topic Re: ASA Traffic Sharing between subnets in Network Security

ASA Traffic Sharing between subnets

danielnunes — Mon, 11 Mar 2019 19:17:00 GMT

Folks,

I'd like to implement a Traffic Sharing or Traffic shapping on ASA5520, I saw on the Conf. Guide that there is a way to do this using Qos, like this example "Bandwidth Management(Rate Limit) Using QoS Policies" but How can I use dynamic Qos Policy on ASA? For example, I have a Internet with 8Mbps and I want to give just 2Mbps to SUBNET_X, just 3Mbps to

SUBNET_Y and I want to share the 3Mbps between them.

Does ASA do this QoS mode?

Is there any guide or configuration example about it?

I think this configuration is related with Dynamic policy QoS, am I ok?

thanks a lot

Re: ASA Traffic Sharing between subnets

Kureli Sankar — Wed, 01 Dec 2010 02:42:45 GMT

Here is a doc that one of our engineers put together:

https://supportforums.cisco.com/docs/DOC-1230

I am not sure what you mean by "I want to share the 3Mbps between them."

-KS

Re: ASA Traffic Sharing between subnets

danielnunes — Wed, 01 Dec 2010 16:27:21 GMT

Hi Poonghuzali,

thanks for your helpful post.

Well, let me try again other example.

I have a Internet with 10Mbps and I'd like to give to SUBNET_A just a limit in 3Mbps

to SUBNET_B a limit in 3Mbps

and the rest of the BandW could be load sharing between SUBNET_A, SUBNET_B and other Subnets.

do you know what i mean?

thanks

Re: ASA Traffic Sharing between subnets

Panos Kampanakis — Wed, 01 Dec 2010 23:52:32 GMT

You could do that. Here is a sample config


ASA(config)# class-map subnetaA-cm
ASA(config-cmap)# match access-list 
ASA(config)# class-map subnetaB-cm
ASA(config-cmap)# match access-list 
ASA(config)# policy-map police-policy
ASA(config-pmap-c)# class subnetaa-cm
ASA(config-pmap-c)# police output 3000000
ASA(config-pmap-c)# class subnetaB-cm
ASA(config-pmap-c)# police output 3000000
ASA(config-pmap-c)# service-policy police-priority-policy interface


I hope it helps.

PK

Re: ASA Traffic Sharing between subnets

danielnunes — Thu, 02 Dec 2010 00:40:24 GMT

Hi Pkampana,

thanks for your attention, your configuration was really helpful and I'll study more about QoS.

I saw in that configuration we are using police output then, considering that Subnets A and B are

behind Inside side, do I need to put this police on Inside interface?

thanks a lot

Re: ASA Traffic Sharing between subnets

Panos Kampanakis — Thu, 02 Dec 2010 00:58:21 GMT

If you want to police what the inside subnet will download you need to change the "output" to "input" and it will be ok.

Let us know if it answers your question.

Rgs,

Re: ASA Traffic Sharing between subnets

danielnunes — Thu, 02 Dec 2010 10:45:22 GMT

Ok Friend!

thanks a lot for your attention.

see you!