topic ASA rate limiting in Network Security

ASA rate limiting

Jon Marshall — Mon, 16 Oct 2023 11:39:49 GMT

I have an ASA (5520) with an outside, DMZ, and inside interface and I want to rate limit the traffic (5Mbps) coming from the outside going to a specific server on the DMZ (192.168.3.3).

Never set this up before and it is a live production firewall so would like a sanity check please.

I have this configuration -

asa(config)# access-list WEB_SERVER permit ip any host 192.168.3.3
asa(config)# class-map Web-Policy
asa(config-cmap)# match access-list WEB-SERVER

asa(config)# policy-map WEB
asa(config-pmap)# class Web-Policy
asa(config-pmap-c)# police 5000000 conform-action transmit exceed-action drop

asa(config)# service-policy Web-Policy interface in DMZ

1) will this work ?

2) is the interface I have applied the service policy to the correct one or should it be the outside interface ?

Thanks

Jon

Re: ASA rate limiting

MHM Cisco World — Mon, 16 Oct 2023 11:43:49 GMT

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/82310-qos-voip-vpn.html

Check thisb

Re: ASA rate limiting

balaji.bandi — Mon, 16 Oct 2023 11:46:28 GMT

yes that should work as expected.

Re: ASA rate limiting

Jon Marshall — Mon, 16 Oct 2023 11:48:44 GMT

I did, that was the document I used 🙂

Wasn't clear to me which interface to apply it to though, I am assuming rate limiting is done outbound by the looks of it.

Re: ASA rate limiting

MHM Cisco World — Mon, 16 Oct 2023 11:56:07 GMT

""Finally attach the shaping policy to the interface on which to shape and prioritize outbound traffic""

As cisco doc. It apply to interface outbound traffic. So it must be outside (nameif).

Re: ASA rate limiting

balaji.bandi — Mon, 16 Oct 2023 12:00:27 GMT

Looks like OP mentioned DMZ (i think he want to do in DMZ i guess)

asa(config)# service-policy Web-Policy interface in DMZ ( syntax may be wrong, but that is what his intention i guess)

Re: ASA rate limiting

Jon Marshall — Mon, 16 Oct 2023 16:06:54 GMT

I want to limit traffic going to a server in the DMZ so I assumed it would either be applied inbound on the outside interface or outbound on the DMZ interface but definitely not inbound on the DMZ interface as far as I can tell.

Re: ASA rate limiting

Jon Marshall — Mon, 16 Oct 2023 16:09:09 GMT

So outbound would be the DMZ interface in my case as I am not trying to limit traffic to the internet (which most of the examples seem to be about) but limit coming from the internet to a server in the DMZ.

Jon