Bandwidth Limit on ASA

[marcio.tormente]

Hello folks!

Anyone knows how can I do bandwidth limit on ASA?

With QoS there is no bandwidth command available.

Thanks

Marcio

[Aditya Ganjoo]

Hi Marcio,

Please confirm the version of the ASA and the hardware model.

Also you can check this link to configure bandwidth limiting on the ASA:

http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/91790-pixasa7x-traffic-mgt.html

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[marcio.tormente]

Hello Aditya,

Thanks for your support

I have ASA 5555-X and the version is 9.5.(2).

I didn´t see your documment in detail, I saw that the configuration was based on PIX, I have to see if all command is supported on ASA 5555-X.

thanks

Marcio

[Aditya Ganjoo · Accepted solution]

Hi Marcio,

Yes all the commands are supported on ASA 5555-x.

This example shows how to throttle the bandwidth to 1 Mbps for a specific user in the outbound direction:

ciscoasa(config)# access-list WEB-LIMIT permit ip host 192.168.10.1 any
ciscoasa(config)# class-map Class-Policy
ciscoasa(config-cmap)# match access-list WEB-LIMIT
ciscoasa(config-cmap)#exit

ciscoasa(config)# policy-map POLICY-WEB
ciscoasa(config-pmap)# class Class-Policy
ciscoasa(config-pmap-c)# police output 1000000 conform-action transmit exceed-
action drop
ciscoasa(config-pmap-c)#exit
ciscoasa(config-pmap)#exit

ciscoasa(config)# service-policy POLICY-WEB interface outside

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[marcio.tormente]

Thanks Aditya!

This information will help me alot

[Aditya Ganjoo]

Glad to assist you Marcio !!!

[bishrow]

How can i throttle bandwidth for a range of IP Addresses? I saw you gave an example for one host

[Florin Barhala]

You just configure a class-map to match on the range of IPs needed.
What exactly do you mean by "throttle bandwidth" ? What you need to achieve?

[bishrow]

Okay let me explain more on what i need to achieve.

1. We have a Cisco ASA 5515

2. We have about 500 hosts which are sharing a bandwidth of 160 mbps of which we would want each host to share equally instead of lets say 10 hosts using more of the bandwidth than others.

3. So if possible we would like each host to be limited to a bandwidth of 200 kbps 

So far i have tried this configuration which does not seem to work as hosts cannot access the Internet when the service policy is applied.

access-list internet_outbound extended permit ip 192168.1.0 255.255.255.0 any

class-map internet_limit
match access-list internet_outbound

policy-map trottle_internet
class internet_limit

police output 200000 96000 conform-action transmit exceed-action drop 
police input 200000 96000 conform-action transmit exceed-action drop 

service-policy throttle_internet interface inside

Is there something that i am missing?

[Florin Barhala]

I don't think you can achieve your goal with ASA. This is Linux territory unless Cisco made some huge QoS improvements lately.

Still let's see some other thoughts.

[andrews_steven]

Hi Bishrom,

Did you end up getting a resolution on this?

We have upgraded from pfsense to an ASA and we used to have rate limiting that would restrict each host to only being able to get 7mb/7mb, but with the ASA I can only achieve doing an overall restriction to 7mb/7mb instead of allowing each host to achieve this.

Any help would be great, this seems like a basic feature Cisco is really missing out on if its not achievable.

Thank you,

Steven