ASA Traffic Sharing between subnets

[danielnunes]

Folks,

I'd like to implement a Traffic Sharing or Traffic shapping on ASA5520, I saw on the Conf. Guide that there is a way to do this using Qos, like this example "Bandwidth Management(Rate Limit) Using QoS Policies" but How can I use dynamic Qos Policy on ASA? For example, I have a Internet with 8Mbps and I want to give just 2Mbps to SUBNET_X, just 3Mbps to

SUBNET_Y and I want to share the 3Mbps between them.

Does ASA do this QoS mode?

Is there any guide or configuration example about it?

I think this configuration is related with Dynamic policy QoS, am I ok?

thanks a lot

[Kureli Sankar]

Here is a doc that one of our engineers put together:

https://supportforums.cisco.com/docs/DOC-1230

I am not sure what you mean by "I want to share the 3Mbps between them."

-KS

[danielnunes]

Hi Poonghuzali,

thanks for your helpful post.

Well, let me try again other example.

I have a Internet with 10Mbps and I'd like to give to SUBNET_A just a limit in 3Mbps

                                                                       to SUBNET_B a limit in 3Mbps

and the rest of the BandW could be load sharing between SUBNET_A, SUBNET_B and other Subnets.

do you know what i mean?

thanks

[Panos Kampanakis]

You could do that. Here is a sample config

ASA(config)# class-map subnetaA-cm
ASA(config-cmap)# match access-list 
ASA(config)# class-map subnetaB-cm
ASA(config-cmap)# match access-list 
ASA(config)# policy-map police-policy
ASA(config-pmap-c)# class subnetaa-cm
ASA(config-pmap-c)# police output 3000000
ASA(config-pmap-c)# class subnetaB-cm
ASA(config-pmap-c)# police output 3000000
ASA(config-pmap-c)# service-policy police-priority-policy interface 

I hope it helps.

PK

[danielnunes]

Hi Pkampana,

thanks for your attention, your configuration was really helpful and I'll study more about QoS.

I saw in that configuration we are using police output then, considering that Subnets A and B are

behind Inside side, do I need to put this police on Inside interface?

thanks a lot

[Panos Kampanakis · Accepted solution]

If you want to police what the inside subnet will download you need to change the "output" to "input" and it will be ok.

Let us know if it answers your question.

Rgs,

PK

[danielnunes]

Ok Friend!

thanks a lot for your attention.

see you!