QoS Examples

The following examples show how Prisma Access marks and shapes traffic.

In the following example, the administrator created a security policy on the Mobile_User_Device_Group to mark incoming mobile user traffic. These policies assign traffic an IP precedence value of AF11.

The administrator also created QoS profiles with QoS policy rules, enabled QoS on the service connection and remote network connection, and applied the profiles to those connections to shape the traffic at the traffic’s egress point based on the QoS markings.

Prisma Access marks traffic at its ingress point based on security policies or honors marking set by your on-premises devices, and shapes the traffic on egress to your service connections or remote network connections using QoS profiles.

The following example shows the QoS traffic flow from a branch office to an HQ/data center. The administrator creates a security policy on the

Remote_Network_Device_Group

to mark the incoming traffic from the remote network connection and enabled QoS and applied a QoS profile on the service connection to shape the outgoing traffic.

The following example shows a hybrid deployment with an on-premises firewall at a branch that is connected by Prisma Access with a remote network connection, and the on-premises firewall marks the traffic. This deployment honors the marking set on the on-premises firewall. You must enable QoS and apply a QoS profile on the service connection, so that Prisma Access can shape the traffic at egress.

Prisma Access honors all DSCP marking from the on-premises device as long as that traffic does not match an overriding security policy on Prisma Access.

The following example shows a Clean Pipe configuration that shapes on ingress (from the internet to Clean Pipe side). See Configure Quality of Service for Clean Pipe for configuration details.

Configure QoS in Prisma Access

Add one or more security policy rules for remote networks and mobile users to mark the ingress traffic for QoS.

You use these policies to match a traffic flow and assign it a selected DSCP value.

Select

Policies

Security

Pre Rules

.

Alternatively, select

Policies

Security

Post Rules

to add a rule at the bottom of the rule order that is evaluated after a pre-rule.

Be sure that you select the correct

Device Group

. To create a security rule for a remote network, select the device group for the remote network (for example,

Remote_Network_Device_Group

); for mobile users, select the device group for the mobile users (for example,

Mobile_User_Device_Group

).

Add

a security policy rule.

Enter a

Name

for the rule.

Define the matching criteria for the source or destination fields in the packet.

See Create a Security Policy Rule for details.

Click

Actions

, then select a

QoS Marking

of either

IP DSCP

or

IP Precedence

.

Enter the QoS value in binary form, or select the value from the drop-down.

The following screenshot shows a security policy rule that matches traffic marked with an

IP DSCP

value of

af11

.



Add one or more QoS policy rules.

You use QoS policies to bind DSCP marking to one of eight available classes. You use these classes later when you create one or more QoS profiles.

Select

Policies

QoS

Pre Rules

.

Alternatively, select

Policies

QoS

Post Rules

to add a rule at the bottom of the rule order that is evaluated after a pre-rule.

Be sure that you select the correct

Device Group

for the service connection (for example,

Service_Conn_Device_Group

) or remote network connection (for example,

Remote_Network_Device_Group

). If a rule in a Shared device group has defined values other than the values in the

General

,

DSCP/ToS

, and

Other

settings areas, Prisma Access does not apply the rule on the remote network and service connection.

Add

a QoS policy rule.

Click

General

and enter a name for the policy rule.

Click the

DSCP/ToS

tab, then click

Codepoints

and

Add

one or more new codepoints.

For Clean Pipe deployments, you can specify additional QoS settings in policy, such as source, destination, or application.

Specify a

Name

for the DSCP/ToS rule, then select a

Type

and

Codepoint

.



Alternatively, keep the default value (

Any

) to allow the policy to match to traffic regardless of the Differentiated Services Code Point (DSCP) value or the IP Precedence/Type of Service (ToS) defined for the traffic.

Click the

Other Settings

tab, then Choose the QoS

Class

to assign to the rule.

You define class characteristics in the QoS profile.

Click

OK

.



Create one or more QoS profiles to shape QoS traffic on egress for service connections and remote network connections.

You use profiles to shape the traffic at egress point by defining QoS classes and assigning a bandwidth to them. You must select either an existing QoS profile or create a new QoS profile when you enable QoS for Prisma Access.

Select the correct template the profile you want to create (
Remote_Network_Template
or
Service_Conn_Template
); then, select
Network
Network Profiles
QoS Profile
and
Add
a profile.
Enter a profile
Name
.
Set the overall bandwidth limits for the QoS profile rule.
Enter an
Egress Max
that represents the maximum throughput (in Mbps) for traffic leaving the service connection or remote network connection.
For service connections, specify a number of up to 1 Gpbs (1,000 Mbps).
Do not enter a number greater than 1 Gbps; Prisma Access calculates service connection bandwidth per service connection IPSec tunnel and not cumulatively across multiple tunnels.
For remote network connections, enter a value of
0
.
Enter an
Egress Guaranteed
value. bandwidth that is the guaranteed bandwidth for this profile (in Mbps).
For service connections, enter an
Egress Guaranteed
bandwidth that is the guaranteed bandwidth for this profile (in Mbps).
Any traffic that exceeds the Egress Guaranteed value is best effort and not guaranteed. Bandwidth that is guaranteed but is unused continues to remain available for all traffic.
For remote network connections, enter a value of
0
.
In the Classes section,
Add
one or more classes and specify how to mark up to eight individual QoS classes.
Select the
Priority
for the class (either
real-time
,
high
,
medium
, or
low
).
Enter the
Egress Max
for traffic assigned to each QoS class you create.
For bandwidth-based QoS profiles (used by service connections or remote networks that allocate bandwidth by location), enter a value in Mbps. The Egress Max for a QoS class must be less than or equal to the Egress Max for the QoS profile.
Enter the
Egress Guaranteed
percentage or bandwidth in Mbps for each QoS class. For QoS profiles for remote networks, enter a percentage.
Guaranteed bandwidth assigned to a class is not reserved for that class—bandwidth that is unused continues to remain available to all traffic. When a class of traffic exceeds the egress guaranteed bandwidth, Prisma Access passes that traffic on a best-effort basis.
Enter a
Class Bandwidth Type
for the profile.

Click
OK
.

(

Service Connections Only

) Enable QoS for the service connection and apply the QoS profile to the connection.

Enable QoS by selecting
Panorama
Cloud Services
Configuration
Service Setup
, selecting a
Connection Name
, clicking the
QoS
tab; then
Enable
QoS.
If you allocate your remote network bandwidth by location instead of by compute location, configure QoS in the same way as you do service connections. Select
Panorama
Cloud Services
Configuration
Remote Networks
, select the hypertext for a remote network connection
Name
, click the
QoS
tab, and
Enable
QoS.
Select a QoS profile and click
OK
.



Check the QoS status.

Select

Panorama

Cloud Services

Status

Monitor

Service Connection

or

Panorama

Cloud Services

Status

Monitor

Remote Networks

, then

Monitor

the

Statistics

.

Click

QoS

to view a page with QoS statistics.



This page displays a chart with real-time and historical QoS statistics, including the number of dropped packets per class. This chart displays only for service connections or remote network connections that have QoS enabled, shows the last five minutes of the connection’s network activity, and refreshes every 10 seconds.

The following figure shows traffic being passed for classes 1,2,3, and 4. The data below the figure shows the number of packets dropped based on the QoS configuration for classes 2, 3, and 4.