Configure QoS

Create an Application QoS Policy

You can create an application QoS policy as part of a main template, or you can create it separately and then associate it with a main template. For more information on main templates, see Configure Main Templates.

• To create a application QoS policy for an existing main template:
  1. In Tenant view, select Configure > SD-WAN > Main Templates.
  2. Select the main template for which you want to configure the policy.
  3. Click step 5, QoS, Traffic Steering, and Traffic Monitoring. The following screen displays.
     
     
  4. Select the Application QoS tab, and then click Add New Application QoS Policy.
  5. Continue to Configure an Application QoS Policy Rule, below.
• To create an application QoS  policy separately from a main template:
  1. In Tenant view, select Configure > Secure SD-WAN > QoS & Traffic Steering > QoS.
     
     
     
     The following screen displays with the Policies > Application QoS Policies tab selected by default.
     
     
     
     If there are no existing QoS policy rules, the following screen displays:
     
     
  2. Click + Add or Add Application QoS Policy. The Add Application QoS Policy screen displays. 
  3. Continue to Configure an Application QoS Policy Rule, below.

Configure an Application QoS Policy Rule

1. In the Add Application QoS Policy screen, click Add Application QoS Rule.
   
   
   
   The screen displays the workflow to create a rule, beginning with step 1, Applications and URLs.
   
   
2. By default, all applications, URLs, and reputations are included in the match criteria. You can include or exclude specific applications, application groups, application categories, URL categories and URL reputations. 
   
   To specify traffic for application groups, specific applications, application categories, and URL categories and reputations for the rule:
   1. Select the Applications > Application Groups tab.
      
      
   2. To select specific application groups to include or exclude in the rule, click User Defined Application Groups, Predefined Application Groups, or both. Then select the application groups for the rule to match. You can use the Search bar to find specific application groups.
      • To create an Application Group object, click + Add Application Group.
   3. Select the Applications > Applications tab.
      
      
   4. To select specific applications, click User Defined Applications, Predefined Applications, or both. Then select the applications for the rule to match. You can use the Search bar to find specific applications.
      • To create an Application object, click + Add Application. See Applications section in Configure Reusable Objects. 
   5. Select the Applications > Application Category tab.
      
      
   6. Select one or more user-defined and predefined application categories for the rule to match. You can use the Search bar to find specific application categories.
      • To create an Application Category object, click + Add Application Category. See the See Application Categories section in Configure Reusable Objects.
   7. Select the URLs and Reputations tab. 
      
      
   8. In the URL Categories field, click the down arrow, and then select one or more URL categories for the rule to match.
      • To create a URL category, select + Add URL Category. See the Add a URL Category section in Configure Reusable Objects.
   9. In the Reputations field, click the down arrow, and then select one or more reputations to include in the rule:
      • High risk
      • Low risk
      • Moderate risk
      • Suspicious
      • Trustworthy
      • Undefined
3. Click Next or select step 2, Users & User Groups.
4. By default, all users and user groups are included in the match criteria. To customize which traffic to include or exclude from users & user groups:
   1. Click to select the user type for which you want to apply the rule:
      • All Users—Apply rule for all matched users. This is the default.
      • Selected Users—Apply rule for selected users. 
      • Known Users—Apply rule for all known (authenticated) users. 
      • Unknown Users—Apply rule only for users that are not authenticated. 
        
        
   2. If you select the Selected Users option, the following screen displays. 
      
      
   3. Click the User and Device Authentication Profile field to select a user authentication profile for the matched users and groups.
      • To create a new profile, select + Create New. See the Configure User and Device Authentication Profiles in Configure SD-WAN User and Device Authentication.
   4. On the User Groups tab, click the checkbox for each user group to include. You can search for specific user groups, or click Select All to include all user groups.
   5. Click the Users tab, and then click the checkbox for each user to include. You can search for specific users, or click Select All to include all users. 
5. Click Next or select step 3, Source & Destination Traffic.
6. By default, traffic from all source and destination addresses and zones, and all sites, are included in the match criteria. You can include or exclude specific source and destination traffic to match the rule.   
   
   To match traffic from specific source and destination addresses, zones, and sites:
   1. Select the Source Addresses tab.
      
      
   2. Select a source address group or address object for the rule to match, or use the search box to find a source address group or object. To exclude the source address or addresses, click Negate Source Address.
      • To create an Address Group object, click the + icon. For more information, see Add Address Group.
      • To create an Address Object, click the + icon. For more information, see Add Address Object in Configure Reusable Objects.
   3. To match on IP range, subnet, or wildcard, enter one or more values in the IP Range, Subnet, or Wildcard fields. 
   4. Select the Destination Addresses tab.
      
