I am running a ASA 5545 and I would like to throttle some outgoing traffic without dropping it, when it is bursting over a certain speed limit. Has anyone been able to do this on ASA5545 ? I am aware that some ASA have restricted capabilities regarding traffic shaping... The problem is that I cannot really test before asking...

Thanks in advance.

  • 1
    What exactly do you mean, "throttle some outgoing traffic without dropping it?" You can only queue so much, then traffic will be dropped when the queue is full. Throttling traffic will result in some traffic being dropped.
    – Ron Maupin
    Commented Mar 10, 2016 at 14:54
  • Hello Ron, Thank you for your quick reply. As you have previously commented out on Joe's comment, I am looking to shape the outgoing traffic without dropping anything when it is reaching a burst limit.
    – Nuk3
    Commented Mar 10, 2016 at 15:26
  • I haven't seen anything explicit regarding the buffering size for the traffic bursting over the configured limit. Here is the kind of configuration that I would like to have : ciscoasa(config-pmap)#policy-map qos_outside_policy ciscoasa(config-pmap)# class class-default ciscoasa(config-pmap-c)# shape average 2000000 ciscoasa(config-pmap-c)#exit ciscoasa(config-pmap)#exit ciscoasa(config-pmap-c)# service-policy qos_outside_policy interface outside Any idea if this is configurable on ASA 5545 ?
    – Nuk3
    Commented Mar 10, 2016 at 15:30
  • You really aren't going to be able to guarantee not dropping any traffic. The best you could do is to get a very large pipe and a big percentage of the bandwidth for your traffic class. If this is going outside your network, it's likely that some traffic will be dropped somewhere along the way. TCP is designed to handle this by detecting and retransmitting lost segments, and UDP doesn't guarantee delivery, so application using it are expecting to lose some traffic.
    – Ron Maupin
    Commented Mar 10, 2016 at 15:49
  • 1
    The best way to handle TCP is to use RED which randomly drops packets in the queue when it gets close to being full. This will slow down the TCP flows. Trying to not drop any packets is not something that is workable, and you should use the inherent TCP behavior to level out the traffic flows.
    – Ron Maupin
    Commented Mar 10, 2016 at 16:09

2 Answers 2


Traffic shaping is not supported on the 5500-X series devices and the 5540 or below. Reference


You can use policy/class-maps to throttle and shape traffic. In the example below I am restricting traffic to 20 Mbps. After creating the policy I apply the map to the inside interface. Ignore the "TCP-STATE-BYPASS" part of the config:

class-map 20_Mbps
 match any

policy-map inside_policy
  set connection advanced-options tcp-state-bypass
 class 20_Mbps
  police input 20980000
  police output 20980000

service-policy inside_policy interface inside
  • 1
    Policing drops traffic, but the questions asks how to do it without dropping traffic.
    – Ron Maupin
    Commented Mar 10, 2016 at 15:10
  • Hmm yea, my bad. I guess shaping would be a more appropriate answer, but, like you said, if the queue fills up packets will eventually be dropped.
    – Joe
    Commented Mar 10, 2016 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.