I'm interested to know what best practices are for setting limits and policies on an ASA to protect the device to maintain service when used as a multi tenant firewall. For example following several recent incidents of compromised servers we now have bandwidth policing and connection limits in place on all interfaces.
In this scenario it is preferable for a single tenant to hit a wall rather than all tenants go offline due to overloading or license limitations.
Edit
ASA in question is a pair of 5525-Xs in failover HA, running ASA9.0(1) but it would be good to know general answers for any ASA platform.
In multi-context mode (you didn't say, but multi-tenant=>multi-context would be reasonable), you can allocate resources per context. They can be either percentages or absolute limits, and cover a variety of resources - concurrent connections, ipsec sessions...
At some point, the time the firewall spends deciding if a tenant has exceeded their allocation will be enough to slow it down for everyone, though, with a really serious number of incoming connections.