Limiting outbound FTP Traffic

[imranraheel]

I want to limit the Outbound FTP access from my internet LAN. Is there any way to limit the outbound FTP traffic, also i already have an extended ACL applied on my WAN interface. Please let me know how to limit the traffic .

Thanks

[Federico Coto Fajardo]

Hi,

You can rate-limit FTP traffic by configuring Police.

Check out this document:

http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/conns_qos.html#wp1065257

Hope it helps.

Federico.

[imranraheel]

Thanks for the quick response.

ACn you give me an example also I have an existing ACL would the policy map effect that ACL

ip access-list ext ftp-acl

match protocol ftp

class-map ftp-class

match ip ftp-acl

policy-map outbound

class ftp-class

bandwitdh 4096

class class-default

bandwith 10240

Keeping in mind the specified details.

I have a 10MB circuit and on the WAN interface i already have and inbound and outbound ACL applied

[Federico Coto Fajardo]

This is on an ASA or IOS device?

Your WAN interface is a physical interface?

Federico.

[Federico Coto Fajardo]

From the output it seems it's an IOS router since the ASA does not supports NBAR.

So, on IOS (rate-limit FTP to 1Mb):

class-map FTP

  match protocol ftp

policy-map CBWFQ

  class FTP

    police 1mb

int s0

  service-policy out CBWFQ

You  could also do the above with a shape command instead of police.  The  policier will drop all FTP traffic above 1 Mb, a shaper will queue it  and to keep FTP from exceeding 1 Mb.

You could also not limit FTP bandwidth, but just prioritize to only use excess bandwidth.

e.g.

policy-map CBWFQ

  class FTP

    bandwidth percent 1

Federico.

[imranraheel]

I have applied the specified con

figs but it isnt working

class-map match-all FTP
match protocol ftp
!
!
policy-map FTP
  class FTP
  shape average 4000000
  bandwidth percent 30
  class class-default
  bandwidth percent 70

Interface fastethernet 0/0

service-policy output FTP

Can you let me know if thats correct if i have to limit FTP traffic to 4mb , also the bandwidth percent here is over all interface bandwidth or the service i am subscribed for or is that the bandwidth available on teh interface.