General steps:
I am not familiar with that specific router so I listed general objectives.
Is there any central logging in place now at the gateway IP that you can leverage? Is the system logging to a SQL database?
Is there a central authentication server, radius server? If yes, does it return a unique id or you may want to use the login id.
You have to dump the data to a central database containing ethernet mac address also include bytes in and bytes out. [userid, customerid from authentication server/method]
Once you have a database in place you perform aggregate queries sorted by bytes and mac address.
You can create your own rules on bytes in vs bytes out or just create a cumulative total of both.
Do you want the restrictions on the user or the specific device or both?
Once you have your targets you can script actions against the network using QOS, diff-serv and tag the users packets.
Setup general rules: max bandwidth per connection allocation
Network must be capable of QOS, Diffserv & WMM [would be nice]
Routers, switches should have QOS, diffserv capabilities. Check the switches to see what impact changing the QOS, diffserv tagging has on the different switches, routers etc. This may impact your frequency and method of updating. The whole reason for implementation is to keep a network running smoothly. You want to make sure this type of network management does not have an adverse effect on the network.
How often do you want to update and enforce?
Do you want to enforce at next login or in real time /semi-realtime?
At login check SQL flags: read bytes flag or rules flags.
Do you want to warn the user of the rules? if yes, create warning at threshold percentage of usage [however you decide to factor usage]
Create triggers for queries
Script results to network devices using SNMPv3 or alternative method.
I have done a few of these for different reasons over the years. In one case we put a box in the middle to offload the extra workload caused by the overall process. The computer acted as a filter. We also added dead gateway detection method in front of the filtering computer. If it was down the traffic would flow directly to the gateway bypassing the filtering system. As stated earlier, the general goal of these projects is to provide reliability and stability to all users overall.
