ASA 5510 traffic policing

[itadmin]

I am trying to set up policing from 3 particular servers. The traffic that I want to limit is https (443) connections. The service policy rules that I have set up so far seem to have no effect at all. I'm using the traffic match criteria source and destination IP address, I have the source and destination configured, and I've tried several different services. Under rule actions, protocol selection is set to DCERPC selected, QoS is set to enable policing on input and output, rate is set to 250000.

What am I missing.

Thanks

Mike

[mirober2]

Hi Mike,

Do you have priority queueing enabled as well? This link may help you fix the problem:

https://supportforums.cisco.com/docs/DOC-1230

NOTE 2: Priority queueing needs to be used with 
policing or traffic shaping. The reason is that unless the link that LLQ
 is saturated the packets will not be prioritized. Usually the 
interfaces of the ASA can be 100Mbps or 1Gbps or more, so saturating 
these links isn't something that will happen often . But implementing 
policing or traffic shaping along with LLQ actually makes LLQ kick in at
 the point the policing or shaping limits are met. 

Hope that helps.

-Mike

[Panos Kampanakis]

Please also send us the "sh run class-map", "sh run policy-map", "sh run service-policy" and the ACLs used in the class-maps in order to do a sanity check on the config.

PK

[itadmin]

How do I show the ACL's? I attached the other files..

[mirober2]

Hi Mike,

To see the ACLs used for this config, you can use the following command:

show run access-list inside_mpc

-Mike

[itadmin]

File as requested. I really appreciate the help

Mike

[Panos Kampanakis]

I see the ACL lines being inactive. These will not be matching traffic.

Please put them in again without the inactive keyword.

PK

[itadmin]

When they were active, it didn't have an effect..

[Panos Kampanakis]

You are applying your policy on the inside interface policing at 250kbps for traffic from your 172.... hosts to the 65.... hosts on port 443.

When the lines were active did you see hitcounts on them "sh access-list . If yes, they you were policing.

do you want to policy https download from the hosts, or http uploads? If it is uploads the source port of the ACL should be https, and not the destination.

I hope it helps.

PK

[itadmin]

Hitcount was 0 after I just re-enabled them, I want incoming and out going traffic from the 172.16.10.81-83 IP's to be policed.