We’ve done network engineering for a customer in the credit business for several years.  This customer ran a call center for their card holders at their headquarters location. They used a VOIP internet based IVR system for taking calls and all of their voice based customer contact.  As you might guess, this system worked well but is understandably sensitive to network delays.  Normally there was plenty of internet bandwidth and the system worked well, but all too often seemingly ample Internet bandwidth would get congested, and customer communication visibly (or should I say audibly) suffered.  Using their two separate Cisco ASA firewalls, one for each ISP, it was never very easy to determine what, much less who, was crushing the internet bandwidth. This was a common and painful problem.  With the tools they had available, it was rare that we could reliably figure out what the problem was.  My efforts to sell them a Palo Alto Networks Next Generation Firewall were eventually rewarded.   The day of the installation, after running a few hours, I glanced in to the Palo Alto Networks Firewall GUI admin ACC (application control center).    On the default view, the enumeration of the last hour of traffic broken down by application, sorted by bytes, was the smoking gun.

 

Here is a real conversation with the proud new owner (CIO) of the new firewall:

Soundmind: “Hey, did you know that 60% of your internet bandwidth in the last hour was streaming Netflix?”

CIO: “Are you kidding? We don’t do that here.”

Soundmind: “No, I am not.” (And yes, you really do!)

CIO: “Can you block it?”

Soundmind: “Yes, easily. Would you like to know which four employees are watching Neflix right now?”

CIO: “As a matter of fact, I would!”