      
   5. Select a destination address group or object for the rule to match, or use the search box to find a source address or object. To exclude the destination address or addresses, click Negate Source Address.
      • To create an Address Group object, click the + icon. For more information, see Add Address Group in Configure Reusable Objects.
      • To create an Address Object, For more information, see Add Address Object in Configure Reusable Objects.
   6. To match on IP range, subnet, or wildcard, enter one or more values in the IP Range, Subnet, or Wildcard fields. 
   7. Click the Enable Match Anycast Address to enable match on an anycast IP address, which is a shared default gateway IP address. 
   8. Select the Source Zones & Sites tab to specify source zones to include in the match criteria. Select one or more source zones or source sites from the lists. You can also select an ingress routing instance.
      
      
   9. Select the Destination Zones & Sites tab to specify destination zones to include in the match criteria. Select one or more destination zones or destination sites from the lists. You can also select an egress routing instance.
      
      
7. Click Next to go to step 4, Source and Destination Geolocation.
8. Geolocation uses IP addresses to identify the location of connected devices. By default, source and destination traffic from all locations are included in the match criteria. You can specify the source and destination traffic to include or exclude in the match criteria based on geographic location.
   
   To specify the geographic locations to include or exclude:
    
   1. On the Source Geo Location tab, click the Country drop-down list to select a geographic category to search. 
   2. In the next field, type the name of the country, state, or city. When a match is found, it is added to the Selected list.
   3. To remove a country from the list, click the X next to the country name. To remove all selections, click Clear All.
   4. To exclude the selected geographic locations from the match criteria, click Negate Selection.
   5. Click the Destination Geo Location tab, and repeat steps 8a through 8d.
      
      
9. Click Next to go to step 5, Services & DSCP.
10. By default, all services, service groups, and DSCPs are included in the match criteria. You can specify the services, service groups, and Differentiated Services Code Points (DSCPs) for the rule to match.
    
    To specify services, service groups, and DSCP to include:
    1. Select the Services tab.
       
       
    2. Select the services to include in the match criteria. To filter the list, click All Services, and select Predefined or User Defined. You can also search by service name.
       • To create a services object, click the + icon. For more information, see Add a Service Object in Configure Reusable Objects.
    3. Select the Service Groups tab.
       
       
    4. Select the service groups to include in the match criteria. You can search by service group name.
       • To create a service group object, click the + icon. For more information, see Add a Service Group in Configure Reusable Objects.
    5. Select the DSCP tab. By default, all DSCP decimal values are included in the match criteria. You can specify which DSCP decimal values to include.
       
       
    6. Select one or more DSCP decimal values. The value range is 0 to 63. You can use the search bar to locate values.
11. Click Next to go to step 6, QoS Profile.
    
    
12. In the QoS Profile field, select an existing QoS profile to associate with the rule, or click + Create New to create a new profile. For more information, see Configure QoS Profiles, above.
13. Click Next to go to step 7, Review and Submit.
14. In the General section, enter information for the following fields.
    
    
     

    Field	Description
    General (Group of Fields)
    Name	Enter a name or the rule.
    Description	(Optional) Enter a description for the rule.
    Tags	(Optional) Enter one or more tags. A tag is an alphanumeric text descriptor with no spaces or special characters. You can specify multiple tags added for the same object. The tags are used for searching the objects.
    Schedule	Select a schedule to set the time and frequency at which the rule is in effect.
    Rule Enabled	Click to disable the rule once it is saved. By default, the rule is enabled.
    Logging Disabled	Click to the slider bar to enable logging for the rule. By default, logging is disabled.

15. Review the remaining sections. Click the  Edit icon in any section to make changes, as needed.
16. Click Save Traffic Steering Rule. The Add Application QoS Policy screen displays the saved rule. 
    
    
17. To add another rule, click + Add in the horizontal menu. You can also select an existing rule and perform the following operations: 
    • Filter—Click the Filter icon to filter on matching IP address or subnet in any address range. You can also filter on service port number. In the drop-down list, select one of the following:
      • Select IP Address and enter an IP address or IP subnet, and then click Apply.
      • Select Service Port and enter a service port number, and then click Apply.
      • Select IP Address and enter an IP address or IP subnet, and select Service Port and enter a service port number, and then click Apply.
    • Clone—Creates a copy of the rule. You can change the default name of the cloned rule, if desired. The cloned rule then appears in the list of traffic steering rules.
    • Reorder—Reorder the selected policy rule. 
    • Delete—Delete the selected policy rule. 
18. Continue to Configure Permissions, Review and Submit the Application QoS Policy, below. 

