topic Re: How to apply QOS on the Incoming traffic from Tunnel interface ? in General Topics

How to apply QOS on the Incoming traffic from Tunnel interface ?

MohammedAsik — Tue, 18 Jun 2019 10:24:21 GMT

Hi Team,

How to apply QOS on VPN tunnel ingress interface ? Please helps us

Regards

Mohammed Asik

Re: How to apply QOS on the Incoming traffic from Tunnel interface ?

OtakarKlier — Tue, 18 Jun 2019 14:23:47 GMT

Hello,

QoS is only applied to the egress interface.

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/quality-of-service/configure-qos.html

Just create your QoS profiles and policies and apply them to the egress traffic interfaces.

Regards,

Re: How to apply QOS on the Incoming traffic from Tunnel interface ?

MohammedAsik — Wed, 19 Jun 2019 07:55:39 GMT

Hi Otakar,

Thanks for your replying on my query. Still i do have some more queries on this regards, while i am surfing some of the notes related for applying QOS Traffic i found that we can able to restrict the traffic seperately on both Uploading and Downloading traffic based on the traffic flows in the Firewall.

In the mentioned link i can understand that, We are able to apply the QOS for both Uploading and Downloading Traffic.

(Link: https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/quality-of-service/qos-egress-interface)

I do agree on your point that, QOS is only applicable for the Egress Traffic. So it means the traffic which is sending away from each port in the firewall.

In my scenario, we are having 22 s2s vpn tuunels which is destinated in my wan interface.

we have configured the bandwidth restriction of 2MB on wan interface and egress traffic is woking as expected.

My concern is, I want to restrict the tunnel traffic as 2MB which is enter through ? Is it possible ?

If possible how can we achieve this ? Please suggest us..

Thanking you in advance ..

Regards

Mohammed Asik

Re: How to apply QOS on the Incoming traffic from Tunnel interface ?

OtakarKlier — Wed, 19 Jun 2019 14:27:40 GMT

Hello,

Yes but the QoS policy has to be applied to the egress interface.

Regards,

Re: How to apply QOS on the Incoming traffic from Tunnel interface ?

MohammedAsik — Thu, 20 Jun 2019 08:16:50 GMT

Hi otakar

Yes i agree with your point.

In my environment LAN interface is the egress interface. I have binded the 10 sub-interfaces in LAN interface

If i apply QOS on LAN interface, will it apply on the all sub-interface ?

If yes, How can i apply QOS profile in my lan interface alone ?

Regards

Mohammed Asik

Re: How to apply QOS on the Incoming traffic from Tunnel interface ?

fatboy1607 — Sun, 07 Jun 2020 20:01:27 GMT

To apply qos for incoming traffic from IPSEC tunnel you need to create appropriate QOS profile and apply it on eth1/1 ( untrust ) interface under tunneled traffic , select appropriate tunnel interface and QOS Profile.

Screenshot shown below.