Traffic Shaping and Bandwidth Management on a Palo Alto Firewall

Before you run this

This guide sets up QoS (Quality of Service) on a Palo Alto firewall so you can guarantee bandwidth to important traffic (say VoIP), cap bandwidth for greedy traffic (backups, streaming), and prioritise real-time flows during congestion. QoS on PAN-OS is enforced on the egress direction of an interface, which is the single most important thing to understand before you build anything — I cover it below.

This is configuration work on a production security device, so treat it accordingly:

• Access required. You need a firewall admin account with rights to edit Network profiles, Policies, and to commit. On a Panorama-managed firewall you would push this from Panorama instead; this guide assumes a standalone firewall managed through its own web GUI.
• Keep an out-of-band path open. Have a console cable (or a second management session on a known-good path) connected before you start. A QoS policy that matches management traffic, or an interface change, can throttle or disrupt the very session you are working in.
• Back up first. Go to Device > Setup > Operations and click Save named configuration snapshot, and also Export named configuration snapshot to pull a copy off-box. This is your rollback.
• Nothing here deletes data, but a wrong bandwidth cap or a policy matching too broadly will degrade or drop production traffic, which users feel immediately. QoS caps are enforced silently — there is no error, packets just get delayed or dropped.
• Test the scope first. Build the QoS policy against a narrow, identifiable test source (one test client IP, or one non-critical application) before you widen the match. Watch it in the live QoS statistics graph before you trust it.
• Do it in a maintenance window, and know your undo path: before you commit you can discard everything with Config > Revert Changes; after you commit you can restore the previous running config with Device > Setup > Operations > Load configuration version (or the snapshot you exported). PAN-OS commits are not auto-rollback-timed, so verify quickly after commit.

Assumptions

• PAN-OS 11.1, standalone firewall, configured through the web GUI. Menu paths shift slightly between major versions, so confirm anything that looks different against your exact release.
• Layer 3 interfaces: ethernet1/1 is the internet-facing (untrust) interface, ethernet1/2 faces the LAN (trust). Substitute your real interface names.
• A single internet link. Placeholder link speed below is 100 Mbps down / 20 Mbps up — replace with your actual, measured usable throughput, not the ISP's headline figure.

The one concept that trips everyone up: egress

QoS shapes traffic leaving an interface. So:

• To shape download traffic (internet → users), you apply QoS on the LAN interface (ethernet1/2), because that is where download traffic egresses toward the users.
• To shape upload traffic (users → internet), you apply QoS on the WAN interface (ethernet1/1).

Most people want both, which means you configure QoS on both interfaces. Get this backwards and your "download cap" will do nothing.

Step 1 — Build a QoS profile

The profile defines up to eight traffic classes and what each one gets. Priorities available are real-time, high, medium, low, and each class can have a guaranteed egress and a maximum egress.

1. Go to Network > Network Profiles > QoS Profile and click Add.
2. Name it something like QoS-WAN-Upload.
3. Set the profile-level Egress Max to the interface's usable ceiling — for the WAN upload profile, 20 (Mbps).
4. Under Classes, click Add for each class you need. A sensible starting set:

Class	Purpose	Priority	Guaranteed	Max
class1	VoIP / real-time	real-time	4	6
class2	Business apps	high	6	(blank = up to Egress Max)
class4	Default / everything else	medium	(blank)	(blank)
class7	Bulk / backups	low	(blank)	5

Two things to know about the defaults here, both worth confirming in the PAN-OS QoS documentation for your build: traffic that matches no QoS policy falls into class 4, and a class with no guaranteed/max value is effectively unbounded within the profile ceiling. Leave a class blank rather than guessing a number you don't need.

1. Click OK.

Make a second profile for the LAN interface (e.g. QoS-LAN-Download) with an Egress Max of 100 and the same class layout scaled to your download speed.

Step 2 — Enable QoS on the interface

1. Go to Network > QoS and click Add.
2. On the Physical Interface tab, choose the interface (ethernet1/1 for upload), tick the option to turn on QoS on this interface, set the Egress Max for the physical interface (20), and set the Default Profile for Clear Text traffic to QoS-WAN-Upload.
3. On the Clear Text Traffic tab, set the clear-text Egress Guaranteed and Egress Max to match your link, and confirm the default profile is applied.
4. Click OK.
5. Repeat for ethernet1/2 using QoS-LAN-Download and the 100 ceiling.

The exact field labels on these tabs (Clear Text vs Tunneled Traffic) are documented in Palo Alto's "Configure QoS" admin guide topic — if a field name on your version doesn't match, follow the guide rather than guessing.

Step 3 — Write QoS policy rules

The policy is what actually sorts traffic into your classes. It looks and behaves like a security policy: match on zone, source, destination, application, and service, then assign a class.

1. Go to Policies > QoS and click Add.
2. General: name it, e.g. VoIP-realtime.
3. Source: source zone trust, and for your first test, a single test source address rather than the whole subnet.
4. Destination: destination zone untrust.
5. Application / Service: pick the application (e.g. sip, rtp) or a service. Start specific.
6. On the Other Settings (class) tab, set the QoS Class to class1.
7. Click OK.

Add rules for your other classes (business apps → class2, backups → class7). Order matters — like security rules, the first match wins, so keep specific rules above broad ones. Leave general traffic to fall through to class 4.

Step 4 — Commit

Click Commit (top right). If anything looks wrong before you commit, use Config > Revert Changes to throw the candidate config away entirely.

Verify it worked

PAN-OS gives you a live per-class bandwidth graph, which is the fastest honest check:

1. Go to Network > QoS.
2. On the row for your interface, click the Statistics link.
3. Generate the traffic (place a test VoIP call, run the backup), and watch the class bars move. Your test flow should land in the class you assigned, and a capped class should flatten at its ceiling under load.

Cross-check policy hits under Policies > QoS — the rule hit counter should climb for the rule you expect. From the CLI you can also inspect interface QoS with the operational show commands documented in the PAN-OS CLI reference under QoS; use those read-only commands rather than configuring QoS from the CLI, since the GUI is the supported path here.

Undo / rollback

• Remove one rule: delete it under Policies > QoS and commit.
• Turn QoS off on an interface: Network > QoS, edit the interface, untick the enable option (or delete the entry), and commit.
• Full rollback: Device > Setup > Operations > Load configuration version, pick the version from before your change, and commit — or load the snapshot you exported in the safety note.

Roll back the same way you built it: in a window, with a console session open.