Solved: ASA, apply rate limit to a specific subnet.

andrea.meconi · ‎03-16-2009

Hello at all.

I need to apply a rate limit, on ASA firewall, when a specific subnet connects to Internet.

Thanks for help.

Andrea

Jon Marshall · ‎03-16-2009

"Be patient Jon"

Sorry Andrea, didn't mean to come across as impatient :-).

You can rate-limit the outgoing traffic but not the incoming traffic from the Internet. Actually strictly speaking you could rate-limit the imcoming traffic from the Internet with a service policy outbound on your inside interface but this isn't helpful as the traffic will already have come across your Internet link and used up bandwidth.

If you want to rate-limit inbound you would need to talk to your ISP.

Jon

View solution in original post

Jon Marshall · ‎03-16-2009

Andrea

Assuming 192.168.5.0/24 is the subnet -

access-list rate_subnet permit ip 192.168.5.0 255.255.255.0 any

class-map rate_subnet

match access-list rate_subnet

policy-map rate_qos

class rate_subnet

police output

service-policy rate_qos interface outside

see this link for full details -

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a008084de0c.shtml

Jon

andrea.meconi · ‎03-16-2009

Hi Jon and many many thanks for your help.

I have another question.

I understand that 192.x.x.x is the pre-NAT subnet. Because the service policy is applied only in the output direction than I do not understand how the ACL can match inbound (traffic from Internet)!

Regards.

Andrea.

Jon Marshall · ‎03-16-2009

Andrea

From the doc i sent -

"Note: Policing is applied only in the output direction"

So you cannot police inbound on the ASA.

Jon

andrea.meconi · ‎03-16-2009

Be patient Jon...

So I'm not able to apply a rate limit to a file transfer from Internet!?

Andrea

Jon Marshall · ‎03-16-2009

"Be patient Jon"

Sorry Andrea, didn't mean to come across as impatient :-).

You can rate-limit the outgoing traffic but not the incoming traffic from the Internet. Actually strictly speaking you could rate-limit the imcoming traffic from the Internet with a service policy outbound on your inside interface but this isn't helpful as the traffic will already have come across your Internet link and used up bandwidth.

If you want to rate-limit inbound you would need to talk to your ISP.

Jon