topic Re: ASA Traffic Shaping in Network Security

ASA Traffic Shaping

TMaster100 — Fri, 21 Feb 2020 16:09:21 GMT

Hello Cisco Guru's,

As a start i am no expert at ASA's but manage to find my way around them, i apologize in advance if my question seems dumb.

I have a new 50Mbit/s synchronous link over fibre that the provider implements heavy traffic policing, with this they suggested i setup some shaping on our ASA to 47Mbit's with 50Mbit's bursts, i am hoping i have done this correctly. This is on an ASA 5520.

object network PABX

host 192.168.3.50

object network VOIP

subnet x.x.x.0 255.255.255.0

object-group service SIP-Trunks tcp-udp

port-object range 10020 10067

port-object eq sip

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

access-list outside_access_in extended permit object-group TCPUDP object VOIP object PABX

object-group SIP-Trunks

access-list global_mpc extended permit object-group TCPUDP 192.168.3.0

class-map DM_INLINE_Child-Class

match access-list global_mpc

policy-map DM_INLINE_Child-Policy

class DM_INLINE_Child-Class

priority

policy-map outside-policy

class class-default

shape average 47000000 50000000

service-policy DM_INLINE_Child-Policy

service-policy outside-policy interface outside

In addition i have setup voice traffic (SIP and RTP) for traffic prioritization, hoping i have done this correctly too.

Your help is much appreciated.

Re: ASA Traffic Shaping

Francesco Molino — Mon, 27 Aug 2018 23:25:43 GMT

Hi

The goal is to limit to 50Mbps the voice traffic or limit all traffic and have voice prioritized?

Re: ASA Traffic Shaping

TMaster100 — Mon, 27 Aug 2018 23:28:20 GMT

Yes, you are absolutely correct. We need to shape all traffic to 50Mbps but prioritize Voice.

Re: ASA Traffic Shaping

Francesco Molino — Tue, 28 Aug 2018 00:56:22 GMT

Commans are ok except the bust value.
Bust is a total of bits sent over a specific time.
I recommend you read the following articles:
https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s1.html

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/82310-qos-voip-vpn.html#anc6