Guest Vlan - Best Practise Implementation

[anthony.dyne]

Hello

How to allow guest vlan traffic for http procotol only and limit bandwidth usage, looking for best practise implementation.Blocking peer-to-peer appliction too.

In short our ASA is placed as

Internet-rtr______ASA________3560_____LAN

On ASA we allow SMTP / HTTP / HTTPS from outside to inside

ACL is applied on ASA inside interface to have control on traffic, users on the LAN access internet through Microsoft ISA Server.

thanks

Anthony

[Kureli Sankar]

1. Police that vlan traffic either on the inside switch or on the ASA.

QoS on ASA : https://supportforums.cisco.com/docs/DOC-1230

2. Use websense for content scanning/filtering or use the CSC module on the ASA for http scanning/URL filtering.

http://www.cisco.com/en/US/docs/security/csc/csc6.1.1569.0/administration/guide/csc4.html

-KS

[anthony.dyne]

Thank You KS for your input.

Based on your experience do you advice to Police the traffic on the switch or on the ASA as both options are available.

Thanks

Anthony

[Kureli Sankar]

I'd suggest to do it on the switch. This way you can control what comes into the inside interface of the firewall.

-KS