Rate Limit Per user on PA200.

[inderjit21]

I have PA200 runing PANOS-7.0.6 . Is it possible to rate limit per user. One of the user downloaded 4x1gb files and caused net congestion for other users.

[reaper]

yes it is, you can either create a QoS policy per user or per group, but usually it's better to create QoS policies based on applications or application groups as there are only 8 QoS classes available , else your QoS policy will become increasingly complex

[tsrivastav]

For limiting download 

--------------------------------

Apply QOS on you Lan interface ( which will be the  egress port  for  download traffic ) use a class to limit band width ( dont use class 4 )

Note if you are using clear text tab make sure the source interface will be your wan interface if you are limiting download

 

Write QOS policy according to your need per user / per subnet / per group as shown in above comment.

[inderjit21]

I have setup qos profile with a class2 medium with max bandwidth of 7mb. I have associated this class with webbrowsing app and set it for a user. I can do speedtest and speed is capped at 7mb. But it seems it doesn't work per user. If i log in as a different user speed still gets capped. These are local users on the firewall and I use captive portal before user can start browsing. So i logged in as  a user,clear user-ip-mapping logged in as another user for this scenario.

[reaper]

QoS is designed to limit/guarantee bandwidth per group of applications so that, for example, web browsing cannnot consume more bandwidth and guarantee bandwidth for VoIP

these limits and guarantees are controlled by the class an application/zone is in, all resources in a class are shared within that class

eg. class 8 has a limit of 10mbit: 1 single session will be able to hit 10mbit, 2 sessions will average out at about 5mbit, 20 sessions will have 500kbps

if you change this behavior to match users, you will need to make sure every user has their own class, so they don't need to share bandwidth or restrictions

in your scenario, you will also need to clear all sessions, DP-user-mappings and MP-user-mappings, because you're originating from the same source ip

> clear session all 
> clear user-cache all
> clear user-cache-mp all