ASA Traffic Shaping

[TMaster100]

Hello Cisco Guru's,

As a start i am no expert at ASA's but manage to find my way around them, i apologize in advance if my question seems dumb.

I have a new 50Mbit/s synchronous link over fibre that the provider implements heavy traffic policing, with this they suggested i setup some shaping on our ASA to 47Mbit's with 50Mbit's bursts, i am hoping i have done this correctly.   This is on an ASA 5520.

object network PABX

 host 192.168.3.50

object network VOIP

 subnet x.x.x.0 255.255.255.0

object-group service SIP-Trunks tcp-udp

 port-object range 10020 10067

 port-object eq sip

object-group protocol TCPUDP

 protocol-object udp

 protocol-object tcp

!

access-list outside_access_in extended permit object-group TCPUDP object VOIP object PABX

object-group SIP-Trunks

!

access-list global_mpc extended permit object-group TCPUDP 192.168.3.0

!

class-map DM_INLINE_Child-Class

 match access-list global_mpc

!

policy-map DM_INLINE_Child-Policy

 class DM_INLINE_Child-Class

  priority

policy-map outside-policy

 class class-default

  shape average 47000000 50000000

  service-policy DM_INLINE_Child-Policy

!

service-policy outside-policy interface outside

In addition i have setup voice traffic (SIP and RTP) for traffic prioritization, hoping i have done this correctly too.

Your help is much appreciated.

[Francesco Molino]

Hi

The goal is to limit to 50Mbps the voice traffic or limit all traffic and have voice prioritized?

[TMaster100]

Yes, you are absolutely correct. We need to shape all traffic to 50Mbps but prioritize Voice.

[Francesco Molino]

Commans are ok except the bust value.
Bust is a total of bits sent over a specific time.
I recommend you read the following articles:
https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s1.html

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/82310-qos-voip-vpn.html#anc6