Determine how much traffic is from streaming services on ASA

[michael_bartho]

Hi all,

On an ASA5525-X, how do I determine how much traffic is from streaming services, Netflix, Spotify, YouTube and so on, and how to effectively deny the traffic, if any? The use case would be, how limit AnyConnect users so they don't consume unnecessary ASA bandwidth/compute on streaming services.

Kind regards,

Michael

[balaji.bandi]

If you have setup netflow you can view what kind of bandwidth using each application/service.

if you looking to restrict VPN user bandwidth, you can start implementing the QoS on network for the Any connect users

[michael_bartho]

I don't have any netflow application configured, and I guess that It will only reveal how much traffic the AnyConnect clients consume for streaming.

About QoS, could I prioritize TCP traffic from the clients, thus ensuring internal resources (RDP, shares, applications etc.) and preferable drop UDP traffic if necessary? (i know it's not fool proof)

[balaji.bandi]

QoS you can do that based on your priority test will be low preferred.

[Cristian Matei]

Hi,

    For AnyConnect users, you could use split-tunnelling, so all unneeded traffic is routed directly to the local breakout, instead of the VPN tunnel. This would be the best option.

    Now to really stand a chance and block that traffic in case you don't want split-tunnelling, or for your internal users, you would need a smart proxy deployed, or you could use MPF on the ASA(but this is far from being bullet proof):

class-map match-all NETFLIX

 match protocol http host "*netflix.com*"

Regards,

Cristian Matei.

[michael_bartho]

The reason i can't do spilt-tunnel, is because our public IP is whitelisted with a lot of services around the globe. If I had a complete overview I'd might be able to hack something together.

I'll have a look at MPF, but as you said yourself, it's far from bullet proof and requires some manual grunt work to function properly :)

Just out of curiosity, what smart proxy solutions could have dealt with my issue?

[Cristian Matei]

Hi,

   You would need to do URL Filtering and/or app blocking. For example Cisco WSA is one such proxy; you may not be able to block everything which is tunnelled over HTTP/HTTPS with the basic functionality, but with some advanced tuning you'll make it.

Regards,

Cristian Matei.