QoS is enabled on an interface that shapes nothing
At a glance
Base severity
Area
Platform
Evidence level
Benchmark reference
Reads the export, not the device
ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.
Why it matters
The interface reads as configured for quality of service and treats every packet the same. Under congestion, traffic somebody meant to protect competes with everything else, and the screen that would have shown the mistake shows a feature switched on.
How to fix it
Web interface
The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.
- Bind a QoS profile to the interface, or define the classes the interface should shape.
- Set the egress maximum on the interface so the classes have a total to divide.
- Confirm the profile's classes match the classes the QoS policy assigns.
Command line
PAN-OS CLI
set network qos interface <interface> regular-traffic class-bandwidth-type mbps class <qos-class> class-bandwidth egress-guaranteed <guaranteed-mbps>An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits. Review the candidate configuration, then commit it yourself.
Read it back
show network qos interface <interface>Values to fill in3
- <interface>
- The interface to change
- <qos-class>
- The QoS class
- <guaranteed-mbps>
- The guaranteed bandwidth in megabits per second
Before you type it1
- QoS needs a profile with bandwidth in it and an interface that uses the profile. One without the other shapes nothing.
How to confirm the fix
- Confirm the interface reports a bound profile or one class or more.
- Confirm traffic is landing in the intended classes under load, from the QoS statistics on the device.
Limits
- This reads the configured shaping, not whether the link has ever been congested.
Compliance references
No benchmark recommendation is mapped to this control in this version.
More in QoS
- PAN-SEC-071QoS rule assigns a class with no bandwidth anywhere
- PAN-SEC-072QoS class has a priority and no guaranteed bandwidth
- PAN-SEC-073QoS rule matches all traffic
- PAN-SEC-083QoS policy rules exist and QoS is enabled on no interface
- PAN-SEC-084QoS is enabled on an interface and no QoS policy rule classifies traffic
See it on your own firewall
One complete analysis of one firewall costs nothing. A card is required and nothing is charged.