topic Re: Qos question in General Topics

Qos question

simsim — Wed, 12 Aug 2020 11:16:15 GMT

Hi,

I have traffic shaping enabled on FG and at the same time PA also.

traffic flow is as below

client goes through FG then PA then go to internet or wan

traffic shaping policy running on fortigate , and qos policy is there on PA also

Let's say if i set bandwidth for client A ON fortigate 10 Mbps and 20 Mbps on PA , Speedtest Showing 10 Mbps

My expectation is client should get 20 Mbps

PA in vwire mode (qos enabled on LAn interface )

What could be the reason , How can I solve the issue

Thanks

Re: Qos question

Remo — Wed, 12 Aug 2020 13:06:55 GMT

hi @simsim

I don't see an issue here. I sounds like everything works as it is configured. To "solve" the issue you need to configure the fortinet also to 20 mbps.

Re: Qos question

kiwi — Wed, 12 Aug 2020 13:54:37 GMT

Hi @simsim ,

Agreed with @Remo .

If you throttle one side of a pipe you can't expect a bigger throughput on the other side.

Cheers,

-Kiwi.

Re: Qos question

simsim — Wed, 12 Aug 2020 15:05:41 GMT

Hi,

Let's say if i set bandwidth for client A ON fortigate 10 Mbps and 20 Mbps on PA , Speedtest Showing 10 Mbps

My expectation is client should get 20 Mbps"

My question is PALO ALTO won't override the QOS value set by the fortigate ?

Thanks

Re: Qos question

simsim — Wed, 12 Aug 2020 15:12:10 GMT

Hi @kiwi

What if it is the other way around ?

Let's say on FORTIGATE if I set 20Mbps and on PA set 10Mbps ?

Shall the client get 20 Mbps ?

Thanks

Re: Qos question

kiwi — Wed, 12 Aug 2020 15:25:10 GMT

Hi @simsim ,

No, in that scenario the bottleneck will be the Palo Alto Device. Your device will have 20Mbps through the Fortigate but once you reach the PA you will get 10Mbps.

In your first scenario you will have 10Mbps through the Fortigate to begin with ... the PA can't make 20Mbps out of the 10Mbps it's getting from the Fortigate.

If the devices are inline then the device with the most restricted speed will be the maximum speed for that pipe.

Cheers,

Kiwi.

Re: Qos question

simsim — Wed, 12 Aug 2020 16:59:34 GMT

Hi,

"If the devices are inline then the device with the most restricted speed will be the maximum speed for that pipe. "

Why palo alto not overriding the qos value which is set by fortigate in this scenario

Thanks

Re: Qos question

RamprakashRT — Wed, 12 Aug 2020 17:03:56 GMT

Hi @simsim

No , Paloalto cannot override the QOS tweak done by fortinet. In this scenario it would be better to maintain QOS policies in only a single device ( FG or PA).

Thanks,

Ram

Re: Qos question

simsim — Wed, 12 Aug 2020 17:11:39 GMT

Hi,

Paloalto cannot override the QOS tweak done by fortinet

Any reason for that paloalto cannot overwrite /override .

Or all the network devices behavior is same (eg : cisco router )

Thanks

Re: Qos question

RamprakashRT — Wed, 12 Aug 2020 17:22:26 GMT

HI @simsim ,

Assume we have ISP of 10 mbps , can we get 20 mbps using any device . The answer is certainly "NO". in such a way pa is receiving only 10 mbps so it cant be increased . Any device cannot increase the bandwidth more than it recieved.

Hope it helps

Thanks,

Ram

Re: Qos question

simsim — Thu, 13 Aug 2020 06:04:11 GMT

Hi @RamprakashRT

What if it is the other way around , If fg set 20 Mbps and policy is for the device is 10Mbps

just for final clarification

Thanks

Re: Qos question

Remo — Thu, 13 Aug 2020 06:16:55 GMT

Hi @simsim

What exactly do you mean with "policy for the device is set to 10mbps"?

But for such situations @kiwi already wrote it perfectly: "If the devices are inline then the device with the most restricted speed will be the maximum speed for that pipe."

Re: Qos question

simsim — Thu, 13 Aug 2020 07:10:00 GMT

Hi @Remo

What exactly do you mean with "policy for the device is set to 10mbps"?

I mean in the policy the bandwidth is set to 10Mbps for a host .

Thanks

Re: Qos question

Remo — Thu, 13 Aug 2020 07:58:49 GMT

Hi @simsim

In this case the single host will have a max. bandwidth of 10mbps and the others should get 20mbps. But it also depends if there is a priorization set on the traffic. If everything has the same priority and then th single host already consumes 10mbps, then for another host with is not limited specially, it will also get 10mbps so that you have in total the 20mbps.