topic Re: Hi Marcio, in Network Security

Bandwidth Limit on ASA

marcio.tormente — Tue, 12 Mar 2019 07:51:42 GMT

Hello folks!

Anyone knows how can I do bandwidth limit on ASA?

With QoS there is no bandwidth command available.

Thanks

Marcio

Hi Marcio,

Aditya Ganjoo — Wed, 08 Jun 2016 16:07:46 GMT

Hi Marcio,

Please confirm the version of the ASA and the hardware model.

Also you can check this link to configure bandwidth limiting on the ASA:

http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/91790-pixasa7x-traffic-mgt.html

Regards,

Aditya

Please rate helpful posts and mark correct answers.

Hello Aditya,

marcio.tormente — Wed, 08 Jun 2016 16:29:31 GMT

Hello Aditya,

Thanks for your support

I have ASA 5555-X and the version is 9.5.(2).

I didn´t see your documment in detail, I saw that the configuration was based on PIX, I have to see if all command is supported on ASA 5555-X.

thanks

Marcio

Hi Marcio,

Aditya Ganjoo — Wed, 08 Jun 2016 16:45:21 GMT

Hi Marcio,

Yes all the commands are supported on ASA 5555-x.

This example shows how to throttle the bandwidth to 1 Mbps for a specific user in the outbound direction:

ciscoasa(config)# access-list WEB-LIMIT permit ip host 192.168.10.1 any
ciscoasa(config)# class-map Class-Policy
ciscoasa(config-cmap)# match access-list WEB-LIMIT
ciscoasa(config-cmap)#exit

ciscoasa(config)# policy-map POLICY-WEB
ciscoasa(config-pmap)# class Class-Policy
ciscoasa(config-pmap-c)# police output 1000000 conform-action transmit exceed-
action drop
ciscoasa(config-pmap-c)#exit
ciscoasa(config-pmap)#exit

ciscoasa(config)# service-policy POLICY-WEB interface outside

Regards,

Aditya

Please rate helpful posts and mark correct answers.

Thanks Aditya!

marcio.tormente — Wed, 08 Jun 2016 16:55:55 GMT

Thanks Aditya!

This information will help me alot

Glad to assist you Marcio !!!

Aditya Ganjoo — Wed, 08 Jun 2016 16:57:08 GMT

Glad to assist you Marcio !!!

Re: Hi Marcio,

bishrow — Mon, 07 May 2018 17:26:08 GMT

How can i throttle bandwidth for a range of IP Addresses? I saw you gave an example for one host

Re: Hi Marcio,

Florin Barhala — Tue, 08 May 2018 11:52:37 GMT

You just configure a class-map to match on the range of IPs needed.
What exactly do you mean by "throttle bandwidth" ? What you need to achieve?

Re: Hi Marcio,

bishrow — Tue, 08 May 2018 13:19:40 GMT

Okay let me explain more on what i need to achieve.

1. We have a Cisco ASA 5515

2. We have about 500 hosts which are sharing a bandwidth of 160 mbps of which we would want each host to share equally instead of lets say 10 hosts using more of the bandwidth than others.

3. So if possible we would like each host to be limited to a bandwidth of 200 kbps

So far i have tried this configuration which does not seem to work as hosts cannot access the Internet when the service policy is applied.

access-list internet_outbound extended permit ip 192168.1.0 255.255.255.0 any

class-map internet_limit
match access-list internet_outbound

policy-map trottle_internet
class internet_limit

police output 200000 96000 conform-action transmit exceed-action drop
police input 200000 96000 conform-action transmit exceed-action drop

service-policy throttle_internet interface inside

Is there something that i am missing?

Re: Hi Marcio,

Florin Barhala — Tue, 08 May 2018 13:28:10 GMT

I don't think you can achieve your goal with ASA. This is Linux territory unless Cisco made some huge QoS improvements lately.

Still let's see some other thoughts.

Re: Hi Marcio,

andrews_steven — Wed, 19 Dec 2018 00:57:29 GMT

Hi Bishrom,

Did you end up getting a resolution on this?

We have upgraded from pfsense to an ASA and we used to have rate limiting that would restrict each host to only being able to get 7mb/7mb, but with the ASA I can only achieve doing an overall restriction to 7mb/7mb instead of allowing each host to achieve this.

Any help would be great, this seems like a basic feature Cisco is really missing out on if its not achievable.

Thank you,

Steven