topic Re: Limiting outbound FTP Traffic in Network Security

Limiting outbound FTP Traffic

imranraheel — Mon, 11 Mar 2019 19:40:53 GMT

I want to limit the Outbound FTP access from my internet LAN. Is there any way to limit the outbound FTP traffic, also i already have an extended ACL applied on my WAN interface. Please let me know how to limit the traffic .

Thanks

Re: Limiting outbound FTP Traffic

Federico Coto Fajardo — Thu, 27 Jan 2011 17:44:36 GMT

Hi,

You can rate-limit FTP traffic by configuring Police.

Check out this document:

http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/conns_qos.html#wp1065257

Hope it helps.

Federico.

Re: Limiting outbound FTP Traffic

imranraheel — Thu, 27 Jan 2011 19:20:43 GMT

Thanks for the quick response.

ACn you give me an example also I have an existing ACL would the policy map effect that ACL

ip access-list ext ftp-acl

match protocol ftp

class-map ftp-class

match ip ftp-acl

policy-map outbound

class ftp-class

bandwitdh 4096

class class-default

bandwith 10240

Keeping in mind the specified details.

I have a 10MB circuit and on the WAN interface i already have and inbound and outbound ACL applied

Re: Limiting outbound FTP Traffic

Federico Coto Fajardo — Thu, 27 Jan 2011 20:14:07 GMT

This is on an ASA or IOS device?

Your WAN interface is a physical interface?

Federico.

Re: Limiting outbound FTP Traffic

Federico Coto Fajardo — Fri, 28 Jan 2011 04:36:39 GMT

From the output it seems it's an IOS router since the ASA does not supports NBAR.

So, on IOS (rate-limit FTP to 1Mb):

class-map FTP

match protocol ftp

policy-map CBWFQ

class FTP

police 1mb

int s0

service-policy out CBWFQ

You could also do the above with a shape command instead of police. The policier will drop all FTP traffic above 1 Mb, a shaper will queue it and to keep FTP from exceeding 1 Mb.

You could also not limit FTP bandwidth, but just prioritize to only use excess bandwidth.

e.g.

policy-map CBWFQ

class FTP

bandwidth percent 1

Federico.

Re: Limiting outbound FTP Traffic

imranraheel — Sun, 30 Jan 2011 07:10:23 GMT

I have applied the specified con

figs but it isnt working

class-map match-all FTP
match protocol ftp
!
!
policy-map FTP
class FTP
shape average 4000000
bandwidth percent 30
class class-default
bandwidth percent 70

Interface fastethernet 0/0

service-policy output FTP

Can you let me know if thats correct if i have to limit FTP traffic to 4mb , also the bandwidth percent here is over all interface bandwidth or the service i am subscribed for or is that the bandwidth available on teh interface.