topic Re: Data cap limits for users in specific network in Next-Generation Firewall Discussions

Data cap limits for users in specific network

FellowCurious — Mon, 28 Aug 2023 23:43:31 GMT

Hi, just like the title says, I'm looking to cap data usage for users in a subnet, something like this: https://github.com/hiep4hiep/PANW-Bandwidth-quota, but without having to use scripts, is there a way to do something similar inside the PA firewall?

Re: Data cap limits for users in specific network

Raido_Rattameister — Tue, 29 Aug 2023 12:24:31 GMT

Check if this gives you ideas.

Instead of QoS you can block traffic if quota is exceeded.

https://www.youtube.com/watch?v=7fU91SZ5xDk

Re: Data cap limits for users in specific network

BPry — Tue, 29 Aug 2023 13:20:19 GMT

@FellowCurious,

If you're trying to create an aggregate amount over time, you'll need to use an external script instead of relying on the firewall. Just scanning over both solutions they also don't appear to take into account long-running sessions, so you'll need a way to account for those. That could be just closing any sessions that exceed a certain duration (via a script), or some other negate for expected sessions.

Essentially what you'll run into from a brief glance is that some users will have long sessions that will eventually end. They've passed enough traffic to keep it open and it's potentially been open for days if a user just locks their endpoint instead of logging off or shutting down at the end of the day. You might end up with someone closing a session that's technically passed tens or hundreds of GBs that doesn't quite line up with reality.

Just something to keep in mind that this won't be explicitly clean due to how you're pulling the data.

Re: Data cap limits for users in specific network

FellowCurious — Tue, 29 Aug 2023 19:29:55 GMT

This one requires a script to remove devices afterwards, can't have that done manually daily, too much overhead.