Rate Limit Per user on PA200.
Showing results for 
Search instead for 
Did you mean: 

Rate Limit Per user on PA200.

L3 Networker

I have PA200 runing PANOS-7.0.6 . Is it possible to rate limit per user. One of the user downloaded 4x1gb files and caused net congestion for other users.


L7 Applicator

yes it is, you can either create a QoS policy per user or per group, but usually it's better to create QoS policies based on applications or application groups as there are only 8 QoS classes available , else your QoS policy will become increasingly complex



Tom Piens
Like my answer? check out my book! https://bit.ly/MasteringPAN


For limiting download 



Apply QOS on you Lan interface ( which will be the  egress port  for  download traffic ) use a class to limit band width ( dont use class 4 )

Note if you are using clear text tab make sure the source interface will be your wan interface if you are limiting download




Write QOS policy according to your need per user / per subnet / per group as shown in above comment.




I have setup qos profile with a class2 medium with max bandwidth of 7mb. I have associated this class with webbrowsing app and set it for a user. I can do speedtest and speed is capped at 7mb. But it seems it doesn't work per user. If i log in as a different user speed still gets capped. These are local users on the firewall and I use captive portal before user can start browsing. So i logged in as  a user,clear user-ip-mapping logged in as another user for this scenario.

QoS is designed to limit/guarantee bandwidth per group of applications so that, for example, web browsing cannnot consume more bandwidth and guarantee bandwidth for VoIP

these limits and guarantees are controlled by the class an application/zone is in, all resources in a class are shared within that class


eg. class 8 has a limit of 10mbit: 1 single session will be able to hit 10mbit, 2 sessions will average out at about 5mbit, 20 sessions will have 500kbps


if you change this behavior to match users, you will need to make sure every user has their own class, so they don't need to share bandwidth or restrictions



in your scenario, you will also need to clear all sessions, DP-user-mappings and MP-user-mappings, because you're originating from the same source ip


> clear session all 
> clear user-cache all
> clear user-cache-mp all
Tom Piens
Like my answer? check out my book! https://bit.ly/MasteringPAN
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!