Rate Limit Per user on PA200.

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L3 Networker

Rate Limit Per user on PA200.

I have PA200 runing PANOS-7.0.6 . Is it possible to rate limit per user. One of the user downloaded 4x1gb files and caused net congestion for other users.

Highlighted
L7 Applicator

yes it is, you can either create a QoS policy per user or per group, but usually it's better to create QoS policies based on applications or application groups as there are only 8 QoS classes available , else your QoS policy will become increasingly complex

 

2016-07-19_10-39-31.jpg

Tom Piens - PANgurus.com
New to PAN-OS or getting ready to take the PCNSE? check out amazon.com/dp/1789956374
Highlighted
L3 Networker

Pic2.PNG

For limiting download 

--------------------------------

 

Apply QOS on you Lan interface ( which will be the  egress port  for  download traffic ) use a class to limit band width ( dont use class 4 )

Note if you are using clear text tab make sure the source interface will be your wan interface if you are limiting download

 daaaa.PNG

 

 

Write QOS policy according to your need per user / per subnet / per group as shown in above comment.

 

 

 

Highlighted
L3 Networker

I have setup qos profile with a class2 medium with max bandwidth of 7mb. I have associated this class with webbrowsing app and set it for a user. I can do speedtest and speed is capped at 7mb. But it seems it doesn't work per user. If i log in as a different user speed still gets capped. These are local users on the firewall and I use captive portal before user can start browsing. So i logged in as  a user,clear user-ip-mapping logged in as another user for this scenario.

Highlighted
L7 Applicator

QoS is designed to limit/guarantee bandwidth per group of applications so that, for example, web browsing cannnot consume more bandwidth and guarantee bandwidth for VoIP

these limits and guarantees are controlled by the class an application/zone is in, all resources in a class are shared within that class

 

eg. class 8 has a limit of 10mbit: 1 single session will be able to hit 10mbit, 2 sessions will average out at about 5mbit, 20 sessions will have 500kbps

 

if you change this behavior to match users, you will need to make sure every user has their own class, so they don't need to share bandwidth or restrictions

 

 

in your scenario, you will also need to clear all sessions, DP-user-mappings and MP-user-mappings, because you're originating from the same source ip

 

> clear session all 
> clear user-cache all
> clear user-cache-mp all
Tom Piens - PANgurus.com
New to PAN-OS or getting ready to take the PCNSE? check out amazon.com/dp/1789956374
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!