Configure Permissions, Review, and Submit the Application QoS Policy

1. In the Add Application QoS Policy screen, click Step 2, Permissions. The following screen displays. 
2. The permission for each role is selected by default, and you can update it.
   
   
3. To change the permissions for a role, select Read, Update, or Delete in the Permissions column.
4. Click Next to go to step 3, Review and Submit.
5. In the General section, enter a name for the application QoS policy. You can also enter a text description for the policy and one or more tags. A tag is an alphanumeric text descriptor with no spaces or special characters. You can specify multiple tags added for the same object. The tags are used for searching the objects.
   
   
6. Review the settings you have selected. Click the  Edit icon to change a setting, as needed.
7. Click Submit.

Create a Stateless QoS Policy

You can create a stateless QoS policy as part of a main template, or you can create it separately and then associate it with a main template. For more information on main templates, see Configure Main Templates.

• To create a stateless QoS policy for an existing main template:
  1. In Tenant view, select Configure > SD-WAN > Main Templates.
  2. Select the main template for which you want to configure the policy.
  3. Click step 5, QoS, Traffic Steering, and Traffic Monitoring.
     
     
  4. Select the Stateless QoS tab, and then click Add New Stateless QoS Policy.
  5. Continue to Configure Stateless QoS Policy Rules below.
• To create a stateless QoS policy separately from a main template:
  1. In Tenant view, select Configure > Secure SD-WAN > QoS & Traffic Steering > QoS.
     
     
  2. In the Stateless QoS Policies screen, select the Stateless QoS Policies tab.
     
     
  3. Click + Add. The Add Application QoS Policy screen displays. 
  4. Continue to Configure Stateless QoS Policy Rules below.

Configure Stateless QoS Policy Rules

1. In the Add Stateless QoS Policy screen, click Add Stateless QoS Rules.
   
   
   
   The screen displays the workflow to create a rule, beginning with step 1, Source and Destination Traffic.
   
   
2. By default, traffic from all source and destination addresses and zones, and all sites, are included in the match criteria. You can include or exclude specific source and destination traffic to match the rule. 
   
   To match traffic from specific source and destination addresses, zones, and sites:  
   1. Select the Source Addresses tab.
      
      
   2. Select a source address group or address object for the rule to match, or use the search box to find a source address group or object. To exclude the source address or addresses, click Negate Source Address.
      • To create an Address Group object, click the + icon. For more information, see Add Address Group in Configure Reusable Objects.
      • To create an Address Object, click the + icon. For more information, see Add Address Object in Configure Reusable Objects.
   3. To match on IP range, subnet, or wildcard, enter one or more values in the IP Range, Subnet, or Wildcard fields. 
   4. Select the Destination Addresses tab.
      
      
   5. Select a destination address group or object for the rule to match, or use the search box to find a source address or object. To exclude the destination address or addresses, click Negate Source Address.
      • To create an Address Group object, click the + icon. For more information, see Add Address Group in Configure Reusable Objects.
      • To create an Address Object, click the + icon. For more information, see Add Address Object in Configure Reusable Objects.
   6. To match on IP range, subnet, or wildcard, enter one or more values in the IP Range, Subnet, or Wildcard fields. 
   7. Click the Enable Match Anycast Address to enable match on an anycast IP address, which is a shared default gateway IP address. 
   8. Select the Source Zones & Sites tab to specify source zones to include in the match criteria. Select one or more source zones or source sites from the lists. You can also select an ingress routing instance.
      
      
   9. Select the Destination Zones & Sites tab to specify destination zones to include in the match criteria. Select one or more destination zones or destination sites from the lists. You can also select an egress routing instance.
      
      
3. Click Next to go to step 2, Services & DSCP.
4. By default, all services, service groups, and DSCPs are included in the match criteria. You can specify the services, service groups, and Differentiated Services Code Points (DSCPs) for the rule to match.
   
   To specify services, service groups, and DSCP to include:
   1. Select the Services tab.
      
