Solved: ASA rate limit downloads from internet

guy tec · ‎11-04-2013

Hi all,

I have a Cisco ASA 5512 that sits between my LAN and the internet (all traffic is natted/patted to the outside).

I have multiple subnets, each subnet has its own VLAN, and sub interface on the ASA.

Now I want to overcome that one of my subnets can fill the whole internet pipe (both download from the internet and upload to the internet)

If I understand it correctly I can do this with a service policy that does policing.

Now my question, on what interface do I need to apply the policy? and what kind of policing do I need, inbound and/or outbound?

Do I need 2 policys, one for the download limiting, one for the upload limiting?

Karsten Iwen · ‎11-04-2013

Yes, that's a way it can be implemented. You could think about using a service-policy on the inside interface for outgoing traffic because it doesn't make any sense to first process the traffic in the ASA and later to drop it on the outside interface. But with your ASA you probably won't run into any performance problems.

NAT/PAT is handled transparently in your ASA-version. That was different in the versions < 8.3, but these are not available for your ASA.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

View solution in original post

Karsten Iwen · ‎11-04-2013

Yes, you can use policing for that. It can be done both in the inbound and outbound direction:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/mpf_service_policy.html#wp1162717

Here is an example on how to activate it:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/conns_qos.html#wp1221898

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni