topic Re: Cisco Secure Firewall 3105 with FMC - QoS schedule in Network Security

Cisco Secure Firewall 3105 with FMC - QoS schedule

Tibor M — Mon, 29 Jul 2024 13:56:40 GMT

Hi,

on ASA there were possible to create service policy rule for some interface and apply QoS shaping for download/upload based on time of day schedule. We using it to limiting upload speed for exact subnets to not deplete whole capacity of line to WAN (i.e. upload max 50mbps during 8:00 - 22:00, but during 22:00 - 8:00 it could be 200mbps)

I'm looking for way how to do it on FTD3105 managed by FMC and cannot find anything. There is possible to configure QoS but it looks as static setting without any schedule which is kind of problem as it's mandatory for us to have successful migration from ASA to FTD.

Re: Cisco Secure Firewall 3105 with FMC - QoS schedule

Marius Gunnerud — Mon, 29 Jul 2024 14:36:36 GMT

To configure QoS on a schedule you will most likely need to do this through Flexconfig.

Re: Cisco Secure Firewall 3105 with FMC - QoS schedule

Tibor M — Mon, 29 Jul 2024 16:54:49 GMT

🙂😉but I do not know how. of course this is something not described officially how to manipulate with qos and schedules in flexconfig

Re: Cisco Secure Firewall 3105 with FMC - QoS schedule

Marius Gunnerud — Mon, 29 Jul 2024 17:13:06 GMT

What you need to do is just add the ASA configuration into the flexconfig policy. And apply it to the FTD.
I can get you a sample config a bit later, if needed, as I am not infront of my PC right now.

Re: Cisco Secure Firewall 3105 with FMC - QoS schedule

Tibor M — Mon, 29 Jul 2024 21:39:26 GMT

ASA code I have

i.e.

time-range perflab_upload_limit_night_and_weekend
periodic weekend 0:00 to 23:59
periodic weekdays 0:00 to 6:00
!
time-range perflab_upload_limit_workday
periodic weekdays 6:00 to 23:59
!
access-list inside_mpc_1 extended permit ip object subnet-10-16-0-0__16-Perflab any4 time-range perflab_upload_limit_night_and_weekend
access-list inside_mpc_2 extended permit ip object subnet-10-16-0-0__16-Perflab any4 time-range perflab_upload_limit_workday
!
class-map inside-class-qos-perflab-limit
match access-list inside_mpc_2
!
class-map inside-class-qos-perflab-nolimit
match access-list inside_mpc_1
!
policy-map inside-policy
class inside-class-qos-perflab-limit
set connection decrement-ttl
police input 50000000 1562500
class inside-class-qos-perflab-nolimit
police input 200000000 6250000
set connection decrement-ttl
class inside-class1
set connection timeout half-closed 0:05:00 idle 0:30:00
set connection decrement-ttl
user-statistics accounting
class inside-class
inspect dns
inspect icmp
inspect icmp error
inspect ip-options
inspect ipsec-pass-thru
inspect pptp
inspect rsh
inspect rtsp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect xdmcp
!
service-policy inside-policy interface inside

but can I modify qos with Flex so simple, just to replace interface name? I'm curious why such new device like Firepower does not know stupid easy thing as time range ACL available since ages old IOS devices easily in these days. I know time ranges are now available as part of Access List Policy, but QoS is detached from it and it could be set just as static. It looks like Cisco engineers thinks that QoS could not change in time.

Re: Cisco Secure Firewall 3105 with FMC - QoS schedule

NetSecNW — Fri, 14 Feb 2025 11:50:41 GMT

I have been looking for the same feature and unfortunately it does not look like its supported. Access and Pre-Filter policies can be scheduled but seeing as the QoS enforcement is after the access control enforcement or the pre-filter enforcement it cannot be manipulated without adding the schedule feature to a QoS policy. In and out of core business hours QoS manipulation would be a really nifty feature to protect bandwidth.