Quality of Service on Palo Alto Firewall
1. The process of classification
Anyone who has prior experience of Modular QoS CLI (MQC) on Cisco IOS will know that you first classify traffic that needs to be prioritized against other types of traffic.
Similar logic is applied while configuring QoS on Palo Alto firewall.
The first step towards configuring QoS on Palo Alto firewall is to classify the traffic.
Palo Alto allows you to classify traffic based on several parameters like:
- Source zone
- Source IP/subnet
- Source user
- Destination zone
- Destination IP/subnet
- TCP/UDP service
- URL category
You identify the traffic that needs preferential treatment and assign it to a class.
On Palo Alto firewall, you have 8 classes of traffic; so your traffic will eventually fall in one of the eight classes.
Also in this step, you are able to leverage App ID and User ID features of Palo Alto to classify traffic.
2. Create a QoS Profile
Let us say that you have classified youtube traffic into class1
When you create a QoS profile for youtube traffic, you can set:
There are four configurable priorities – real time, high, medium and low
Real time being most important.
b. Egress Max
Maximum bandwidth to be set for this class.
Traffic beyond this rate will be dropped. This is similar to policer mechanism in Cisco IOS.
c. Egress Guaranteed
Amount of bandwidth which is guaranteed at all times.
In below example, you are setting 6 Mbps maximum bandwidth for youtube traffic and also giving youtube traffic guaranteed bandwidth of 3 Mbps
3. Apply the QoS profile on physical interface.
Here you simply apply the QoS profile created in Step 2 above to a physical interface.
To ensure that your configuration is indeed working, you need to navigate to
Network – QoS – Statistics
Where you will be able to verify your configuration.