topic QOS in Network Security

QOS

Tuba — Mon, 14 Oct 2019 06:48:23 GMT

I have a server that downloads a lot of data from the internet want, I to configure policing to reduce the input, output of the server to CIR 25000, but I see overall utilization of the outside interface of 100% during download

access-list QoS extended permit ip any any

class-map Internet-to-VPNs
 match access-list QoS

class Internet-to-VPNs
  police input 5500000 2748
  police output 5500000 2748
!
service-policy outside-policy interface outside

Re: QOS

Mohammed al Baqari — Mon, 14 Oct 2019 10:27:52 GMT

Hi, If the server is downloading TCP, then policing for traffic from
internet on the internet port in ingress direction will help. When the
policier starts dropping traffic, TCP sender will notice lost ACKs and will
slow transmission speed.

If the server is downloading UDP, then policy won't help because the sender
will keep dumping traffic which you will see at the ingress interface even
if your policiers drops it, like a DoS attack.

**** remember to rate useful posts