Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ASA rate limit downloads from internet

Hi all,

I have a Cisco ASA 5512 that sits between my LAN and the internet (all traffic is natted/patted to the outside).

I have multiple subnets, each subnet has its own VLAN, and sub interface on the ASA.

Now I want to overcome that one of my subnets can fill the whole internet pipe (both download from the internet and upload to the internet)

If I understand it correctly I can do this with a service policy that does policing.

Now my question, on what interface do I need to apply the policy? and what kind of policing do I need, inbound and/or outbound?

Do I need 2 policys, one for the download limiting, one for the upload limiting?

  • Firewalling
Everyone's tags (2)
1 ACCEPTED SOLUTION

Accepted Solutions
VIP Purple

ASA rate limit downloads from internet

Yes, that's a way it can be implemented. You could think about using a service-policy on the inside interface for outgoing traffic because it doesn't make any sense to first process the traffic in the ASA and later to drop it on the outside interface. But with your ASA you probably won't run into any performance problems.

NAT/PAT is handled transparently in your ASA-version. That was different in the versions < 8.3, but these are not available for your ASA.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

-- Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
3 REPLIES
VIP Purple

ASA rate limit downloads from internet

Yes, you can use policing for that. It can be done both in the inbound and outbound direction:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/mpf_service_policy.html#wp1162717

Here is an example on how to activate it:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/conns_qos.html#wp1221898

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

-- Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

ASA rate limit downloads from internet

Thanks for your response, would the following work in my situation?

I don't have a problem configuring it, but I want to know that I am thinking about this correctly.

For example, I have 10Mbit upload and 20Mbit download from my ISP.

I have 2 internal subnets:

10.10.10.0/24 -> I want to limit upload to 5Mbit and download to 10Mbit

10.20.20.0/24 -> I want to limit upoad to 7Mbit and download to 15Mbit

I apply the following to my Outside interface (creating 4 policys):

1.1) police upload traffic subnet 1

ACL src = 10.10.10.0/24 | dest = any

Police outbound = 5Mbit

1.2) police download traffic subnet 1

ACL src = any | dest = 10.10.10.0/24

Police inbound = 10Mbit

2.1) police upload traffic subnet 2

ACL src = 10.20.20.0/24 | dest = any

Police outbound = 7Mbit

112) police download traffic subnet 2

ACL src = any | dest = 10.20.20.0/24

Police inbound = 15Mbit

Will this work?

Won't I run into issues with NAT/PAT concerning my ACL's

VIP Purple

ASA rate limit downloads from internet

Yes, that's a way it can be implemented. You could think about using a service-policy on the inside interface for outgoing traffic because it doesn't make any sense to first process the traffic in the ASA and later to drop it on the outside interface. But with your ASA you probably won't run into any performance problems.

NAT/PAT is handled transparently in your ASA-version. That was different in the versions < 8.3, but these are not available for your ASA.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

-- Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
739
Views
0
Helpful
3
Replies