Home / server / Questions / 19043
In Process
lpfavreau
Asked: 2009-06-04 10:53:05 +0800 CST

Cisco ASA5510 Bandwidth Shaping/Limiting

  • 772

This question is in two parts:

Shape

How can I limit the bandwidth on a ASA5510 to less than 10Mbps?

Currently I have:

policy-map shape_policy
class class-default
 shape average 9000000 36096
!
service-policy shape_policy interface outside

But when I look at the traffic on the outside interface it seems it sometimes busts the 10Mbps.

Police

Also, is it possible to limit the bandwidth taken by each users on the ASA? I've tried something like that (although it is not running at the moment):

police input 3000000 51200 conform-action transmit exceed-action drop
police output 3000000 51200 conform-action transmit exceed-action drop

Is it the way to go or is there a better way?

Thanks!

// Addendum:

I should add I'm using version 8.0(4) of the firmware as it can help provide proper configurations for the latest ASAs.

// Status:

I've opened up a bounty. I got two interesting answers although not definite. One seems to be outdated in terms of supported commands, the other one does not answer the second part of the question and leave me unsatisfied. Cisco experts needed!

firewall cisco cisco-asa

2 Answers

  1. This:

      shape average 9000000 36096

    actually gives your ASA license to burst the the bandwidth you've allocated, if there#s been a suitably quiet period. If you want a guarantee that you never exceed a given bandwidth, using policing is a better option (on the other hand, with policing, any packets that exceed the bandwidth will be dropped instead of delayed).

    • 4

  2. Unfortunately, I don't have an ASA to check/test with but I use the below command on one of my routers to limit the bandwidth to 6Mb. Perhaps something similar will help with your shape question.

    interface Serial1/0 
  rate-limit input 6000000 112500 225000 conform-action set-prec-continue 0 exceed-action drop
  rate-limit output 6000000 112500 225000 conform-action transmit exceed-action drop
    • 1