Configure QoS Policies and Rules

Add a QoS Policy to an Existing Application Subprofile

1. Go to Configure > Secure SD-WAN > Profiles > Sub Profiles > Application.
   
   
   
   The screen displays the existing Application profiles.
   
   
2. To add a QoS policy, click an application subprofile (Application-SP in the screenshot above), or click the Ellipsis icon, and then click the Edit icon in the popup menu. The Edit Application Subprofile screen displays.
   
   
    
3. Select the Policy tab, and then click + Policy.
   
   
    
4. In the popup menu, select QoS. To create a new policy, click Create New Policy. To use an existing policy, click Choose Existing, and then select a policy from the list.
   
   
   
   The Add QoS Policy screen displays, and Step 1, Rules is selected.
   
   
    
5. To change the columns displayed on the screen, click the Select Columns down arrow, and then select or deselect columns to choose the ones you want to display. To restore the default column settings, click Reset.
   
   
6. In the Add QoS Policy screen, click Add Rule. The following screen displays.
   
   
7. To create a new rule for the application policy, continue to Step 8. To add an existing rule:
   1. Click Add Existing Rule. The Add Existing QoS Rules screen displays the existing QoS rules.
      
      
   2. Select one or more rules. The selected rules move to the QoS Rules Selected pane.
      
      
   3. To view the configuration elements for a selected rule, click the down arrow next to the rule, and then select a category to display the configuration elements for that category:
      • Applications or URLs
      • Classification
      • Network Layer 3-4
      • Variable Types
   4. Click Add Rules to add the QoS rules to the application policy.
8. To create a new rule for the application policy, select Create Rule only for this Policy. The Add QoS Rule screen displays, and the Step 1, Applications & URLs and the Applications > Application Group tab is selected.
   
   
    
9. On the Applications tab, you can select specific applications, application groups, or application categories to include in the match criteria. All applications are included by default. You can use this screen to customize which applications to include in the match criteria.
   • To select application groups for the rule to match, on the Applications > Application Group tab, click the group category (User Defined Application Groups or Predefined Application Groups), and then select the application groups for the rule to match. You can also use the Search bar to find specific application groups.
     
     
   • To select applications for the rule to match, select the Applications > Applications tab, click the group category (User-Defined Applications or Predefined Applications), and then select the applications. You can also use the Search bar to find specific applications.
     
     
   • To select predefined application categories for the rule to match, select the Applications > Application Category tab, and then select one or more predefined application categories. You can also use the Search bar to find specific application categories.
     
     
10. Select the URL Categories and Reputations tab. The following screen displays.
    
    
     
11. In the URL Categories field, click the down arrow, and then select one or more URL categories for the rule to match.
12. In the Reputations field, click the down arrow, and then select one or more reputations to include in the rule:
    • High risk
    • Low risk
    • Moderate risk
    • Suspicious
    • Trustworthy
    • Undefined
13. Click Next or select Step 2, Users & Groups.
    
    
     
14. Select the user type to match with the QoS policy:
    • All Users
    • Known Users
    • Selected Users
    • Unknown Users
15. To add an existing user group, click Selected Users and click the name of one or more user groups (Group in the screenshot below).
    
    
16. To add a new user group, click + Add New User Group. The following screen displays.
    
    
    1. Enter a user group name and a distinguished name (DN).
    2. Click Add.
17. Select the Users tab. To add existing users, click Selected Users, and then click the name of one or more users.
    
    
18. To add a new user, click + Add New User. The following screen displays.
    
    
    1. Enter a user name and a work email address.
    2. Click Add.
19. Click Next or select Step 3, Source & Destination Traffic. The following screen displays. By default, all source and destination traffic is included in the match criteria. You can use this screen to customize the source and destination traffic to include in the match criteria.
    
    
20. To customize the source traffic, on the Source Address tab, use one of the following methods:
    • To specify source addresses to include in the match criteria, continue with Step 21.
    • To specify source addresses to exclude from the match criteria, select Negate Source Address to match all source addresses except the source addresses that you specify, and then continue with Step 21.
21. To specify a source address to include or exclude in the match criteria, you can select a source address from the list or use the search box to find a source address. To create a variable for the source address, click + Add Variable to the right of the source address list. Enter a name for the variable, click the Plus icon, and then click Add. You can add multiple variables.
    
    
    You can also enter values for the fields IP Address or IP Range, IP Subnet, or IP Wildcard as part of the match criteria. To create variables for these values, click + Add Variable for that field.
    • To add a variable for the IP address or IP range, select IPv4 Address, IPv4 Range, or IPv6 Address from the drop-down list, click the Plus icon, and then click Add. You can add multiple variables.
      
      
    • To add a variable for the IP subnet, select IP Subnet or IPv6 Subnet, click the Plus icon, and then click Add. You can add multiple variables.
      
      
    • To add a variable for the IP wildcard, enter a name for the variable, click the Plus icon, and then click Add. You can add multiple variables.
      