      
   2. Select the services to include in the match criteria. To filter the list, click All Services, and select Predefined or User Defined. You can also search by service name.
      • To create a services object, click + Add User Defined. <link here>
   3. Select the Service Groups tab.
      
      
   4. Select the service groups to include in the match criteria. You can search by service group name.
      • To create a service group object, click + Add User Defined. <link here>
   5. Select the DSCP tab. By default, all DSCP decimal values are included in the match criteria. You can specify which DSCP decimal values to include.
      
      
   6. Select one or more DSCP decimal values. The value range is 0 to 63. You can use the search bar to locate values.
5. Click Next to go to step 3, Layer 2.
6. To classify packets that an interface receives based on Layer 2 fields, enter information for the following fields.
   
   
    

   Field	Description
   MAC Address Type	Select the MAC address type to match: Broadcast Multicast
   Ether Type (Group of Fields)
   None	Select if you do not want to classify incoming packets based on Ether type.
   Ether Type	Select to match by name, and then select the Ether type of incoming packets: ARP IPv4 IPv6
   Ether Type Value	Select to match by value, and then enter a numeric value between 1536 through 65535.
   IEEE 802.1p Priority Values	Enter a value (0 through 7) for the IEEE 802.1p Priority Code Point (PCP) in the VLAN tag at Layer 2 to specify the frame priority for QoS handling in Ethernet networks.

7. Click Next to go to step 4, QoS Profile.
8. Enter information for the following fields.
   
   
    

   Field	Description
   Action	Click the action to take on traffic that matches the rule: Allow—Permit traffic that matches the rule. Deny—Do not permit traffic that matches the rule. Bypass Service—Route traffic that matches the rule, but do not perform any service-related processing or create a session for the traffic.
   QoS Profile	Select an existing QoS profile to associate with the rule or click + Create New to create a new QoS profile. For more information, see Configure QoS Profiles above.
   Permit Existing Flow	Select how to apply the rule to an existing flow for TCP sessions created by a non-SYN TCP packet: Allow—Select to allow the existing TCP flows with minimal services. Validate—Select to allow the existing TCP flows with all services applicable in the service chain.

9. Click Next to go to step 5, Review and Submit.
10. In the General section, enter information for the following fields.
    
    
     

    Field	Description
    General (Group of Fields)
    Name	Enter a name or the rule.
    Description	(Optional) Enter a description for the rule.
    Tags	(Optional) Enter one or more tags. A tag is an alphanumeric text descriptor with no spaces or special characters. You can specify multiple tags added for the same object. The tags are used for searching the objects.
    Schedule	Select a schedule to set the time and frequency at which the rule is in effect.
    Rule Enabled	Click to disable the rule once it is saved. By default, the rule is enabled.
    Logging Disabled	Click to the slider bar to enable logging for the rule. By default, logging is disabled.

11. Review the remaining sections. Click the  Edit icon in any section to make changes, as needed.
12. Click Save Traffic Steering Rule. The Add Stateless QoS Policy screen displays the saved rule. 
    
    
13. To add another rule, click + Add in the horizontal menu. You can also select an existing rule and perform the following operations: 
    • Filter—Click the Filter icon to filter on matching IP address or subnet in any address range. You can also filter on service port number. In the drop-down list, select one of the following:
      • Select IP Address and enter an IP address or IP subnet, and then click Apply.
      • Select Service Port and enter a service port number, and then click Apply.
      • Select IP Address and enter an IP address or IP subnet, and select Service Port and enter a service port number, and then click Apply.
    • Clone—Creates a copy of the rule. You can change the default name of the cloned rule, if desired. The cloned rule then appears in the list of traffic steering rules.
    • Reorder—Reorder the selected policy rule. 
    • Delete—Delete the selected policy rule. 
14. Continue to Configure Permissions, Review and Submit the Stateless QoS Policy. 

Configure Permissions, Review, and Submit the Stateless QoS Policy

1. In the Add Stateless QoS Policy screen, click step 2, Permissions. The following screen displays.
   
   
2. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
3. To change the permissions for a role, select Edit, Hide, or Read in the Permissions column.
4. Click Next to go to step 3, Review and Submit.
5. In the General section, enter a name for the stateless QoS policy. You can also enter a text description for the policy and one or more tags. A tag is an alphanumeric text descriptor with no spaces or special characters. You can specify multiple tags added for the same object. The tags are used for searching the objects.
   
   
6. Review the settings you have selected. Click the  Edit icon to change a setting, as needed.
7. Click Submit.