ASA 5506 Policing SMB Traffic

rschember1 · ‎10-26-2017

I need to be able to police SMB traffic from a Windows 2016 server (10.10.1.11) to a specific Windows 10 PC (10.10.20.12) and I just can't get it working.

Interestingly, if I use FTP, the policing DOES work. If I use Windows Explorer, it bypasses the policing and it's allowed to use all of the available bandwidth, saturating the network. I used NetMon to check the ports, and it's using TCP/139. Even specifically adding TCP/139 to the object group does not work.

What am I missing? Is the ASA incapable of policing SMB traffic?

object-group protocol IP_TCP_UDP
 protocol-object ip
 protocol-object tcp
 protocol-object udp

access-list Server_Win10 extended permit object-group IP_TCP_UDP host 10.10.1.11 host 10.10.20.12 

class-map Server_Win10
 match access-list Server_Win10

policy-map inside_policy
 class Server_Win10
  police input 1500000 1500
  police output 1500000 1500

service-policy inside_policy interface inside_1
service-policy inside_policy interface inside_2

Flavio Miranda · ‎10-27-2017

Hello @rschember1

Try add port 445 as well. Also, this port can be used: 137 (UDP) 138 (UDP)

-If I helped you somehow, please, rate it as useful.-

rschember1 · ‎10-27-2017

No, it still doesn't work. It's totally bizarre. It seems to work for everything except copying files from Windows Explorer between windows. Then it bypasses the bandwidth policing and saturates the network.