topic Re: ASA 5505 Shaping in Network Security

ASA 5505 Shaping

Dustin Barnett — Wed, 13 Mar 2019 01:02:00 GMT

I'm attempting to configure qos on our ASA 5505 and I'm not sure how to determine what our average and burst rates should be.

The applications being used will be RDP over a ipsec tunnel, so it is somewhat sensitive to latency.

The final setup will be a 1.54Mb T1 line, but in testing I have a DSL connection with .70Mb U/L speed.

Re: ASA 5505 Shaping

Syed Usaid K — Thu, 28 Apr 2011 04:01:50 GMT

Hi,

Hope this thread will help you,

https://supportforums.cisco.com/docs/DOC-1230

Regards,

Syed Usaid.K

Re: ASA 5505 Shaping

Dustin Barnett — Thu, 28 Apr 2011 15:46:47 GMT

Thanks, I used the shaping with prioitization example, but I am having problems while testing. To test, I upload a file via ftp to a remote server on the internet, and then attempt to start an rdp connection on a different computer, but it is very laggy. I can see the traffic is being shaped in the FTP client, and also through the ASDM traffic graph.

Here is the current configuration created by ASDM. I also created one using only the command line, but the results were the same so I thought I had made a mistake.

class-map DM_INLINE_Child-Class

match port tcp eq 3389

match tunnel-group 192.168.100.1

policy-map DM_INLINE_Child-Policy

class DM_INLINE_Child-Class

priority

policy-map outside-policy

class class-default

shape average 256000

service-policy DM_INLINE_Child-Policy

Re: ASA 5505 Shaping

Dustin Barnett — Thu, 28 Apr 2011 18:47:11 GMT

After more testing, it looks as if the priority setting is not doing anything...It seems no matter how I configure the priority settings, the traffic is still shaped to whatever the average rate is configured at. I have tried setting priority by tunnel group, port number, and access-lists, but there is no effect! Is it because I'm trying to give priority to traffic on an ipsec tunnel?

Not sure what the issue could be. Here is one configuration that seems to be shaping all traffic and not giving priority:

access-list priority extended permit ip 192.168.220.0 255.255.255.0 192.168.50.0 255.255.255.0

priority-queue outside

class-map DM_INLINE_Child-Class
match access-list priority
!
!
policy-map DM_INLINE_Child-Policy
class DM_INLINE_Child-Class
priority
policy-map outside-policy
class class-default
shape average 256000
service-policy DM_INLINE_Child-Policy
policy-map DM_INLINE_Child-Class
!
service-policy outside-policy interface outside