topic Hello Shrikant, Thanks for in Network Security

Restricting the bandwidth for particular subnet in ASA 5545

shoaib sheikh — Tue, 12 Mar 2019 05:27:47 GMT

Hello Freinds,

We have ASA 5545 connected to internet Router 3925. We are creating
site to site VPN From Firewall and want to restrict the bandwidth of the users
travelling in the VPN. I know the process for router but not getting the
configuration for firewall as options for policing traffic are not coming under policy-map command in ASA.

Configuration for router:

ip access-list extended 105
permit ip 10.10.10.0 0.0.0.255 any

class-map test
match access-group 105

policy-map test1
class test
police cir 1000000
conform-action transmit
exceed-action drop
violate-action drop

int Gixx
service-policy output test1

Please help me with the equivalent configuration for ASA 5545.

Hi Shoaib,you can do the same

Shrikant Jadhav — Mon, 09 Feb 2015 13:00:56 GMT

Hi Shoaib,

you can do the same by referring below on ASA:

CLASSIFYING TRAFFIC-:

access-list capin1 permit ip 10.10.10.0 0.0.0.255 any

access-list capin1 permit ip any 10.10.10.0 0.0.0.255
Access-list cap permit ip any any ---> this is for all other traffic except 10.10.10.0

MATCHING THE TRAFFIC-:

class-map capin1
match access-list capin1

Class-map cap
Match access-list cap

TAKING THE ACTION UNDER THE GLOBAL POLICY-:

policy-map global_policy
class capin1
police input 1000000 -------to allocate the 10 Mbps for only 10.x.x.x network IN and OUT
police output 1000000
Class cap
Police input 20000000 ------to allocate the 20 Mbps for other network subnets IN and OUT
Police output 20000000

Thanks

Shrikant

In ASA the access list wouldn

APPIREDDY — Mon, 09 Feb 2015 18:11:14 GMT

In ASA the access list wouldn't take wild card mask, instead it should be subnet mask, hence

access-list capin1 permit ip 10.10.10.0 0.0.0.255 any

access-list capin1 permit ip any 10.10.10.0 0.0.0.255
Access-list cap permit ip any any ---> this is for all other traffic except 10.10.10.0

should be

access-list capin1 permit ip 10.10.10.0 255.255.255.0 any

access-list capin1 permit ip any 10.10.10.0 255.255.255.0
Access-list cap permit ip any any ---> this is for all other traffic except 10.10.10.0

Hello Shrikant, Thanks for

shoaib sheikh — Fri, 20 Feb 2015 04:52:20 GMT

Hello Shrikant,

Thanks for your input. The ASA is giving the the following error when putting police command.

policy-map global_policy

class restrict_FL

police ?

ERROR: % Unrecognized command

For your information the ASA is 5545 and I am trying to put this command in context mode. So, please let me know the commands supported in context.