Any way to throttle MS Updates

[palomed]

All of our instant clones decided to update this morning and it's killing my Internet pipe. 

Is there a way I could limit the amount of bandwidth us for MS Update? Something 

fast and easy?

[PavelK · Accepted solution]

Thank you for post @palomed

you can do it with QoS. Here is corresponding KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClS0CAK

In summary, you can create an QoS Profile applied to "Trust" interface where you specify one class with "Egress Max Bandwidth" you want to limit windows update traffic to, then under: Policies > QoS you add a new policy, associate this policy with class and under application you can add: "ms-update".

Once you complete the above configuration, only new sessions will match QoS policy. For existing sessions you will have to terminate them first.

Kind Regards

Pavel

[LAYER_8]

Enabling session rematching might allow for the sessions not needing to be killed for policy changes to take effect. 

[PavelK]

Thank you for comment @LAYER_8

The "Rematch Sessions" is enabled by default and in my own personal experience it did not take an effect for QoS policy. Based on my research, this feature only works for security policies.

Kind Regards

Pavel