topic Re: Bandwidth limit AD group in General Topics

Bandwidth limit AD group

dkordyban — Thu, 08 Dec 2016 15:02:35 GMT

We have a need to limit download and upload to 50 Mb/50 Mb for a specific AD group in our company. I have followed the steps in this article

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/quality-of-service/use-case-qos-for-a-single-user#36469

When I apply the qos profile to interfaces it then applies to 50 Mb limit to everyone in the zone even though I create the qos policy rule to apply to just a specifc group. I have not found articles to help.

thank for you time

Re: Bandwidth limit AD group

BPry — Thu, 08 Dec 2016 15:23:52 GMT

It sounds like you are assigning the same class id that your traffic would natively be assigned coming from that zone.

As long as I have QoS right, and I may not, the QoS policy is essentially just dictating what class gets assigned to the traffic that matches that policy. If you havethe 50/50 limit applied to class 4 (the default) then the policy essentially doesn't make a difference since you already applied the rate limit to all of the traffic from your interface the same QoS policy.

The QoS profile that you make should specify a class that you are not already utilizing, then the QoS profile should be used to designate that all traffic from that AD group is going to be assigned the set class. The class identified needs to not match your normal traffic flow or be the default class, as then the QoS profile settings will be applied to all traffic.

Re: Bandwidth limit AD group

dkordyban — Thu, 08 Dec 2016 18:47:04 GMT

Thanks that was it. I remove the egress garanteed and the egress max from Qos Profile and set the limits on class 7. I then changed the policy rule to match on the group with class 7. It works? Thanks again.