Fixed bandwidth for VPN tunnel

[adrianamh]

Hi Everybody:

I have an IPSec tunnel configured into my ASA5525X firewall. The outside interface has a 70 Mbps channel. At this moment, the outside channel is getting satured due to a large number of new users.

Is there any way to configure a fixed bandwidth for the tunnel, so that its traffic does not compete with the normal user traffic?

Than you.

[Karsten Iwen]

That is not possible on the ASA itself. If you control the upstream-router, that would be the place to do it.

What would work, but is far from being optimal, is to police all other traffic down to a usable rate.

[Cristian Nilsson]

Not sure if this works on ingress also but works for me with egress on VPN.

Example polices outgoing traffic to ~50Mbit/s outgoing.

access-list VPN-TRAFFIC extended permit ip 10.0.0.0 255.255.255.0 10.0.0.0 255.255.255.0

class-map MATCH-VPN-TRAFFIC
 match access-list VPN-TRAFFIC

policy-map POLICE-VPN-OUT
 class MATCH-VPN-TRAFFIC
 police output 52400000

service-policy POLICE-VPN-OUT interface OUTSIDE

//Cristian