topic Re: Palo Alto Bandwidth Throttling in General Topics

Palo Alto Bandwidth Throttling

MarkTan — Thu, 03 Oct 2013 16:28:56 GMT

Hello Everyone,

I have a question regarding Palo Altos and bandwidth throttling. I know that the Palo Altos can do QoS to limit the bandwidth for specific applications, but can the Palo Altos just do bandwidth throttling with different networks? Say for instance, we have an office and guest network going to a Palo Alto firewall. Can you do a QoS with the Guest network so that its bandwidth doesn't go above a specific limit, say 20Mbps? Any help is appreciated.

Thanks,

Mark

Re: Palo Alto Bandwidth Throttling

gswcowboy — Fri, 04 Oct 2013 04:02:33 GMT

I've got a screen shot where Internal zone traffic destined for the External zone has QoS applied for 'any' application but sourced from a specific subnet within that internal zone. Is this what you're referring to?

Re: Palo Alto Bandwidth Throttling

MarkTan — Fri, 04 Oct 2013 14:19:32 GMT

That was exactly what I was looking for. Though, does QoS in Palo Altos only do egress limiting or can it do ingress as well?

Re: Palo Alto Bandwidth Throttling

gswcowboy — Fri, 04 Oct 2013 14:20:44 GMT

QoS on the PAN is for egress only traffic

Re: Palo Alto Bandwidth Throttling

MarkTan — Fri, 04 Oct 2013 15:26:18 GMT

Got it. I think I'm getting the handle of this. One more question, is there any functionality for dynamic QoS? Say for instance, we have our office and guest network, and our office network requires more bandwidth for whatever reason. Is there an automation available to increase the max bandwidth of the office network and lower the max bandwidth of the guest network?

Re: Palo Alto Bandwidth Throttling

_slv_ — Fri, 04 Oct 2013 16:00:05 GMT

Of course Yes. Please read this two documents:

https://live.paloaltonetworks.com/docs/DOC-3439

Also you can look at the following doc as well:

https://live.paloaltonetworks.com/docs/DOC-3158

and some about limitation od QoS and subinterfaces:

Re: QoS on Tagged VLAN Sub-interface

Hopefully this helps.

Regards

Slawek

Re: Palo Alto Bandwidth Throttling

gswcowboy — Fri, 04 Oct 2013 16:03:29 GMT

the qos doc slawek mentions would be ideal to get your feet wet. perhaps case 2 would be suited to what you're trying to accoomplish.

Re: Palo Alto Bandwidth Throttling

jangeja — Fri, 04 Oct 2013 21:22:52 GMT

The document is somewhat confusing as to what exactly is supported on the 2050. Is Bandwidth throttling supported on the 2050 as well?

Joe

Re: Palo Alto Bandwidth Throttling

gswcowboy — Fri, 04 Oct 2013 21:43:31 GMT

tech note indicates 2000 series devices is not able to support policing but does perform traffic shaping.

Policing is performed to avoid unintentional starvation of the QoS priority queues.

Not all Palo Alto Networks firewalls support policing, refer to the following table:

Platform Policing

PA-200

Not Supported

PA-500

Not Supported

PA-2000 Series

Not Supported

PA-4000 Series

Supported (on egress interface)

PA-5000 Series

Supported (on egress interface)

All platforms support shaping, which is at the egress interface only. In PA-200/500 and PA-2000 Series devices, Shaping is performed in software only

Re: Palo Alto Bandwidth Throttling

jangeja — Sat, 05 Oct 2013 17:40:49 GMT

Thanks Nato

Re: Palo Alto Bandwidth Throttling

apasupulati — Mon, 07 Oct 2013 05:24:38 GMT

QOS on the palo alto device is applied only on the egress interfaces, however you can apply Qos profiles for traffic ingressing from a specific source subnet.

So for example if you want to rate limit upload traffic from your guest/office network:

Guest/office---ingress--->PAN---egress--->Untrust

Here QOS is enabled on the Untrust (egress)interface, but you can configure multiple QOS profiles for traffic egressing Untrust, based on the source interface/subnet as well.

I'm guessing this may answer your original question partially unless you want to rate limit traffic ingressing Untrust interface like downloads, hope it helps.

Aditi

Re: Palo Alto Bandwidth Throttling

Retired Member — Mon, 07 Oct 2013 06:32:14 GMT

so can we use this for download by selecting WAN interface on clear tab section ?

Re: Palo Alto Bandwidth Throttling

apasupulati — Mon, 07 Oct 2013 06:40:46 GMT

Yes, you will enable QOS on the egress interface i.e. LAN and can select the WAN interface as the source interface for download traffic from the internet. Source subnet will be any.

Thanks,

Aditi

Re: Palo Alto Bandwidth Throttling

Retired Member — Mon, 07 Oct 2013 07:34:10 GMT

I tried that with choosing Wan on subnet but physical interface was Layer2 and it did not work.is that normal ?

Re: Palo Alto Bandwidth Throttling

MarkTan — Mon, 07 Oct 2013 19:47:44 GMT

Thanks for all the input everyone!

Does anyone know of documentation besides the one posted above that can better explain QoS profiles? I keep trying to test QoS in the labs and whenever I set up my profile and QoS settings, it gives me an error that states "the regular traffic guaranteed bandwidth is less than the sum of the total guaranteed bandwidth of its children." I tried modifying my bandwidth settings, but I'm not sure what to change. I know that the max/guaranteed bandwidth for each class has to be less than or equal to the max/guaranteed of the profile, but is there any other rules that I should know about?

Re: Palo Alto Bandwidth Throttling

PaloSoSlow — Thu, 08 Dec 2022 22:21:19 GMT

this link "https://live.paloaltonetworks.com/docs/DOC-3439" says "access denied" after i log in with forums account. Do you have another link that actually works?

i dont see why manuals are locked behind a login anyways... hard to tell if i dont have access, or the resource was just simply moved since you posted this in 2013.

Re: Palo Alto Bandwidth Throttling

Adrian_Jensen — Fri, 09 Dec 2022 16:45:39 GMT

@PaloSoSlow At some point in the past the forums changed format and many of the old "live.paloaltonetworks.com/docs/*" links broke and give an "access denied" error instead of a "not found" error (so it seems). Documents were re-written and moved to "knowledgebase.paloaltonetworks.com/" and "documentation.paloaltonetworks.com/" (in about Sep 2018 I think).

The original /docs/DOC-3439 link redirects to /t5/tech-note-articles/qos-in-pan-os/ta-p/56051. That document, "qos in pan os", is no longer available on "live.paloaltonetworks.com/". However, if you search by the document name in KnowledgeBase and Documentation you will find the document "QoS in PAN-OS" in the KnowledgeBase:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5tCAC