Bandwidth Allocation

[ferdinandmucos]

I have an internal server that needs access from outside. When users are not in their work stations the server can be accessed from outside easily. But when users are all available, Because of bandwidth overload users from outside cant access the internal server. Out of my 20Mbps speed, I would like to allocate 2mb dedicated bandwidth to this server to avoid the issue of connection refuse especially when users are actively using the internet. How would i configure this on my cisco asa firewall which is my gateway and router? Thanks in advance for the assistance.

[Georg Pauwen]

Hello,

the QoS options on the ASA are somewhat limited. Bandwidth reservation is as far as I know not possible, traffic policing is, but that is not what you want.

You could place all traffic to the server in the low latency queue, which is processed before the standard queue. That way, traffic to the server will always have priority.

The configuration would look like this:

ciscoasa(config)#access-list 100 extended permit ip any host 192.168.1.1
ciscoasa(config)#access-group 100 in interface outside
ciscoasa(config)#class-map SERVER_PRIORITY_CLASS
ciscoasa(config-cmap)#match access-list 100
ciscoasa(config-cmap)#policy-map SERVER__PRIORITY_POLICY
ciscoasa(config-pmap)#class SERVER_PRIORITY_CLASS
ciscoasa(config-pmap-c)#priority
ciscoasa(config-pmap-c)#end
ciscoasa#configure terminal
ciscoasa(config)#priority-queue outside
ciscoasa(config)#service-policy SERVER_PRIORITY_POLICY interface outside
ciscoasa(config)#end

[ferdinandmucos]

Thanks for the response gpauwen. In my interface i have a dmz. after firewall interface which is my gateway, the traffic hits my router again before it goes outside. do i need to do the same configs on my router too?

[Georg Pauwen]

Hello,

yes, good idea to configure the policy on your router as well. You have more options here, instead of:

ciscoasa(config-pmap-c)#priority

you can actually use the bandwidth command"

Router(config-pmap-c)#bandwidth 2000000

Apply the service policy inbound and outbound.

[ferdinandmucos]

On my router when I key in access-group it replies invalid input. what would be the problem?

[Georg Pauwen]

Hello,

on your router (IOS) the configuration would look like this:

access-list 100 permit ip any host 192.168.1.1

class-map SERVER_PRIORITY
 match access-group 100

policy-map 2_MB_SERVER
 class SERVER_PRIORITY
  priority 2000

int s0/1
service-policy output 2_MB_SERVER

[ferdinandmucos]

Thanks a lot for your help. The solution helped me.

[Joseph W. Doherty]

BTW, the example policy won't "trigger" unless the physical interface congests.  Assuming your physical interface is more than 20 Mbps, you'll want a parent shaper.

e.g.

policy-map 20Mbps_Shape
class class-default
 shape average 20000000
 service-policy 2_MB_SERVER

int xxx
 service-policy output 20Mbps_Shape