topic Re: Rate Limit Per user on PA200. in General Topics

Rate Limit Per user on PA200.

inderjit21 — Tue, 19 Jul 2016 06:26:51 GMT

I have PA200 runing PANOS-7.0.6 . Is it possible to rate limit per user. One of the user downloaded 4x1gb files and caused net congestion for other users.

Re: Rate Limit Per user on PA200.

reaper — Tue, 19 Jul 2016 08:39:50 GMT

yes it is, you can either create a QoS policy per user or per group, but usually it's better to create QoS policies based on applications or application groups as there are only 8 QoS classes available , else your QoS policy will become increasingly complex

Re: Rate Limit Per user on PA200.

tsrivastav — Tue, 19 Jul 2016 10:43:48 GMT

For limiting download

--------------------------------

Apply QOS on you Lan interface ( which will be the egress port for download traffic ) use a class to limit band width ( dont use class 4 )

Note if you are using clear text tab make sure the source interface will be your wan interface if you are limiting download

Write QOS policy according to your need per user / per subnet / per group as shown in above comment.

Re: Rate Limit Per user on PA200.

inderjit21 — Tue, 26 Jul 2016 08:54:59 GMT

I have setup qos profile with a class2 medium with max bandwidth of 7mb. I have associated this class with webbrowsing app and set it for a user. I can do speedtest and speed is capped at 7mb. But it seems it doesn't work per user. If i log in as a different user speed still gets capped. These are local users on the firewall and I use captive portal before user can start browsing. So i logged in as a user,clear user-ip-mapping logged in as another user for this scenario.

Re: Rate Limit Per user on PA200.

reaper — Tue, 26 Jul 2016 09:32:20 GMT

QoS is designed to limit/guarantee bandwidth per group of applications so that, for example, web browsing cannnot consume more bandwidth and guarantee bandwidth for VoIP

these limits and guarantees are controlled by the class an application/zone is in, all resources in a class are shared within that class

eg. class 8 has a limit of 10mbit: 1 single session will be able to hit 10mbit, 2 sessions will average out at about 5mbit, 20 sessions will have 500kbps

if you change this behavior to match users, you will need to make sure every user has their own class, so they don't need to share bandwidth or restrictions

in your scenario, you will also need to clear all sessions, DP-user-mappings and MP-user-mappings, because you're originating from the same source ip

> clear session all 
> clear user-cache all
> clear user-cache-mp all