topic Re: ASA Security Contexts - rate limit in Network Security

ASA Security Contexts - rate limit

niima — Fri, 21 Feb 2020 15:53:29 GMT

Dear experts,

Is one able to rate limit below items when configuring security context on a ASA5520?

1) NAT

2)MAC Learning

3) Stateful packet inspections

My understanding is that only ASDM sessions rate and connections rate as well as syslog msg rates are the only options to rate limit? Am I wrong? your input is much appreciated.

Re: ASA Security Contexts - rate limit

Marvin Rhoads — Sun, 17 Jun 2018 14:46:05 GMT

Yes to all three - as well as several others you didn't mention.

A complete listing can be found here:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/configuration/general/asa-99-general-config/ha-contexts.html#ID-2171-00000181

Re: ASA Security Contexts - rate limit

niima — Sun, 17 Jun 2018 14:55:25 GMT

Hi Marvin,

Appreciate your prompt response. However I am a bit confused. The list mentions about mac-address and inspect. (attached)

mac-address: does it mean the rate limit of mac address learning in a second or its only the maximum number of macs in the mac table?

inspect: is it only Application inspections per second or its stateful packet inspection as well? (I don't think this two are the same, are they?)

Re: ASA Security Contexts - rate limit

Marvin Rhoads — Sun, 17 Jun 2018 15:01:13 GMT

You're welcome.

For mac address it's the latter.

Inspects is (are) application inspections per second.

What's the use case you're looking to address with the answer to these questions?

Re: ASA Security Contexts - rate limit

niima — Sun, 17 Jun 2018 15:43:27 GMT

I am preparing for an exam, I came up to a question that I found in a discussion forum which many people are arguing on different answers.

It is asking: which three resource class limits can be set using a rate limit? (Choose three.)

A. address translation rate
B. Cisco ASDM session rate
C. connections rate
D. MAC-address learning rate (when in transparent mode)
E. syslog messages rate
F. stateful packet inspections rate

Re: ASA Security Contexts - rate limit

niima — Mon, 18 Jun 2018 05:19:34 GMT

So what are your thoughts Melvin?

Re: ASA Security Contexts - rate limit

Marvin Rhoads — Mon, 18 Jun 2018 14:30:38 GMT

The answer would be c, e, and f.

The reason is because, as indicated in the link I provided earlier, those are the only parameters in that list that are limited by "rate" (vs. by a "concurrent" number).