traffic shaping/qos on palo alto

[Jatin.Singh]

Hi,

We have 400/400 up and down mbps connection, your ISP does not shape the traffic and have asked us to shape it.

Applying qos on the outside interface both ways, how would we achieve it?

if I only set the egress then i am only setting the speed for outbound traffic not inbound.

Also if I do QOS rules is this going to also QOS the Palo Alto VPN ? as the rules will only be applied to traffic crossing the firewall it wont see the VPN tunnels made by the clients being added to the bandwidth load on this interface as its not crossing the firewall to hit the QOS rules ??

pan - os 9.0.4

[Yasasreeram-Cheedella · Accepted solution]

Hi Jatin,

QoS is always applied on the egress interface.

1. To limit upload, a QoS profile needs to be enabled on the untrust interface

2. To limit download, a QoS profile needs to be enabled on the trust interface.

3. In your case, to limit both download & upload traffic, QoS will have to be applied on both interfaces.

4. QoS Can also be applied to tunneled interfaces, please refer to https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEfCAK

Hope this helps,

Regards,

Ram