topic Applying differing inbound QoS profiles in a dual-ISP failover setup? in General Topics

Applying differing inbound QoS profiles in a dual-ISP failover setup?

en26bq — Sat, 29 Jul 2017 23:12:27 GMT

Hi-

I need to configure a dual-ISP failover setup as described in the following article:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-a-Palo-Alto-Networks-Firewall-with-Dual-ISPs/ta-p/59774

However, I have a couple of additional requirements and am unsure as to how I can do this on the Palo Alto platform.

Firstly, I need incoming QoS, in that I need to reserve a set amount of incoming bandwidth for video-messaging.

Secondly, my 2 ISP circuits are different speeds: primary is 100Mb download, backup is 10Mb download; how can I reserve differing amounts of bandwidth for incoming video-messaging, depending on which ISP circuit is in use?

Class bandwidth-limits are assigned in QoS Profiles.

QoS Profiles are associated with Physical Interfaces in a QoS Interface object.

However. it appears that each Physical Interface can be associated with only one QoS interface (and therefore only one QoS Profile), so how can I apply differing QoS profiles to my incoming Internet traffic, depending on which ISP I am currently connected to?

Thanks for any suggestions!

Re: Applying differing inbound QoS profiles in a dual-ISP failover setup?

en26bq — Sat, 29 Jul 2017 23:23:13 GMT

to follow on: logically, I would expect to create a 3 virtual router system, with VR1 and VR2 associated with ISP1 and ISP2, with both having static routes pointing trusted internal traffic to a 3rd internal VR.

I would then expect to be able to attach different QoS profiles to the internal-facing interfaces of VR1 and VR2, allowing me to enable different QoS behaviour dependent on which circuit packets came in on.

But since it appears you can only apply QoS profiles to physical interfaces, this does not appear to be an option.

So again, question is how can I apply differing QoS profiles to my incoming Internet traffic, depending on which ISP I am currently connected to?

Thanks!

Re: Applying differing inbound QoS profiles in a dual-ISP failover setup?

Remo — Sat, 29 Jul 2017 23:58:03 GMT

Hi @en26bq

On what PAN hardware do you need to set this up?

Re: Applying differing inbound QoS profiles in a dual-ISP failover setup?

en26bq — Sun, 30 Jul 2017 01:06:19 GMT

everything from PAN-220s upwards.

Furthermore, all instances are going to be HA clusters,

Ideally I'd like a template I could use for all satellite offices.

Re: Applying differing inbound QoS profiles in a dual-ISP failover setup?

Remo — Sun, 30 Jul 2017 06:17:58 GMT

Hi @en26bq

My initial question was a little sensless. It would matter if you have both internet connections on the same port but different subinterfaces on you PA...

Anyway, when you create the QoS configuration on your internal interface, in the clear text tab you can create different rules with different QoS profiles based on the source interface (or the source IP) of the incoming traffic.

Re: Applying differing inbound QoS profiles in a dual-ISP failover setup?

en26bq — Sun, 30 Jul 2017 10:26:54 GMT

Hi vsys_remo.

Thank you for your response.

I wasn't aware of being able to specify source interface on the QoS Interface Clear-Text Traffic tab, and I think this will enable me to do just what I am trying to do.

(I've found an image URL showing this tab, showing differing profiles being applied dependent on source interface/subnet and pasted below if anyone wants to check.

/t5/image/serverpage/image-id/5848i490BA4F2D5AE9010?v=1.0

When I get back to work, I'll try this out and update here.