topic Re: Not able to apply QoS profile to interface in Next-Generation Firewall Discussions

Not able to apply QoS profile to interface

raji_toor — Mon, 16 Jan 2023 19:37:12 GMT

I am preparing firewall for interface change, and moving 2 sub interfaces to a separate aggregate ethernet.

Current

AE1.10, .20, .30, .40

Upcoming

AE1.10, .20

AE10.30, .40

I have already created aggregate and its subinterfaces and are disabled, added fake IP/s routes and created NAT rules using new interfaces, to make it easier on the change day.

What I can't do is apply QoS profile to these subinterfaces. They are L3 perfectly valid although fake IPs.

Under Physical interface, I can see other interfaces but not AE10

I also enabled one of the physical interfaces(although link is down), in aggregate but no change.

FWs are panorama managed(10.1.6), What am I missing?

Re: Not able to apply QoS profile to interface

Raido_Rattameister — Mon, 16 Jan 2023 19:47:29 GMT

Are you checking under "Clear Text Traffic" tab and "Destination Interface" droppdown and subinterface is not there?

Re: Not able to apply QoS profile to interface

raji_toor — Mon, 16 Jan 2023 20:17:58 GMT

@Raido_Rattameister Here is the screenshot. Adding QoS interface and under Physical Interface > Interface Name , there is no AE10

Re: Not able to apply QoS profile to interface

aleksandar.astardzhiev — Mon, 16 Jan 2023 21:29:07 GMT

Hi @raji_toor ,

Have you commited the configuration that is creating the new aggregated interface? And I think you may need to push it to the firewall and not only commit to Panorama.

Re: Not able to apply QoS profile to interface

Raido_Rattameister — Mon, 16 Jan 2023 23:00:56 GMT

Subinterfaces are not accessible from "Physical Interface" tab.

You can configure subinterface based settings under "Clear Text Traffic" tab.

Re: Not able to apply QoS profile to interface

raji_toor — Mon, 16 Jan 2023 23:14:59 GMT

I never said I am trying to access subinterfaces from 'Physical Interface' I always said there is no AE10 and that is not a subinterface.

I should be able to see AE10 in the drop down for physical interface, but it does not come up.

Like I can see AE1 and AE2, I should be able to see AE10.

Re: Not able to apply QoS profile to interface

Raido_Rattameister — Mon, 16 Jan 2023 23:40:03 GMT

You should talk to support.

I tested and see similar issue.

Worked with lower ae id's up to 8.

9 and 10 were not visible any more.

Re: Not able to apply QoS profile to interface

raji_toor — Tue, 17 Jan 2023 19:42:00 GMT

@aleksandar.astardzhiev Yes it was commited

Re: Not able to apply QoS profile to interface

raji_toor — Tue, 17 Jan 2023 19:45:45 GMT

@Raido_Rattameister Thanks for testing this out. I can confirm when I changed AE10 to AE5, I do indeed get to apply QoS.

I am in a bit of a hurry for the change, so i moved all my config to AE5. It will help someone else facing this issue and maybe someone else can notify Palo of this bug.

Re: Not able to apply QoS profile to interface

TTNhan — Thu, 04 Jan 2024 10:16:51 GMT

I have the same case.

Is there any work around, or is this a limit of features that need to be requested?

Re: Not able to apply QoS profile to interface

Justin_Ng — Fri, 05 Jan 2024 08:28:43 GMT

Hi Nhan,

This may be PAN-OS bug, and fixed in the 10.1.11, 10.2.6 and 11.0.3 versions as well.

Re: Not able to apply QoS profile to interface

TChristieBCI — Thu, 12 Sep 2024 18:46:48 GMT

I've just stumbled upon this in 10.2.8, but it seems AE20 does work (but my stupid hardware only supports up to AE14. They need a published matrix of non-feature limited ae numbers.

OR, remove these limits altogether. GRRR

In my screenshot i've already deleted ae20, but as you can see on the cli, it was there.

Re: Not able to apply QoS profile to interface

anazarta — Thu, 17 Oct 2024 19:19:06 GMT

On PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls, QoS is supported on only the first eight AE interface groups.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/network/network-interfaces/aggregate-ethernet-ae-interface-group#:~:text=On%20PA%2D3200%20Series%2C%20PA%2D5200%20Series%2C%20and%20PA%2D7000%20Series%20firewalls%2C%20QoS%20is%20supported%20on%20only%20the%20first%20eight%20AE%20interface%20groups.