topic ASA rate limit bandwidth hogs in Network Security

ASA rate limit bandwidth hogs

Alex-Pr — Thu, 16 Jun 2022 16:33:57 GMT

Hey there,

I am running into the problem every so often where one or two users that are bandwidth hogs create a bad service level for everyone else. I am trying to find a way within a ASA to essentially rate limit the top talkers or bandwidth hogs.

Say I have a 50 meg internet connection, it is a public space and can have anything from 5 to 200 users at any given time.

What seems to happen every now and then is one of the users has something doing synching or backup and it runs at 48mbps, the rest of the users get a slow speed and start to complain.

It is basically the bully in the playground is hogging all the toys...

Is there a way for the ASA to basically track either the top talker or all users and have a police limit of 25 megs... This way, that bully is limited to 25 megs and everone else who is playing fairly still has access to the 25 megs?

Thank you!

Re: ASA rate limit bandwidth hogs

balaji.bandi — Thu, 16 Jun 2022 17:21:55 GMT

You can consider deploying QoS - make sure you required service get high priority compare to p2p and download.

check example steps :

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/82310-qos-voip-vpn.html

Re: ASA rate limit bandwidth hogs

Alex-Pr — Thu, 16 Jun 2022 17:43:51 GMT

Interesting idea.

Do you know what are the typical protocols that will be bandwidth hogs so I can match on that? What I was hoping for is to be able to match for the IP of the top talkers. In ASDM, you can see the top talkers. I am curious if the QOS policy can match directly on top talkers..

Thanks again

Re: ASA rate limit bandwidth hogs

balaji.bandi — Thu, 16 Jun 2022 19:07:14 GMT

For that one you need to Monitor or setup, a Priority for HTTP/voice/any other get higher priority

the QoS depends on business requirements, look at the document, start implementing step by step - and monitor to get optimal results.