topic ASA 5510 priority queue in Network Security

ASA 5510 priority queue

matthew-f — Tue, 12 Mar 2019 01:11:38 GMT

Hey Everyone:

Just after some help with an ASA 5510 QoS config for our lab. Trying to set-up a priority queue for Voice and Video traffic, below is the current ASA config. The WAN link is 6mb, trying to limit the Internet traffic to 4mb and save 2mb for the PQ, config below, any help appreciated. Traffic just isn't hitting the PQ

priority-queue outside

queue-limit 512

tx-ring-limit 200

class-map Video

description Video

match dscp af31

class-map priority_VoIP

description High Priority = VoIP

match dscp ef

policy-map PRIORITY

class priority_VoIP

priority

class Video

priority

policy-map shaping

class inspection_default

inspect pptp

inspect icmp

inspect icmp error

inspect netbios

inspect dns

inspect ipsec-pass-thru

inspect http

inspect sip

class class-default

shape average 4096000

service-policy PRIORITY

service-policy shaping interface outside

Queue Type = BE

Tail Drops = 0

Reset Drops = 0

Packets Transmit = 462212354

Packets Enqueued = 240158

Current Q Length = 0

Max Q Length = 160

Queue Type = LLQ

Tail Drops = 0

Reset Drops = 0

Packets Transmit = 0

Packets Enqueued = 0

Current Q Length = 0

Max Q Length = 0

Please dont post PDF's or links, looking for some proper feedback as i've been labbing this up befoe posting to the forum

cheers

Matt

ASA 5510 priority queue

matthew-f — Fri, 08 Mar 2013 15:05:56 GMT

My thoughts are it might be something to do with the class inspection_default being above the class-default. I still need to reference those inspect commands somewhere as i need services like pptp to work from inside to out

Matt

ASA 5510 priority queue

Julio Carvajal — Fri, 08 Mar 2013 15:08:38 GMT

Hello Matthew,

Configuration looks good to me,

It just that the Priority queue has not kick in...

As a test have you lower the available bandwith available for the best effort traffic? just to see if that triggers the LLQ

Regards

ASA 5510 priority queue

matthew-f — Fri, 08 Mar 2013 15:18:38 GMT

I lowered the number to 2960000 which by my calculation is just under 2mb and still no traffic hitting the PQ. I also removed the class inspection_default with the number at 2960000 and still no joy.

cheers

Matt

ASA 5510 priority queue

matthew-f — Fri, 08 Mar 2013 15:25:32 GMT

The strange thing is, with have about 6mb bandwidth, video call's and conferences below 2mb are crystal clear, as we have restricted the other traffic to 4mb max via the shape, almost as if they are getting the reversed 2mb bandwidth, but they don't show up in the LLQ, does anyone have any theories on that?

Matt

ASA 5510 priority queue

Julio Carvajal — Fri, 08 Mar 2013 16:59:49 GMT

Hmm,

Strange,

can you share

show service-policy priority

Show service-policy shaping

Regards

ASA 5510 priority queue

matthew-f — Fri, 08 Mar 2013 18:19:45 GMT

show service-policy priority has NO output, no error's, just no output

-------

sh service-policy shape

Interface outside:

Service-policy: shaping

Class-map: class-default

shape (average) cir 3584000, bc 14336

(pkts output/bytes output) 13734055/8235687800

(total drops/no-buffer drops) 47123/0

Service-policy: PRIORITY

------

sh service-policy interface outside

Interface outside:

Service-policy: shaping

Class-map: inspection_default

Inspect: pptp, packet 0, drop 0, reset-drop 0

Inspect: icmp, packet 640, drop 8, reset-drop 0

Inspect: icmp error, packet 64, drop 0, reset-drop 0

Inspect: netbios, packet 371, drop 0, reset-drop 0

Inspect: dns _default_dns_map, packet 28474, drop 0, reset-drop 0

Inspect: ipsec-pass-thru _default_ipsec_passthru_map, packet 0, drop 0, reset-drop 0

Inspect: http, packet 1695864, drop 0, reset-drop 0

Inspect: sip , packet 4, drop 0, reset-drop 0

tcp-proxy: bytes in buffer 0, bytes dropped 0

Class-map: class-default

shape (average) cir 3584000, bc 14336

(pkts output/bytes output) 13739572/8241058643

(total drops/no-buffer drops) 47135/0

Service-policy: PRIORITY

Class-map: priority_VoIP

priority

Queueing

queue limit 64 packets

(queue depth/total drops/no-buffer drops) 0/0/0

(pkts output/bytes output) 0/0

Class-map: Video

priority

Queueing

queue limit 64 packets

(queue depth/total drops/no-buffer drops) 0/0/0

(pkts output/bytes output) 0/0

Class-map: class-default

Default Queueing

queue limit 64 packets

(queue depth/total drops/no-buffer drops) 0/47135/0

(pkts output/bytes output) 13739727/8241090250