Configure QoS
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
-
- Cloud Management of NGFWs
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
- PAN-OS 9.1 (EoL)
-
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
-
-
-
- Cloud Management and AIOps for NGFW
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1
- PAN-OS 11.2
- PAN-OS 8.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 9.1 (EoL)
Configure QoS
Follow these steps to configure Quality of
Service (QoS), which includes creating a QoS profile, creating a
QoS policy, and enabling QoS on an interface.
Before you create
a QoS policy rule, make sure you understand that the set of IPv4
addresses is treated as a subset of the set of IPv6 addresses, as
described in detail in Policy.
- Identify the traffic you want to manage with QoS.This example shows how to use QoS to limit web browsing.SelectACCto view theApplication Command Centerpage. Use the settings and charts on theACCpage to view trends and traffic related to Applications, URL filtering, Threat Prevention, Data Filtering, and HIP Matches.Click any application name to display detailed application information.
- Identify the egress interface for applications that you want to receive QoS treatment.The egress interface for traffic depends on the traffic flow. If you are shaping incoming traffic, the egress interface is the internal-facing interface. If you are shaping outgoing traffic, the egress interface is the external-facing interface.Selectto view the Traffic logs.MonitorLogsTrafficTo filter and only show logs for a specific application:
- If an entry is displayed for the application, click the underlined link in the Application column then click the Submit icon.
- If an entry is not displayed for the application, click the Add Log icon and search for the application.
TheEgress I/Fin the traffic logs displays each application’s egress interface. To display theEgress I/Fcolumn if it is not displayed by default:- Click any column header to add a column to the log:
- Click the spyglass icon to the left of any entry to display a detailed log that includes the application’s egress interface listed in the Destination section:
- Add a QoS policy rule.A QoS policy rule defines the traffic to receive QoS treatment. The firewall assigns a QoS class of service to the traffic matched to the policy rule.Because QoS is enforced on traffic as it egresses the firewall, your QoS policy rule is applied to traffic after the firewall has enforced all other security policy rules, including Network Address Translation (NAT) rules. If you want to apply QoS treatment to traffic based on source, you must specify the pre-NAT source address (such as pre-NAT source IP, pre-NAT source zone, pre-NAT destination IP, and post-NAT destination zone) in a QoS policy rule. Do not configure the QoS policy with the post-NAT source address if you want to apply QoS treatment for the source traffic.
- SelectandPoliciesQoSAdda new policy rule.
- On theGeneraltab, give the QoS Policy Rule a descriptiveName.
- Specify traffic to receive QoS treatment based onSource,Destination,Application,Service/URL Category, andDSCP/ToSvalues (theDSCP/ToSsettings allow you to Enforce QoS Based on DSCP Classification).For example, select theApplication, clickAdd, and selectweb-browsingto apply QoS to web browsing traffic.
- (Optional) Continue to define additional parameters. For example, selectSourceandAddaSource Userto provide QoS for a specific user’s web traffic.
- SelectOther Settingsand assign aQoS Classto traffic matching the policy rule. For example, assign Class 2 to the user1’s web traffic.
- ClickOK.
- Add a QoS profile.A QoS profile allows you to define the eight classes of service that traffic can receive, including priority, and enables QoS Bandwidth Management.You can edit any existing QoS profile, including the default, by clicking the QoS profile name.
- SelectandNetworkNetwork ProfilesQoS ProfileAdda new profile.
- Enter a descriptiveProfile Name.
- Set the overall bandwidth limits for the QoS profile:
- Enter anEgress Maxvalue to set the overall bandwidth allocation for the QoS profile.
- Enter anEgress Guaranteedvalue to set the guaranteed bandwidth for the QoS Profile.
