ASA rate limiting

[Jon Marshall]

I have an ASA (5520) with an outside, DMZ, and inside interface and I want to rate limit the traffic (5Mbps) coming from the outside going to a specific server on the DMZ (192.168.3.3). 

Never set this up before and it is a live production firewall so would like a sanity check please. 

I have this configuration - 

asa(config)# access-list WEB_SERVER permit ip any host 192.168.3.3
asa(config)# class-map Web-Policy
asa(config-cmap)# match access-list WEB-SERVER

asa(config)# policy-map WEB
asa(config-pmap)# class Web-Policy
asa(config-pmap-c)# police 5000000 conform-action transmit exceed-action drop

asa(config)# service-policy Web-Policy interface in DMZ 

1) will this work ? 

2) is the interface I have applied the service policy to the correct one or should it be the outside interface ? 

Thanks 

Jon

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/82310-qos-voip-vpn.html

Check thisb

[Jon Marshall]

I did, that was the document I used  

Wasn't clear to me which interface to apply it to though, I am assuming rate limiting is done outbound by the looks of it. 

[MHM Cisco World]

""Finally attach the shaping policy to the interface on which to shape and prioritize outbound traffic""

As cisco doc. It apply to interface outbound traffic. So it must be outside (nameif).

[balaji.bandi]

Looks like OP mentioned DMZ (i think he want to do in DMZ i guess)

asa(config)# service-policy Web-Policy interface in DMZ  ( syntax may be wrong, but that is what his intention i guess)

[Jon Marshall]

I want to limit traffic going to a server in the DMZ so I assumed it would either be applied inbound on the outside interface or outbound on the DMZ interface but definitely not inbound on the DMZ interface as far as I can tell. 

[Jon Marshall]

So outbound would be the DMZ interface in my case as I am not trying to limit traffic to the internet (which most of the examples seem to be about) but limit coming from the internet to a server in the DMZ.

Jon

[balaji.bandi]

yes that should work as expected.