topic Re: Qos in General Topics

Qos

sib2017 — Tue, 06 Sep 2016 03:13:26 GMT

Hi,

If I have 100 Mbps internet download speed ,

If I want to shape like below

Class 1 , 10
Class 2, 5
Class 3, 5
Class 5 , 10
Class 6, 5
Class 7 , 5
Class 8, 5

Do i need to assign Reamining 45 to (default class(4))

The interface is 1Gbps

So what would be the value of default class

Thanks

Re: Qos

reaper — Tue, 06 Sep 2016 08:40:27 GMT

are those limits or guarantees ?

if they're limits, class 4 will consume the remaining 45 and more if more is available, it will then share bandwidth based on priority (typically class 1-3 are higher priority than 4, 5-8 are lower priority, slightly influencing IO) so unless you want to add guarantees to the remaining (or some of the) classes, it would be a good idea to set a limit for class 4 as well so you don't deprive your 'high priority' traffic of bandwidth

if those are guarantees, class 4 will not be able to consume more than 45 unless a class is not currently active in a session

if you set the profile 'Egress Max' to 100, the total bandwidth on the interface will not exceed 100Mbps

Re: Qos

Brandon_Wertz — Tue, 06 Sep 2016 13:31:42 GMT

Can I get more info on this?

I was always told that the Palo can't "shape or rate-limit." That palo can only QoS mark or provide a total bandwidth quota. Is that not true?

I'd like to be able to, say for instance, only provide 100Mb for FB/YouTube on a given 1Gb interface. Is that possible?

Re: Qos

reaper — Tue, 06 Sep 2016 13:43:36 GMT

Hi @Brandon_Wertz

yes, yes it is! 😉

check out a little article i wrote on the matter 🙂 Getting Started: Quality of Service

in short: in the security policy options you can do DSCP marking etc, for external BW shaping appliances, but the firewall comes with it's own QoS policies that can limit or guarantee bandwidth for a subnet/application/user/.. (it's not as fancy as true traffic shaping, but it does a pretty good job)

Re: Qos

Brandon_Wertz — Tue, 06 Sep 2016 13:53:39 GMT

@reaper thanks! I see this article was written in 2015. Has PAN-OS always been able to rate-limit applications or how long has it been possible for?

Re: Qos

reaper — Tue, 06 Sep 2016 14:11:04 GMT

@Brandon_Wertz it's been there for as long as i can remember.... 😉 (so PAN-OS 3.1.4 and after)