QoS Interface Settings
Table of Contents
Expand all | Collapse all
-
- Objects > Addresses
- Objects > Address Groups
- Objects > Regions
- Objects > Dynamic User Groups
- Objects > Application Groups
- Objects > Application Filters
- Objects > Services
- Objects > Service Groups
- Objects > Devices
- Objects > External Dynamic Lists
- Objects > Custom Objects > Spyware/Vulnerability
- Objects > Custom Objects > URL Category
- Objects > Security Profiles > Antivirus
- Objects > Security Profiles > Anti-Spyware Profile
- Objects > Security Profiles > Vulnerability Protection
- Objects > Security Profiles > File Blocking
- Objects > Security Profiles > WildFire Analysis
- Objects > Security Profiles > Data Filtering
- Objects > Security Profiles > DoS Protection
- Objects > Security Profiles > Mobile Network Protection
- Objects > Security Profiles > SCTP Protection
- Objects > Security Profile Groups
- Objects > Log Forwarding
- Objects > Authentication
- Objects > Decryption > Forwarding Profile
- Objects > Schedules
-
-
- Firewall Interfaces Overview
- Common Building Blocks for Firewall Interfaces
- Common Building Blocks for PA-7000 Series Firewall Interfaces
- Tap Interface
- HA Interface
- Virtual Wire Interface
- Virtual Wire Subinterface
- PA-7000 Series Layer 2 Interface
- PA-7000 Series Layer 2 Subinterface
- PA-7000 Series Layer 3 Interface
- Layer 3 Interface
- Layer 3 Subinterface
- Log Card Interface
- Log Card Subinterface
- Decrypt Mirror Interface
- Aggregate Ethernet (AE) Interface Group
- Aggregate Ethernet (AE) Interface
- Network > Interfaces > VLAN
- Network > Interfaces > Loopback
- Network > Interfaces > Tunnel
- Network > Interfaces > SD-WAN
- Network > VLANs
- Network > Virtual Wires
-
- Network > Network Profiles > GlobalProtect IPSec Crypto
- Network > Network Profiles > IPSec Crypto
- Network > Network Profiles > IKE Crypto
- Network > Network Profiles > Monitor
- Network > Network Profiles > Interface Mgmt
- Network > Network Profiles > QoS
- Network > Network Profiles > LLDP Profile
- Network > Network Profiles > SD-WAN Interface Profile
-
-
- Device > Setup
- Device > Setup > Management
- Device > Setup > Interfaces
- Device > Setup > Telemetry
- Device > Setup > Content-ID
- Device > Setup > WildFire
- Device > Setup > DLP
- Device > Log Forwarding Card
- Device > Config Audit
- Device > Administrators
- Device > Admin Roles
- Device > Access Domain
- Device > Authentication Sequence
- Device > Device Quarantine
-
- Security Policy Match
- QoS Policy Match
- Authentication Policy Match
- Decryption/SSL Policy Match
- NAT Policy Match
- Policy Based Forwarding Policy Match
- DoS Policy Match
- Routing
- Test Wildfire
- Threat Vault
- Ping
- Trace Route
- Log Collector Connectivity
- External Dynamic List
- Update Server
- Test Cloud Logging Service Status
- Test Cloud GP Service Status
- Device > Virtual Systems
- Device > Shared Gateways
- Device > Certificate Management
- Device > Certificate Management > Certificate Profile
- Device > Certificate Management > OCSP Responder
- Device > Certificate Management > SSL/TLS Service Profile
- Device > Certificate Management > SCEP
- Device > Certificate Management > SSL Decryption Exclusion
- Device > Certificate Management > SSH Service Profile
- Device > Response Pages
- Device > Server Profiles
- Device > Server Profiles > SNMP Trap
- Device > Server Profiles > Syslog
- Device > Server Profiles > Email
- Device > Server Profiles > HTTP
- Device > Server Profiles > NetFlow
- Device > Server Profiles > RADIUS
- Device > Server Profiles > TACACS+
- Device > Server Profiles > LDAP
- Device > Server Profiles > Kerberos
- Device > Server Profiles > SAML Identity Provider
- Device > Server Profiles > DNS
- Device > Server Profiles > Multi Factor Authentication
- Device > Local User Database > Users
