topic Re: Prioritizing Teams application traffic for Global Protect and Local users in GlobalProtect Discussions

Prioritizing Teams application traffic for Global Protect and Local users

tamilvanan — Sun, 17 Oct 2021 07:45:14 GMT

Hi Team,

We are facing slowness issue with the Teams Application traffic Voice and Video and there is some disruption on the voice and video.

Is it possible to configure Qos for Teams application traffic and whether it will work correctly?

If any one had already implemented Qos for Team in your environment could you please let us know on how to do the configuration to achieve this.

Epically the Qos Rule and applications needed to be included in the application tab.

Re: Prioritizing Teams application traffic for Global Protect and Local users

nikoolayy1 — Sun, 17 Oct 2021 10:34:14 GMT

Better to exclude this traffic using split tunnel with domain or process:

https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-gateways/split-tunnel-traffic-on-globalprotect-gateways/configure-a-split-tunnel-based-on-the-domain-and-application.html

https://live.paloaltonetworks.com/t5/globalprotect-articles/globalprotect-optimizing-office-365-traffic/ta-p/319669

Also to exlude it for the enforce globalprotect connection for network access if you use such option:

https://docs.paloaltonetworks.com/globalprotect/5-1/globalprotect-app-new-features/new-features-released-in-gp-app/enforce-globalprotect-exclusions.html

For more about VPN issue I recommend:

https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-community-account-fix-and-globalprotect/td-p/441311

Re: Prioritizing Teams application traffic for Global Protect and Local users

tamilvanan — Mon, 18 Oct 2021 08:40:15 GMT

Hi @nikoolayy1 thanks for the reply. The issue is we need all the traffic to go through the full tunnel.So split tunnel is not an option for us.

So we need to know whether application based Qos Policy will work better on the firewall as we had previously seen PBF rule based on Application traffic will not work well due to technical constraints.

Thanks in advance.

Re: Prioritizing Teams application traffic for Global Protect and Local users

nikoolayy1 — Mon, 18 Oct 2021 10:22:05 GMT

If you are not decrypting the traffic it could be that you can't match corectlly the application etc. You may try using QOS based on the globalprotect zones or destination ports (services as palo alto calls them) , destination FQDN, URL or ip addresses:

https://docs.paloaltonetworks.com/globalprotect/9-0/globalprotect-admin/get-started/create-interfaces-and-zones-for-globalprotect.html

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/quality-of-service/configure-qos.html

Maybe helpfull:

https://www.youtube.com/watch?v=7fU91SZ5xDk

Re: Prioritizing Teams application traffic for Global Protect and Local users

DDmchk — Tue, 02 Nov 2021 07:48:21 GMT

Fully aree with Nikolai - I've lived it through - attempts to pritoritize MS Teams by application failed in my case (I've discovered many traffic missing the policy, also we are using UDP for calls, not TCP that can be recognized as ms-teams app - so in my case I've finished with working QoS policy based on MS Teams official endpoint list (https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide#skype-for-business-online-and-microsoft-teams)