01-28-2019 01:55 AM 02-21-2020 08:42 AM 更新
Hello,
We have a pair of ASA 5516x firewalls with Firepower connected to our 100Mbps internet line.
We have been migrating using into O365 recently and I've noticed our Internet pipe is maxing our first thing in the morning when users log in, looking at Netflow it is https traffic to Microsoft so it's the users OneDrive files and Outlook I think.
Is here a way I can give https or O365 a certain percentage of the 100Mbps line?
Thanks
01-28-2019 02:15 AM 01-28-2019 02:16 AM 更新
you can configure the QOS on the ASA.
here is the link
for SFR you can not confiugre the QOS as it is only supported in FTD with FMC.
01-29-2019 06:26 AM 01-29-2019 06:28 AM 更新
Hi all,
See anything wrong with this. It's to limit the downloads to 20Mbps from SharePoint online. I'm not sure if FQDNs can be used in QoS?
CLI:
service-policy MSSP1-outside-policy interface outside
class-map outside-class
description O365 SharePoint Downloads
match access-list outside_mpc
access-list outside_mpc line 1 extended permit tcp host 13.107.136.9 172.x.x.0 255.255.254.0 eq https (hitcnt=0) 0xcf278a07
The x.x is just me hiding our LAN not that it matters.
As you can see zero hits so far:
So anything inbound from 13.107.136.9 to our LAN should be limited to 20Mbps?
Thanks
01-29-2019 06:37 AM
you configuration are not complete.
service-policy MSSP1-outside-policy interface outside
class-map outside-class
description O365 SharePoint Downloads
match access-list outside_mpc
access-list outside_mpc line 1 extended permit tcp host 13.107.136.9 172.x.x.0 255.255.254.0 eq https
you have the access-list defined and mapping into the class-map but you have not define the police rate or bandwidth parameters.
01-29-2019 06:47 AM
Sorry I missed that part of the CLI output but you can see it in the screenshot.
What show command can I use to output all this and show you?
01-29-2019 06:54 AM
I give you a template so you can change to what suit you as i am not ware of your network setup.
ASA
!
access-list ICMP permit ip any any
class-map ICMP
match access-list ICMP
!
policy-map OUT-POLICY
class ICMP
police input 32000
police output 32000
!
server-policy OUT-POLICY interface out
!
access-list OUTSIDE_IN permit icmp any any
access-group OUTSIDE_IN in interface OUT
!
show service-policy police
01-29-2019 08:22 AM
Thanks, what does 32000 equate to?
01-29-2019 11:26 AM
Hi sorry for getting back late.
I just chose the random number, 32000 means 32kbps in both directions
01-29-2019 11:42 AM
actually i had a thought of your requirement. and come up with this config.
!
policy map SH-POLICY
class class-default
shape average 2000000 20000
!
service-policy SH-POLICY interface OUT
!
access-list OUTSIDE_IN permit tcp MICROSOFT-IP INISDE-IP eq https
!
access-group OUTSIDE_IN in interface OUT
!
show service-policy shape
!
make sure you apply/test this configuration in change windows.
エキスパートの回答、ステップバイステップガイド、最新のトピックなどお気に入りのアイデアを見つけたら、あとで参照できるように保存しましょう。
コミュニティは初めてですか?これらのヒントを活用してスタートしましょう。 コミュニティの活用方法 新メンバーガイド