topic Re: QOS not working well in Next-Generation Firewall Discussions

QOS not working well

Wilbur — Fri, 08 Sep 2023 02:13:53 GMT

I have limited the total download bandwidth of an intranet host to 60M on the firewall, but the actual bandwidth exceeds 60M. Why is this? Is PA QOS not doing well enough?

Re: QOS not working well

ozheng — Mon, 11 Sep 2023 08:04:42 GMT

Hello Wilbur,

Can you share more context on the setup?

Is the user traffic being encapsulated?
How are you measuring the bandwidth?

Olivier

Re: QOS not working well

Wilbur — Tue, 12 Sep 2023 02:07:06 GMT

Hello Ozheng,

Thinks for your replay . My customer configured their network to limit the maximum download speed of Intranet hosts to 60M, but the customer observed a maximum bandwidth of more than 60M on their monitoring device.Especially during the 8:30-12:00 a.m .

the configturation is as follows

I think this config is no problem. But I do not know why the bandwidth still exceeds the maximum limit, so it is not the QOS function of PA is not good? Or there's something else.

Regards

Wilbur

Re: QOS not working well

TomYoung — Tue, 12 Sep 2023 02:19:09 GMT

Hi @Wilbur ,

Could you look at this document and verify you have the correct ingress and egress interfaces configured?

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/quality-of-service/qos-concepts/qos-egress-interface

"QoS is always enabled and enforced on the egress interface for a traffic flow."

"For example, in an enterprise network, if you are limiting employees’ download traffic from a specific website, the egress interface in the QoS configuration is the firewall’s internal interface, ...."

Thanks,

Tom

Re: QOS not working well

Wilbur — Tue, 12 Sep 2023 02:27:05 GMT

Hello Tom,

I know this. What the customer wants to limit is the download speed of the intranet host. I made the QOS configuration on the intranet port. This configuration is correct. I confirm this.

thanks

Wilbur

Re: QOS not working well

Raido_Rattameister — Tue, 12 Sep 2023 12:27:08 GMT

Click on this button and share output while monitoring shows above 60Mbit/s.