- Device > Local User Database > User Groups
- Device > Scheduled Log Export
- Device > Software
- Device > Dynamic Updates
- Device > Licenses
- Device > Support
- Device > Policy Recommendation
-
- Network > GlobalProtect > MDM
- Network > GlobalProtect > Clientless Apps
- Network > GlobalProtect > Clientless App Groups
- Objects > GlobalProtect > HIP Profiles
-
- Use the Panorama Web Interface
- Context Switch
- Panorama Commit Operations
- Defining Policies on Panorama
- Log Storage Partitions for a Panorama Virtual Appliance in Legacy Mode
- Panorama > Setup > Interfaces
- Panorama > High Availability
- Panorama > Administrators
- Panorama > Admin Roles
- Panorama > Access Domains
- Panorama > Device Groups
- Panorama > Plugins
- Panorama > Log Ingestion Profile
- Panorama > Log Settings
- Panorama > Server Profiles > SCP
- Panorama > Scheduled Config Export
End-of-Life (EoL)
QoS Interface Settings
Enable QoS on an interface to set bandwidth limits for
the interface and/or to enable the interface to enforce QoS for
egress traffic. Enabling a QoS interface includes attaching a QoS
profile to the interface. QoS is supported on physical interfaces
and, depending on firewall model, QoS is also supported on subinterfaces and
Aggregate Ethernet (AE) interfaces. See the Palo Alto Networks product comparison tool to
view QoS feature support for your firewall model.
To get started, Add or modify a QoS Interface,
and then configure settings as described in the following table.
QoS Interface Settings | Configured In | Description |
---|---|---|
Interface Name | QoS InterfacePhysical Interface | Select the firewall interface on which to
enable QoS. |
Egress Max (Mbps) | Enter the maximum throughput (in Mbps) for
traffic leaving the firewall through this interface. The value is
0 by default, which specifies the firewall limit (60,000 Mbps in PAN-OS
7.1.16 and later releases; 16,000 in PAN-OS 7.1.15 and earlier releases). Though this is not a required field, we
recommend always defining the Egress Max for
a QoS interface. | |
Turn on QoS feature on this interface | Select to enable QoS on the selected interface. | |
Clear Text Tunnel Interface | QoS InterfacePhysical InterfaceDefault Profile | Select the default QoS profiles
for clear text and for tunneled traffic. You must specify a default
profile for each. For clear text traffic, the default profile applies
to all clear text traffic as an aggregate. For tunneled traffic,
the default profile is applied individually to each tunnel that
does not have a specific profile assignment in the detailed configuration
section. For instructions on defining QoS profiles, refer to Network
> Network Profiles > QoS. |
Tunnel Interface | ||
Egress Guaranteed (Mbps) | QoS InterfaceClear Text Traffic/ Tunneled Traffic | Enter the bandwidth that is guaranteed for
clear text or tunneled traffic from this interface. |
Egress Max (Mbps) | Enter the maximum throughput (in Mbps) for
clear text or tunneled traffic leaving the firewall through this
interface. The value is 0 by default, which specifies the firewall
limit (60,000 Mbps in PAN-OS 7.1.16 and later releases; 16,000 in PAN-OS
7.1.15 and earlier releases). The Egress Max for
clear text or tunneled traffic must be less than or equal to the Egress
Max for the physical interface. | |
Add |
For
example, assume a configuration with two sites, one of which has
a 45 Mbps connection and the other a T1 connection to the firewall.
You can apply restrictive QoS settings to the T1 site so that the
connection is not overloaded while also allowing more flexible settings
for the site with the 45 Mbps connection. To remove a clear
text or tunneled traffic entry, clear the entry and click Delete. If
the clear text or tunneled traffic sections are left blank, the
values specified in the Physical Interface tab’s Default Profile
section are used. |