Focus

Configure Lockless QoS

Table of Contents

Filter

Expand All | Collapse All

Configure Lockless QoS for improved QoS performance that results in improved throughput and latency.

The Palo Alto Networks firewalls supports two types of QoS:

Legacy QoS—In legacy QoS mode, the firewall supports both QoS and non-QoS traffics, where the legacy QoS shapes the QoS traffic.
(PAN-OS 10.2.5 and later 10.2 releases) Lockless QoS —In Lockless QoS mode, the firewall supports both QoS and non-QoS traffics, where the Lockless QoS shapes the QoS traffic. The firewall shapes the packets from the same interface (or port) by the same core for achieving Lockless QoS. For firewalls with higher bandwidth QoS requirements, the Lockless QoS dedicates CPU cores to the QoS function that improves QoS performance, resulting in improved throughput and latency.
In Lockless QoS mode, as the members in a LAG have to be mapped to the same core, the overall LAG QoS throughput is limited by the per core throughput.
- The QoS throughput on a 100G, 40G, and 25G port is limited to a single core throughput.
- Whenever more than two ports are mapped to a single core, the QoS throughput of that core is shared.
We support Lockless QoS mode on the following firewall models. Regardless of the type of QoS configured, the maximum bandwidth (maximum rate of transfer) you can allocate at the port level and QoS profile level for the following platforms is 10G.
- PA-3410 firewall
- PA-3420 firewall
- PA-3430 firewall
- PA-3440 firewall
- PA-5410 firewall
- PA-5420 firewall
- PA-5430 firewall

Follow these steps to enable, disable, and view the status of the Lockless QoS.

Access the CLI
Use the operational command set lockless-qos yes to enable the Lockless QoS to improve the QoS performance. Commit and reboot the firewall for the changes to take effect.
```
username@hostname>  set lockless-qos yes
Changing lockless-qos enable requires reboot of the device. Do you want to continue? (y or n)
```
If you want to configure Lockless QoS where the legacy QoS is already configured, you can do so by running the set lockless-qos yes command and reboot your firewall. If you don't run this command, the firewall retains the legacy QoS behavior. When you disable the Lockless QoS, the firewall falls back to the legacy QoS behavior, if you have already configured legacy QoS before enabling Lockless QoS.
Use the operational command set lockless-qos no to disable the Lockless QoS. As a result, Lockless QoS isn't supported on the firewall.
```
username@hostname>  set lockless-qos no
```
Use the operational command show lockless-qos enable to view the Lockless QoS enable status.
```
username@hostname>  show lockless-qos enable
lockless-qos enable : yes
```
Use the operational command show lockless-qos if-core-mapping to view the list of ports with the number of cores allocated for the QoS process by the Lockless QoS.
```
username@hostname>  show lockless-qos if-core-mapping
interface            qos-core
ethernet1/41            71
ethernet1/42            72
```