topic Limit bandwith in untrust interface in General Topics

Limit bandwith in untrust interface

soporteseguridad — Tue, 23 Jan 2018 10:57:08 GMT

Hi,

I need to limit the bandwith in untrust interface. We replicate DB info to the Oracle cloud and we want to limit this traffic. We have 100Mbps bandwith, and we want to limit the Oracle cloud traffic 50Mbps max.

So this is what i configured:

Profile QoS: all the classes with 50Mbps max egress.

QoS config

eth1/1 is our untrust interface (100Mbps line)

tunnel interface, the profile was created before.

In "tunneled traffic" we add the tunnel for Oracle Cloud (tunnel.6) and the QoS profile.

Is that correct???

Going to statistics we dont see any number in runtime BW in tunnel???? not tunnel 6.... any idea??

Re: Limit bandwith in untrust interface

OtakarKlier — Tue, 23 Jan 2018 19:57:56 GMT

Hello,

Enable the QoS profile you have on your Trust interface that is on same side as the Oracle server, i.e. inbound interface. Also do you have your QoS policy set? I didnt see it in the screen shots you provided, Policies->QoS.

https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-Quality-of-Service/ta-p/68633

Regards,

Re: Limit bandwith in untrust interface

soporteseguridad — Wed, 24 Jan 2018 11:13:31 GMT

We need to control "Untrust" interface, because we are running backup in the ORACLE CLOUD. Not in our LAN. So we need to limit outbound interface to Oracle cloud. To connect with Oracle cloud we use a tunnel IPSEC. IS that above config correct?

I think its not necessary QoS policies to perform a limit in bandwith , right???

Qos policies is necessary is you want to classify any kind of traffic

Re: Limit bandwith in untrust interface

BPry — Wed, 24 Jan 2018 15:36:03 GMT

@soporteseguridad,

QoS is how you rate limit traffic on a Palo Alto device. The QoS policy would map traffic destined to Oracle Cloud to a certain class; this class would then be configured with an Egress Max to limit that specific class to 50 instead of allowing it class flow through the generic class 4.

Re: Limit bandwith in untrust interface

soporteseguridad — Wed, 24 Jan 2018 16:31:39 GMT

Yes, but i only want con limit the BW for this tunnel to 50Mb (all the classes). I understand i dont need to use any policy QoS.

right?

Re: Limit bandwith in untrust interface

OtakarKlier — Wed, 24 Jan 2018 16:57:59 GMT

Hello,

Yes the policy is what sets the limits on the traffic you have defined in the other QoS settings. It can be very granular, i.e. specific server to specific destination, etc.

Regards,