topic Re: Applying QOS bandwidth restriction in General Topics

Applying QOS bandwidth restriction

Ahmed_94 — Sun, 30 Nov 2025 07:07:03 GMT

Hi,

I would like to understand if my FW is capable of the below using QOS:

- I am using PA-1410 in HA pair

- I have 1 ISP internet link with 50Mbps bandwidth connected to eth1/1

- I have a requirement to create a guest network using the same ISP link and assign 10Mbps out of 50Mbps.

So. using the same outside interface (eth1/1) I want to reserve 10Mbps only for a sub-interface dedicated to guest network. Is that doable with Qos?

Many thanks

Re: Applying QOS bandwidth restriction

JayGolf — Sun, 30 Nov 2025 21:46:03 GMT

Hi @Ahmed_94 ,

You won’t be able to apply QoS directly on a subinterface on the PA-1410, but you can classify the guest VLAN traffic on the physical interface (eth1/1) and put it into a lower-priority or max-bandwidth QoS class. This won’t guarantee a strict 10 Mbps slice, but it will prevent the guest VLAN from saturating your 50 Mbps link.

Re: Applying QOS bandwidth restriction

PavelK — Mon, 01 Dec 2025 04:32:57 GMT

Hello @Ahmed_94

only to add to what Jay mentioned, this KB: Why is QoS Setting Not Available Under subinterface? explains what Firewall models are supporting QoS in sub-interface.

Kind Regards

Pavel

Re: Applying QOS bandwidth restriction

Ahmed_94 — Mon, 01 Dec 2025 04:52:44 GMT

Hi Jay, thank you for your response.

Just want to clarify what you meant by "put it into a lower-priority or max-bandwidth QoS class", so in the default profile I assign a low-priority class like 6 and also assign the max bandwidth allowed as 10Mbps, as below. is that what you meant?

And then in the policy I put the guest vlan into class 6 and the profile assigned to interface eth1/1.

Thanks

Re: Applying QOS bandwidth restriction

Raido_Rattameister — Mon, 01 Dec 2025 15:14:52 GMT

QoS profile needs to be applied to egress interface.

If you apply it to eth1/1 then you effectively throttle/prioritize upload bandwidth and not download.

Assign profile to internal interface.

With policy assign guest traffic to a specific class.

In QoS profile give this class 10Mbit/s.

Re: Applying QOS bandwidth restriction

Ahmed_94 — Tue, 02 Dec 2025 08:31:21 GMT

Hi @Raido_Rattameister, Thanks for your reply.

Assigning the profile on the internal interface would not be proper traffic flow right? see below image flow.

In our case, the egress interface would be the other way around, it would be eth1/1 egressing to outside because we want to limit the outbound bandwidth to 10Mbps, hope that my understanding is correct?