topic Re: Palo alto traffic shaping in General Topics

Palo alto traffic shaping

simsim — Sat, 13 Jan 2018 14:56:41 GMT

Hi,

I have the below topology . video conference device is connected in distribution .

All the devices are cisco . Actually I want to prioritize and reserve 10 mb for the vc .

Marking the vc network as real time will help . I have never seen the dataplane going high in palo alto .

The real congestion is facing at internet router .In that case what I can do ?

Please help

Thanks

Re: Palo alto traffic shaping

pulukas — Sat, 13 Jan 2018 15:08:53 GMT

Based on your description, I think setting up QoS egress bandwidth guarantee would help on the PA side.

naturally once the traffic hits the internet no one can help further, but at least the PA bandwidth would be reserved.

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/quality-of-service/qos-concepts/qos-bandwidth-management

Re: Palo alto traffic shaping

simsim — Sat, 13 Jan 2018 15:13:55 GMT

Hi,

Thanks for the reply .

If I classify the traffic on the internet router based on the PA marking (Like cisco ) , would it be helpful ?

Or it's not possible ?

Thanks

Re: Palo alto traffic shaping

pulukas — Sat, 13 Jan 2018 15:22:04 GMT

Generally classification is not read or honored on internet path routers. So there is not real advantage to marking traffic as it enters the internet. Really does not matter what brand you have. On the public internet we don't honor client traffic markings at all.

This QoS bandwidth reservation will keep your own internal traffic from crowding out the traffic type. This you can control.

Re: Palo alto traffic shaping

simsim — Sat, 13 Jan 2018 15:30:35 GMT

Hi,

Thanks for the reply . The internet router which I mentioned in the diagram is located in premise.

If I do classification on the router , atleast can I control the congestion happening on the interface which is connected to the ISP ?

Maybe a dumb question 🙂

Thanks

Re: Palo alto traffic shaping

pulukas — Sat, 13 Jan 2018 15:31:48 GMT

Yes, that all will work as per the standards for both the PA and the routers you control.

Re: Palo alto traffic shaping

simsim — Sat, 13 Jan 2018 15:44:05 GMT

Hi,

Thanks for the reply.

In that case , To classify on internet facing router , Can i get the required marking from the PA or it hast be done on the distribution ?

Thanks

Re: Palo alto traffic shaping

pulukas — Sat, 13 Jan 2018 15:47:18 GMT

Best practice is to mark the dscp code as close to ingress as practical then have all devices in the path honor the classifications.

As a practical matter of course it only comes into play when you have congested links.

Re: Palo alto traffic shaping

simsim — Tue, 16 Jan 2018 03:31:19 GMT

Hi,

In between internet router , there is cisco firewall and switch between .

What actually I found switch cpu is going very high and found some drops on the interface ,

In that case do I need to apply qos on the switch also ?

Thanks

Re: Palo alto traffic shaping

BPry — Tue, 16 Jan 2018 14:06:33 GMT

@simsim,

High CPU on a switch isn't necissary an issue. If you run 'show processes cpu history' in EXEC and see what your CPU utilization history is. Is the CPU constantly busy or is it just spiking? Are the spikes lining up with a known event or activity pattern? Are you having any larger issues within Layer2 that could be causing higher CPU utilization across the board? If your substained CPU baseline is higher than 60% I would say this could be causing issues on a broader scope.

As far as the drops go, QoS helps with conjested links. So you won't get rid of the interface drops, you'll simply ensure that traffic you care about has a higher chance of getting processed through the queue before a drop takes place. If you have a highly conjested link on a switch struggling to process traffic in a timely manner you could still see drops with QoS in place if it can't process the traffic in the queue.

Also as @pulukas already pointed out; if you are applying QoS it should be applied across the entire path.