Applying QOS bandwidth restriction

[Ahmed_94]

Hi,

I would like to understand if my FW is capable of the below using QOS:

- I am using PA-1410 in HA pair

- I have 1 ISP internet link with 50Mbps bandwidth connected to eth1/1

- I have a requirement to create a guest network using the same ISP link and assign 10Mbps out of 50Mbps.

So. using the same outside interface (eth1/1) I want to reserve 10Mbps only for a sub-interface dedicated to guest network. Is that doable with Qos?

Many thanks 

[JayGolf]

Hi @Ahmed_94 ,

You won’t be able to apply QoS directly on a subinterface on the PA-1410, but you can classify the guest VLAN traffic on the physical interface (eth1/1) and put it into a lower-priority or max-bandwidth QoS class. This won’t guarantee a strict 10 Mbps slice, but it will prevent the guest VLAN from saturating your 50 Mbps link.

[PavelK]

Hello @Ahmed_94

only to add to what Jay mentioned, this KB: Why is QoS Setting Not Available Under subinterface? explains what Firewall models are supporting QoS in sub-interface.

Kind Regards

Pavel

[Ahmed_94]

Hi Jay, thank you for your response.

Just want to clarify what you meant by "put it into a lower-priority or max-bandwidth QoS class", so in the default profile I assign a low-priority class like 6 and also assign the max bandwidth allowed as 10Mbps, as below. is that what you meant?

And then in the policy I put the guest vlan into class 6 and the profile assigned to interface eth1/1.

Thanks

[Raido_Rattameister]

QoS profile needs to be applied to egress interface.

If you apply it to eth1/1 then you effectively throttle/prioritize upload bandwidth and not download.

Assign profile to internal interface.

With policy assign guest traffic to a specific class.

In QoS profile give this class 10Mbit/s.