QoS ASA 5505 policing

[kgreenway]

Hi All,

I'm looking for some assistance on QoS policing configuration on an ASA 5505.

The ASA is situated behind a cable modem which provides an SLA of 3.2Mbps out.

I've configured a QOS policy to place VoIP and other essential traffic (RDP/Citrix/PCoIP) into a priority queue, whilst policing default class to 3.2Mbps to police out to the cable modem.

I can see on the outside interface graphs that this is rating the output traffic down to 3.2Mbps as expected, but noticing at certain points of high output traffic drops down to 1.6Mbps.  I can't see anything obvious in syslog or any other areas to look, so looking for any pointers as to why the speed is suddenly dropping down.  Likewise if I rate the output to 2Mbps, it will suddenly drop down to 1Mbps at high output rates.

The ASA is running on 8.0(5) and I enclose a copy of the sample QoS config below and attached a sanitized run config, as well as screenshot taken of the outside interface Bit Rates plus service-policy.

Any help much appreciated!

access-list VoIP-Traffic-OUT extended permit tcp 172.16.6.0 255.255.255.0 host 68.98.217.252 eq h323

access-list VoIP-Traffic-OUT extended permit udp 172.16.6.0 255.255.255.0 host 68.98.217.252 object-group rtp

access-list VoIP-Traffic-OUT extended permit tcp 172.16.6.0 255.255.255.0 host 68.98.217.252 eq 2000

access-list VMs-Traffic-Out extended permit tcp 172.16.6.0 255.255.255.0 192.168.168.0 255.255.255.0 eq 3389

access-list VMs-Traffic-Out extended permit tcp 172.16.6.0 255.255.255.0 192.168.168.0 255.255.255.0 eq citrix-ica

access-list VMs-Traffic-Out extended permit tcp 172.16.6.0 255.255.255.0 192.168.168.0 255.255.255.0 eq 4172

access-list VMs-Traffic-Out extended permit udp 172.16.6.0 255.255.255.0 192.168.168.0 255.255.255.0 eq 4172

access-list VMs-Traffic-Out extended permit tcp 172.16.6.0 255.255.255.0 192.168.168.0 255.255.255.0 eq 32111

class-map UKVoice-OUT

match dscp ef

class-map Voice-OUT

match access-list VoIP-Traffic-OUT

class-map VMs-OUT

match access-list VMs-Traffic-Out

policy-map QOS-TRAFFIC-OUT

class Voice-OUT

  priority

class UKVoice-OUT

  priority

class VMs-OUT

  priority

class class-default

  police output 3200000

service-policy QOS-TRAFFIC-OUT interface outside

[Julio Carvajal]

Hello,

So at the moment of the issue the traffic rate is the same than when we are running at 3.2 mbps?

One thing I notice is that on the running configuration you attached you only are using one service-policy

service-policy global_policy global

I do not see this:

service-policy QOS-TRAFFIC-OUT interface outside

Can U doble check that

[kgreenway]

Hi,

Thanks for replying.

Yes you are correct the service-policy QOS-TRAFFIC-OUT interface outside command was temporarily disabled from the sh run, to confirm the issue with rate drop is not due to the cable modem itself.

I can confirm 100% this was in the config at the point the screenshots were observed. 

Any ideas?

Thanks,

Kevin

[Julio Carvajal]

Hello Kevin,

Well, If that's the case I do not see a reason why this should not be working,

Any reason why we have on 2 different policy-maps the priority queue configured?

Do you want to apply it globally and not just on the outside interface?

How is the ASA CPU/Interface errors/Memory when you see that drop?

Regards

[kgreenway]

Hi,

The other policy-map is left in there for historical reasons and I inherited that as is.

The CPU runs between 18-23%, Memory at 200MB with no spikes or interface errors at the time the problem occurs., so very strange..

Any further ideas would be appreciated, as this is really confusing me..

Thanks,

Kevin

[Favaloro.]

What's the total amount of bandwidth on the outside?

Do you notice any problems with the downloads while the problem is happening?

Does it happen with the police and priority configuration in place?

If you compare the results you get in that graph, on the "Table" tab with the output of the "show traffic" command from the ASA right after issuing a "clear traffic", do the numbers match?

[Julio Carvajal]

Hello,

The question here would be, is the ASA the one causing the drop on the rate,

Can you share the show service-policy

Regards

Remember to rate all of the helpful posts.

For this community that's as important as a thanks.