11-04-2013 04:24 AM - edited 03-11-2019 07:59 PM
Hi all,
I have a Cisco ASA 5512 that sits between my LAN and the internet (all traffic is natted/patted to the outside).
I have multiple subnets, each subnet has its own VLAN, and sub interface on the ASA.
Now I want to overcome that one of my subnets can fill the whole internet pipe (both download from the internet and upload to the internet)
If I understand it correctly I can do this with a service policy that does policing.
Now my question, on what interface do I need to apply the policy? and what kind of policing do I need, inbound and/or outbound?
Do I need 2 policys, one for the download limiting, one for the upload limiting?
Solved! Go to Solution.
11-04-2013 07:07 AM
Yes, that's a way it can be implemented. You could think about using a service-policy on the inside interface for outgoing traffic because it doesn't make any sense to first process the traffic in the ASA and later to drop it on the outside interface. But with your ASA you probably won't run into any performance problems.
NAT/PAT is handled transparently in your ASA-version. That was different in the versions < 8.3, but these are not available for your ASA.
--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni
11-04-2013 04:35 AM
Yes, you can use policing for that. It can be done both in the inbound and outbound direction:
Here is an example on how to activate it:
http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/conns_qos.html#wp1221898
--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni