Quality of Service (QoS) on Palo Alto Networks firewalls allows administrators to manage network bandwidth and prioritize critical applications during periods of congestion. By classifying traffic and assigning different levels of service (bandwidth guarantees, priority), QoS ensures that essential applications receive the necessary resources, while less critical traffic can be rate-limited or handled on a best-effort basis.
The primary goal is to improve the performance and reliability of key applications by controlling how bandwidth is allocated on egress interfaces .
Note: PAN-OS QoS is primarily applied on egress to control traffic *leaving* an interface. While QoS Policy rules can match ingress traffic, the actual queuing and bandwidth management occur on the egress interface.
PAN-OS QoS relies on several interconnected components working together:
class 1
to
class 8
). These represent distinct priority queues. Class 1 has the highest priority, and Class 8 has the lowest (best-effort).
Fundamental Order: You MUST configure QoS on the egress interface (defining total bandwidth and class bandwidths) *before* QoS Policy rules referencing that interface can effectively manage traffic.
QoS functionality is enabled and configured on a per-interface basis, typically the external-facing or congested egress interface.
Network > Network Profiles > QoS Profile
(confusingly named, this profile applies settings *to an interface*, distinct from the QoS Profile object used in policy). Alternatively, access directly via
Network > Interfaces > [Select Interface] > QoS
tab.
Once QoS is enabled on an interface, you allocate bandwidth to the 8 fixed classes:
Example: On a 100 Mbps interface, you might guarantee 20 Mbps for Class 2 (VoIP) and set its maximum to 30 Mbps. You might guarantee 5 Mbps for Class 6 (Bulk Transfers) and set its maximum to 50 Mbps.
PAN-OS uses 8 fixed priority queues (Classes 1-8). You cannot add or remove classes.
class 1
: Highest Priority
class 2
: High Priority
class 3
: Medium-High Priority
class 4
: Medium Priority (Often the default)
class 5
: Medium-Low Priority
class 6
: Low Priority
class 7
: Lower Priority
class 8
: Lowest Priority (Best Effort)
PAN-OS employs a Strict Priority Queuing mechanism for Classes 1 through 7. This means:
Implication: If higher-priority classes consistently consume all available bandwidth up to their maximums, lower-priority classes might experience packet loss or significant delays, even if they have guaranteed bandwidth configured (as the guarantee only applies during congestion when higher classes aren't demanding *all* the bandwidth).
A QoS Profile object is simple but essential. Its primary function is to link traffic identified by a QoS Policy rule to one of the 8 QoS classes.
Objects > QoS Profile
QoS-VoIP-Class2
,
QoS-Bulk-Class6
).
QoS Profiles can optionally be used to modify the Differentiated Services Code Point (DSCP) or Type of Service (ToS) value in the IP header of packets matching the associated QoS Policy rule.
EF
for Expedited Forwarding,
AFxx
for Assured Forwarding classes).
QoS Policy rules determine *which* traffic sessions receive specific QoS treatment.
Policies > QoS
Interaction with Security Policy: QoS Policy evaluation occurs *after* a session has been allowed by Security Policy. You only apply QoS to traffic that is permitted to pass through the firewall.
ethernet1/1
), defines its total
Egress Max
bandwidth, and allocates
Guaranteed
and
Maximum
bandwidth limits for each of the 8 QoS classes.
Profile-VoIP
maps to
Class 2
,
Profile-Web
maps to
Class 4
,
Profile-Bulk
maps to
Class 6
).
Profile-VoIP
.
Profile-Web
.
Profile-Bulk
.
Class 4
).
Profile-VoIP
) is applied, marking the packet internally for
Class 2
treatment.
ethernet1/1
), it's placed into the queue for
Class 2
.
flowchart TD
A[Packet Ingress] --> B[Security Policy Lookup]
B -- Allowed --> C[QoS Policy Lookup]
C -- Match Rule --> D[Apply QoS Profile]
D --> E[Assign QoS Class e.g., Class 2]
E --> F[Optional: Remark DSCP]
F --> G[Place in Egress Queue for assigned Class]
subgraph "Egress Interface (e.g., eth1/1)"
direction TB
G --> H[QoS Scheduler]
subgraph Queues
direction TB
Q1[Class 1 Queue]
Q2[Class 2 Queue]
Q3[...]
Q8[Class 8 Queue]
end
H --> Q1
H --> Q2
H --> Q3
H --> Q8
style H fill:#f9f,stroke:#333,stroke-width:2px
end
H --> I[Transmit Packet]
B -- Denied --> J[Drop/Reject]
C -- No Match --> K[Apply Interface Default QoS Profile/Class]
K --> E
linkStyle 10 stroke:#f00,stroke-width:2px,color:red
Simplified QoS processing flow.
Understanding QoS is important for the PCNSE exam. Key areas include: