topic Re: Per IP Traffic shaping in General Topics

Per IP Traffic shaping

puzzel — Wed, 26 Mar 2014 10:31:19 GMT

I have one question.

Does the PA 5020 can shape traffic per host (ip) ??

Re: Per IP Traffic shaping

HULK — Wed, 26 Mar 2014 13:52:26 GMT

FYI.

Similar discussion Re: Per host QoS

For more details information please follow: QoS in PAN-OS 4.1

Thanks

Re: Per IP Traffic shaping

Phoenix — Wed, 26 Mar 2014 14:22:00 GMT

Hello puzzel

Yes we can surely do traffic shaping on all platforms. The QOS rules would decide to which hosts the qos profile should be applied. If we have just one host in the rule then that host gets the configured traffic shaping. On 5k series the shaping is performed on the hardware.

Thanks

Re: Per IP Traffic shaping

puzzel — Thu, 27 Mar 2014 10:42:18 GMT

Yes, but iI've got about 4k hosts in my network

It will be a little difficult and not scalable to make 4k rules in my PA 😕

Is there any other way to do this?

Re: Per IP Traffic shaping

Carlo.Ferandos — Mon, 13 Nov 2017 09:55:36 GMT

Hello!

We recently replaced our Fortigate 1000C internet gateway firewall with PA-3050. We didn't have problems in our Fortigate firewall in terms of bandwidth management because it has a Per IP bandwidth limit. Now with Palo Alto, we encounter bandwidth shortage almost everyday and we received many complaints already. Even my higher-ups are calling my attention regarding this issue. I already made QoS for high bandwidth consuming applications and priority applications but it doesn't solve the problem.

It makes me feel bad to find in this page that this Per IP traffic shaping issue has been brought up a long time ago but until now there is no update from palo alto. I still believe that palo alto is the best enterprise firewall and i like its application control but I don't understand why it doesn't have a Per IP bandwidth limit in its features. For me it is a very important feature and even PFsense open source firewall has this feature. If an open source firewall can provide this feature, then why can't the best and expensive firewall?