Any traffic that exceeds the Egress Guaranteed value is best effort and not guaranteed. Bandwidth that is guaranteed but is unused continues to remain available for all traffic.You can configure theEgress GuaranteedandEgress Maxvalues in Mbps or percentages. The following considerations should be taken into account when configuring these values in percentages:- TheEgress Guaranteed(%) per class is calculated using theEgress Maxvalue, not theEgress Guaranteedvalue.
- ProfileEgress Guaranteedequals the sum of theEgress Guaranteed(%) per class multiplied by theEgress Max.
For example: TheEgress Maxis configured as 100Mbps. The guaranteed percentage configured for Class 1 is 30%, for Class 2 it is 20%, for Class 3 it is 5%, and for Class 4 it is 1%. This configuration results in a total percentage guaranteed as 56%. In this case, profileEgress Guaranteedis 56Mbps (56% xEgress Max). This also means that Class 1Egress Guaranteedis 30Mbps, Class 2Egress Guaranteedis 20Mbps, and so on. - In the Classes section, specify how to treat up to eight individual QoS classes:
- Adda class to the QoS Profile.
- Select thePriorityfor the class: real-time, high, medium, or low.
- Enter theEgress MaxandEgress Guaranteedbandwidth for traffic assigned to each QoS class.
- ClickOK.
In the following example, the QoS profile Limit Web Browsing limits Class 2 traffic to a maximum bandwidth of 50Mbps and a guaranteed bandwidth of 2Mbps. - Enable QoS on a physical interface.Part of this step includes the option to select clear text and tunneled traffic for unique QoS treatment.Check if the firewall model you’re using supports enabling QoS on a subinterface by reviewing a summary of the Product Specifications.
- SelectandNetworkQoSAdda QoS interface.
- SelectPhysical Interfaceand choose theInterface Nameof the interface on which to enable QoS.In the example, Ethernet 1/1 is the egress interface for web-browsing traffic (see Step 2).
- Set theEgress Maxbandwidth for all traffic exiting this interface.It is a best practice to always define the Egress Max value for a QoS interface. Ensure that the cumulative guaranteed bandwidth for the QoS profile attached to the interface does not exceed the total bandwidth allocated to the interface.
- SelectTurn on QoS feature on this interface.
- In the Default Profile section, select a QoS profile to apply to allClear Texttraffic exiting the physical interface.
- (Optional) Select a default QoS profile to apply to all tunneled traffic exiting the interface.
For example, enable QoS on ethernet 1/1 and apply the bandwidth and priority settings you defined for the QoS profile Limit Web Browsing (Step 4) to be used as the default settings for clear text egress traffic.- (Optional) Continue to define more granular settings to provide QoS for Clear Text and Tunneled Traffic. Settings configured on theClear Text Traffictab and theTunneled Traffictab automatically override the default profile settings for clear text and tunneled traffic on the Physical Interface tab.
- SelectClear Text Trafficand:
- Set theEgress GuaranteedandEgress Maxbandwidths for clear text traffic.
- ClickAddand apply a QoS profile to enforce clear text traffic based on source interface and source subnet.(PA-3200 Series, PA-5200 Series, PA-5450 firewall, and PA-7000 Series only) You must also select a destination interface when configuring a QoS policy rule if the rule is applied to a specific subinterface.
- SelectTunneled Trafficand:
- Set theEgress GuaranteedandEgress Maxbandwidths for tunneled traffic.
- ClickAddand attach a QoS profile to a single tunnel interface.
- ClickOK.
- Commit your changes.ClickCommit.
- Verify a QoS configuration.Selectand thenNetworkQoSStatisticsto view QoS bandwidth, active sessions of a selected QoS class, and active applications for the selected QoS class.For example, see the statistics for ethernet 1/3 with QoS enabled:Class 2 traffic limited to 2.343 Mbps of guaranteed bandwidth and a maximum bandwidth of 51.093 Mbps.Continue to click the tabs to display further information regarding applications, source users, destination users, security rules and QoS rules.Bandwidth limits shown on theQoS Statisticswindow include a hardware adjustment factor.