topic Re: QoS on Tagged VLAN Sub-interface - PAN5250 in General Topics

QoS on Tagged VLAN Sub-interface - PAN5250

josephqiu — Fri, 09 Feb 2018 20:11:12 GMT

Hi, this question may have been asked before, but I'm still curious what the best practice is in my situation. Here's what I need to do: a LAG (port-channel) with two 10gig interfaces is carved into mulitple subinterfaces. I'd like to cap the max bandwidth usage for one of the suninterfaces only. Apprently PAN5250 does not support QoS on subinterfaces. So, the question is: if I apply the QoS policy on LAG (physical interface) by defining the matching criteria (e.g. source/destination zones, or IPs), will the firewall find matching packets by stripping the dot1q tags, and put the tagged packets in the desired queue with bandwidth cap? If it works, would it affect other subinterfaces that I don't want rate-limit at all? Or any best practices in similar case when no subinterface QoS support is available? Any experience or real-world implemetation shared would be greatly appreciated.

Joseph

Re: QoS on Tagged VLAN Sub-interface - PAN5250

OtakarKlier — Fri, 09 Feb 2018 22:07:52 GMT

Hello,

I have a similar setup and I just use source and/or destination IP's/Subnets for what I want to limit. It doesnt seem affect anything that doesnt match the QoS policy.

Hope that helps.

Re: QoS on Tagged VLAN Sub-interface - PAN5250

josephqiu — Fri, 09 Feb 2018 23:09:25 GMT

Thanks. I will give it a try.

Re: QoS on Tagged VLAN Sub-interface - PAN5250

OtakarKlier — Fri, 09 Feb 2018 23:12:39 GMT

Hello,

The difference I have is that I dont have a LAG, but dont think that should make a difference.

Cheers!

Re: QoS on Tagged VLAN Sub-interface - PAN5250

josephqiu — Sat, 10 Feb 2018 00:50:01 GMT

Looks like it doesn't work for me. After the QoS policy is applied on the LAG, regular traffics in other sub-interfaces run through with no problem, but the sub-interface matching the policy stopped to pass any packets. As soon as the QoS policy was disabled, traffic started to flow again. The matching rule was based on source/destination zones, and a max bandwidth was applied. I guess it's probably not supported on LAG or something I didn't do right. Continue digging...

But still, thanks for your replies!