4

I have a Cisco ASA and cannot seem to control bandwith from the Internet to the device that well. The ASA supports Shaping, but only on outbound traffic which works great. My question is how to protect voice and video applications from FTP application, if the traffic is coming from the internet to my firewall . This would be download traffic, regarding upload traffic, the shaper works well for this.

I have also tried policing, but that just drops traffic, forcing a retransmit, so it just doubles the mount of traffic going over the WAN, which does not seem like a good solution.

I have clients who move a lot of data and from time to time it stomps on the inbound voice and video traffic.

  • 1
    as a last resort, you can police non voice traffic on the ASA and cap non-voice utilization with enough headroom left for voice. Better options involve WAN QoS... – Mike Pennington Jan 17 '14 at 18:25
  • I have tried this, where I set and police policy on the outside interface. If it is a 10Mbit Circuit I would police 7Mbit leave 3Mbit for the voice. This has worked, but I run into the same issues from time to time where the WAN is saturated and it does not matter what the ASA is policing. – Blake Jan 18 '14 at 0:08
  • that means: either another congestion point, you're not policing all relevant traffic, or you have more voice than expected – Mike Pennington Jan 18 '14 at 0:32
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 15:47
4

If you think about it for a moment, you'll realize that the congestion is happening at the far end of your WAN circuit (i.e., at your provider). Their interface is not prioritizing real-time traffic, so you are seeing poor audio and video performance. It is as if you are at the finish line of an auto race, but your team can't get out of their driveway because of all the big trucks on the highway. Unfortunately, this means that there is not a lot you can do from your end. The traffic has already been delayed by the time it gets to you.

One possibility is to use a packet shaping appliance. This will control your FTP traffic by modifying the window size in the ACK packets your ftp server sends back. If the window size is reduced, the sender will have to slow down. This of course means buying another appliance, which you may not be able to do. But there isn't much you can do on the ASA.

You could also talk with your provider -- perhaps they would be willing to add some QoS on their side (doubtful, but worth asking).

| improve this answer | |
  • Great example. When you're talking about an additional packet shaping appliance, why aren't you recommending WRED? It seems like that's what your describing and it's certainly available on ASAs. – Ryan Foley Jan 17 '14 at 21:46
  • @Fizzle WRED won't help because the packets are already delayed from the ISP. The packet shaper modifies outbound packets going back to the sender to "fool" the sender into slowing down. – Ron Trunk Jan 17 '14 at 21:52
  • That is the entire function of WRED, to drop random packets with a higher threshold going to higher priority queues that results in decreasing the TCP window size. Am I missing something? – Ryan Foley Jan 17 '14 at 21:59
  • There are two problems. One WRED is a congestion avoidance mechanism, so its only configured in outbound policy. Second, the relative slow speed of the WAN link vs the ASA internal speed means the queue would never fill, so WRED wouldn't kick in. – Ron Trunk Jan 17 '14 at 22:06
  • I have heard about shrinking the TCP windows size, but I never see any documentation about actually controlling via a firewall or router interface. Is that something that is controlled more by the application, or is that a feature of some routers/firewalls? What are some stand alone packet shapers that your know of? I agree I feel that the traffic is getting delayed, or overflowed (like a funnel) at the ISP because they only allot so much that can go down the pipe. And so if I police the traffic, it is just going to be sent again. Thanks for the great disucssion – Blake Jan 18 '14 at 0:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.