happening that much. Even something silly like Apps being deployed per user without delivery optimization (rather than per computer), having Teams automatically installing per user, or having OneDrive automatically downloading their files (rather than Files on Demand) would make a huge difference in terms of what it's using

 

Just logging into an AzureAD account shouldn't be using that much bandwidth and certainly not for 15-20 minutes - It's more Mbs for policies etc after the initial installs (https://learn.microsoft.com/en-us/mem/intune/fundamentals/network-bandwidth-use)

 

Steve

[kevin_lane]

You could ask your ISP for the traffic utilisation over say the last 30 days which should give you a better indication of what is going on, before you give them 2 barrels

 

If it looks like it is not not hitting the top end then I.e maxing out then you will want to be looking at your setup

 

I’m thinking firewall / dns and seeing how that flows

 

Just as a starting point

 

And then looking at edge switching and core

[PotNoodleTech]

It's highly likely that it is the 20 part of your 80/20 that's the issue, and also it sounds like it could be in a contended line too? Worth checking with the ISP.

 

Generally moving to the cloud doesn't reduce bandwidth requirements, it increases it. I would guess you would need a 200/200 line to be honest.

[Oaktech]

One of my schools is a fairly large 3 form entry 2-11 primary with just over 600 students using Azure - we have just upgraded our connection to 300 symmetrical on a gig bearer because we were regularly hitting the end stops of our 100/100 on 100 connection. We are still regularly achieving 250 during our whole school video assemblies (we don't all fit in the hall in one go so we have a whole school Google Meet with video) We have an 80mbps sogea backup line as well.

 

We are also in the process of upgrading the majority of our internal uplinks to 10g as well to eliminate pinch points. We are using Unifi for wireless and for switching.

[RobFuller]

What firewall/router are you running, is it up to the demands of that many devices and users?

[sjsedwards]

We're running OPNSense/Zenarmor. We wondered if that was a bottleneck so we've tested with the firewall removed and the issue remains.

[RobFuller]

Is there anything between that and your IPS connnections like a router? I only say as many years ago we had a VMB connection and had to use there router (Coax) and it just was not up to the task when we tested with a school full of users. We now have redundant leased lines.

[sjsedwards]

The router is a Draytek 2760. I'm not a router expert but we have Drayteks in other similar-sized schools and they don't seem to have an issue.

[chaplic]

This strikes me as odd, there’s not that much normally happening on login which makes me wonder what’s happening here. If you threw a gig connection at it, yes it would be better but you’re masking an issue

 

I have 30 laptops and a slower internet connection and no issues.

 

Are profiles being deleted on logouts/ some kind of background job? What is onedrive configured to do? Is proxy interception certificates causing greif (you shouldnt be putting O365/ Azure AD traffic through a firewall and definelty NOT ssl inspecting it)

 

What scheduled tasks are on login/ run once etc

 

Only network thing I could think of would be someone has set the NAT pool very low and that’s being exhausted.

 

 

Procmon can be set to run during boot which might show something also finding a hub and running wire shark on a PC whilst the test laptop signs in might show some problems (all traffic to 365 will be encrypted but you might see lots of resets or something.

[robyholmes]

I recently found Windows Activity History was using a lot of bandwidth at login and log off. So we've disabled it as a test, so far no one has reported its affected anything and bandwidth has reduced a lot.