I have PA200 runing PANOS-7.0.6 . Is it possible to rate limit per user. One of the user downloaded 4x1gb files and caused net congestion for other users.
yes it is, you can either create a QoS policy per user or per group, but usually it's better to create QoS policies based on applications or application groups as there are only 8 QoS classes available , else your QoS policy will become increasingly complex
For limiting download
Apply QOS on you Lan interface ( which will be the egress port for download traffic ) use a class to limit band width ( dont use class 4 )
Note if you are using clear text tab make sure the source interface will be your wan interface if you are limiting download
Write QOS policy according to your need per user / per subnet / per group as shown in above comment.
I have setup qos profile with a class2 medium with max bandwidth of 7mb. I have associated this class with webbrowsing app and set it for a user. I can do speedtest and speed is capped at 7mb. But it seems it doesn't work per user. If i log in as a different user speed still gets capped. These are local users on the firewall and I use captive portal before user can start browsing. So i logged in as a user,clear user-ip-mapping logged in as another user for this scenario.
QoS is designed to limit/guarantee bandwidth per group of applications so that, for example, web browsing cannnot consume more bandwidth and guarantee bandwidth for VoIP
these limits and guarantees are controlled by the class an application/zone is in, all resources in a class are shared within that class
eg. class 8 has a limit of 10mbit: 1 single session will be able to hit 10mbit, 2 sessions will average out at about 5mbit, 20 sessions will have 500kbps
if you change this behavior to match users, you will need to make sure every user has their own class, so they don't need to share bandwidth or restrictions
in your scenario, you will also need to clear all sessions, DP-user-mappings and MP-user-mappings, because you're originating from the same source ip
> clear session all > clear user-cache all > clear user-cache-mp all
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!