      
22. Click the Destination Address tab. The following screen displays.
    
    
23. To customize the destination traffic, use one of the following methods:
    • To specify destination addresses to include in the match criteria, continue to Step 24 to select addresses.
    • To specify destination addresses to exclude from the match criteria, select Negate Source Address to match all destination addresses except the addresses that you specify, and then continue to Step 24 to select addresses.
24. To specify a destination address to include or exclude in the match criteria, you can select a destination address from the list or use the search box to find a destination address. To create a variable for the destination address, click + Add Variable to the right of the destination address list. You can also enter values for the fields IP Address or IP range, IP Subnet, or IP Wildcard as part of the match criteria. To create variables for these values, click + Add Variable for that field. For more information on adding variables, see step 21.
25. Select the Source Zone and Sites tab. The following screen displays. All source zones and source sites are included in the match criteria by default. To customize the source zones and source sites to be included in the match criteria, enter information for the following fields.
    
    
     

    Field	Description
    Source Zones	Click the down arrow, and then select one or more zones. To create a variable for the source zone, click Add Variable.
    Source Sites	Click the down arrow, and then select one or more sites. To create a variable for the source zone, click Add Variable.

26. Select the Destination Zone and Sites tab. By default, all destination zones and destination sites are included in the match criteria. To customize the destination zones and destination sites to be included in the match criteria, enter information for the following fields.
    
    
     

    Field	Description
    Destination Zones	Click the down arrow, and then select one or more zones. To create a variable for the source zone, click Add Variable.
    Destination Sites	Click the down arrow, and then select one or more sites. To create a variable for the source zone, click Add Variable.

27. Click Next or select Step 4, Service & DSCP. The following screen displays. All services, service groups, and differentiated services code points (DSCPs) are included in the match criteria by default. On this screen you can specify the services, service groups, and DSCPs to include in the match criteria.
    
    
28. To specify the services to include, do one or both of the following:
    • In the search box under Services, enter the service name.
    • Select one or more services from the list below the search box. Click All Services to select a category to filter the list:
      • Predefined
      • User Defined
29. Select the Service Groups tab, then select the service group to which you want to apply security access control rules. You can select User-Defined, Predefined, or both. Click the Toggle Row Expand icon next to the service group name to view the details for each service group.
    
    
30. Select one or more service groups to include in the match criteria. The service groups are added to the Services list.
31. Select the DSCP tab. All DSCP decimal values are included by default. You can specify which DSCP decimal values to include in the match criteria.
    
    
32. Select one or more DSCP decimal values, or use search to locate one or more values.
33. Click Next to go to Step 5, Classification. In the Classification field, select a classification criteria to classify the traffic. The list shows the classifications defined in the Profile Elements > Elements > QoS > Classification folder of reusable objects. For information about configuring QoS classifications, see Configure QoS Classification Elements.
    
    
34. Click Next to go to Step 6, Permissions, and revise the permissions, if needed.
    
    
     
35. Click Next to go to Step 7, Review and Submit and then enter information for the following fields.
    
    
     

    Field	Description
    General (Group of Fields)
    Name	Enter a name or the rule.
    Description	Enter a description for the rule.
    Tags	Enter one or more tags. A tag is an alphanumeric text descriptor with no spaces or special characters. You can specify multiple tags added for the same object. The tags are used for searching the objects.
    Schedule	Select a schedule to set the time and frequency at which the rule is in effect.
    Rule Enabled	Click to disable the rule once it is saved. By default, the rule is enabled.

36. Review the selected settings. Click the Edit icon to change a setting, as needed.
37. Click Save to save the rule.
38. In the Add QoS Policy screen, click Step 2, Permissions. The following screen displays.
    
    
     
39. To change the permissions for a role, select Edit, Hide, or Read in the Permissions column.
40. Click Next to go to Step 3, Review and Submit.
    
    
     
41. In the General box, enter a name for the QoS policy, and optionally enter a text description for the policy and one or more tags. A tag is an alphanumeric text descriptor with no spaces or special characters. You can specify multiple tags added for the same object. The tags are used for searching the objects.
42. Review the settings you have selected. Click the Edit icon to change a setting, as needed.
43. Click Save to create the QoS policy.

Note that you can create QoS policy rules in the Profile Elements also, in two places:

• To create a QoS rule in the Profile Elements > Policies > Application folder, click QoS and then follow step 6 through step 43, above.
  
  
• To create a QoS rule in the Profile Elements > Rules > Application folder, click QoS and then follow Step 8 through 37, above.
  
  

Attach QoS Policies to a Basic Master Profile

After you create a QoS policy, you can attach it to a basic master profile.

To attach QoS policies to a basic master profile:

1. Go to Configure > Secure SD-WAN > Profiles > Master Profiles > Basic.
   
   
   
   The screen displays the configured basic master profiles.
   
   
2. Click the master profile to which you want to attach the QoS policy. The Edit Master Profile screen displays.
3. Select the Profile > Application tab. Click +Policy, click the down arrow and select QoS, and then select Choose Existing.
   
   
4. In the Choose Policies screen, select the QoS policy from the list, and then click Add.
   
   
   
   The Edit Master Profile screen displays the QoS policies added.