To control upload and download speeds with respect to internal endpoints browsing the web, apply the following.

1. You will need a QoS policy that says “From Internal zone to External Zone”, then apply application and service details as appropriate. Finally, set the class to a value between 1 and 8.
2. Create two QoS profiles. One for the external interface and one for the internal interface.
3. Apply QoS to your external and internal interfaces (e.g. Ethernet1/1 and Ethernet1/2 respectively) and apply the appropriate QoS profiles to the clear text and tunnel fields on the first tab (ignore the other tabs).
4. To control download speeds from websites to laptops, edit the internal QoS profile. Edit the class you set in the first step.
5. To control upload speeds from laptops to websites, edit the external QoS profile. Edit the class you set in the first step.

In PAN-OS 9.0+, you can apply QoS at a sub-interface level but only on PA-3200 series and higher.