ASA rate limit certain websites

[dan.letkeman]

Hello,

Is there a way with the ASA to rate limit certain websites?  Match using regex but rate limit only those matches?

For example if I wanted to rate limit youtube, could I match youtube in a regex statement and then inspect http and only rate limit youtube and not the rest of the http traffic?

When I set the rate limit it allways seems to rate-limit whatever I am inspecting, eg http in general.

Or should I look at doing this on my router instead?

Thanks,

Dan.

[andrew.prince]

see the below URL for the definition of specific web site urls in regular expressions

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml

Sent from Cisco Technical Support iPad App

[dan.letkeman]

Andrew,

I have read countless examples of using regex on the ASA.  I have some cases already in use and I understand how it works.  But none of the examples I have read can answer my question.

As you can see in the link you provided, the action is always set when you add the http inspection to the class map.  The options are drop, reset or log.  This in no way gives you the abilty to rate-limit the website or domain name, it only gives you the abitlity to block it.

Dan.

[andrew.prince]

Dan,

OK - I forwarded that particular example as the way I look at it, it tells me:-

1) How to configrure RegEx

2) How to configure a specific URL to perform an action (it just happens in this example it's a block action)

3) Assign it to a class map

Once you have it in a class map, you are almost there - in theory (I have not tried this) but since you will have a class map, you should be able to assign it to a QoS policy map, rate limiting the amount of traffic?

See the below example of a QoS Rate Limit

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a008084de0c.shtml

Andrew.

[Philip Straatsma]

I am wondering if you ever came up with a solution for your URL-based rate limiting problem?

[Sheraz.Salim]

youtube is https not http. I beleive you cant rete limit it.