Differences

This shows you the differences between two versions of the page.

--- paloaltonetworks:configuration:qos [2021/07/19 12:45] – bstafford
+++ paloaltonetworks:configuration:qos [2022/11/23 12:49] (current) – external edit 127.0.0.1
@@ Line 7: / Line 7: @@
   - To control download speeds from websites to laptops, edit the internal QoS profile. Edit the class you set in the first step.
   - To control upload speeds from laptops to websites, edit the external QoS profile. Edit the class you set in the first step.
+In a QoS policy rule, the contents of the DSCP/ToS tag are match criteria only. To affect what QoS is applied, using the "Other Settings" tab and set the class. The class that is actually applied depends on what the egress interface is and what QoS profile is applied to that egress. Further more, the interface's QoS settings can have specific QoS profiles applied to traffic depending on the source interface.
+In the security policy rule, when you set QoS marking under the Actions tab, what you set will be evaluated by the QoS policy. Remember QoS policy is applied last of all so you can use the Security policy rule to set a QoS Marking (e.g. IP DSCP cs1). This can then be used by the QoS policy rule based for matching traffic to apply actions to. Remember though, when you do this in Security policy, you are actually tagging the traffic with the marking and the tag will remain on the packet as it is transmitted from the firewall. i.e. you can mess up existing tagging.
 ===== Sub-Interface Limitation =====
 In PAN-OS 9.0+, you can apply QoS at a sub-interface level but only on PA-3200 series and higher.