4

I have a Cisco ASA and cannot seem to control bandwith from the Internet to the device that well. The ASA supports Shaping, but only on outbound traffic which works great. My question is how to protect voice and video applications from FTP application, if the traffic is coming from the internet to my firewall . This would be download traffic, regarding upload traffic, the shaper works well for this.

I have also tried policing, but that just drops traffic, forcing a retransmit, so it just doubles the mount of traffic going over the WAN, which does not seem like a good solution.

I have clients who move a lot of data and from time to time it stomps on the inbound voice and video traffic.

Improve this question
4
  • 1
    as a last resort, you can police non voice traffic on the ASA and cap non-voice utilization with enough headroom left for voice. Better options involve WAN QoS...
    – Mike Pennington
    Commented Jan 17, 2014 at 18:25
  • I have tried this, where I set and police policy on the outside interface. If it is a 10Mbit Circuit I would police 7Mbit leave 3Mbit for the voice. This has worked, but I run into the same issues from time to time where the WAN is saturated and it does not matter what the ASA is policing.
    – Blake
    Commented Jan 18, 2014 at 0:08
  • that means: either another congestion point, you're not policing all relevant traffic, or you have more voice than expected
    – Mike Pennington
    Commented Jan 18, 2014 at 0:32
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 20, 2020 at 18:43

1 Answer 1

Reset to default
4

If you think about it for a moment, you'll realize that the congestion is happening at the far end of your WAN circuit (i.e., at your provider). Their interface is not prioritizing real-time traffic, so you are seeing poor audio and video performance. It is as if you are at the finish line of an auto race, but your team can't get out of their driveway because of all the big trucks on the highway. Unfortunately, this means that there is not a lot you can do from your end. The traffic has already been delayed by the time it gets to you.

One possibility is to use a packet shaping appliance. This will control your FTP traffic by modifying the window size in the ACK packets your ftp server sends back. If the window size is reduced, the sender will have to slow down. This of course means buying another appliance, which you may not be able to do. But there isn't much you can do on the ASA.

You could also talk with your provider -- perhaps they would be willing to add some QoS on their side (doubtful, but worth asking).

Improve this answer
6
  • Great example. When you're talking about an additional packet shaping appliance, why aren't you recommending WRED? It seems like that's what your describing and it's certainly available on ASAs.
    – Ryan Foley
    Commented Jan 17, 2014 at 21:46
  • @Fizzle WRED won't help because the packets are already delayed from the ISP. The packet shaper modifies outbound packets going back to the sender to "fool" the sender into slowing down.
    – Ron Trunk
    Commented Jan 17, 2014 at 21:52
  • That is the entire function of WRED, to drop random packets with a higher threshold going to higher priority queues that results in decreasing the TCP window size. Am I missing something?
    – Ryan Foley
    Commented Jan 17, 2014 at 21:59
  • There are two problems. One WRED is a congestion avoidance mechanism, so its only configured in outbound policy. Second, the relative slow speed of the WAN link vs the ASA internal speed means the queue would never fill, so WRED wouldn't kick in.
    – Ron Trunk
    Commented Jan 17, 2014 at 22:06
  • I have heard about shrinking the TCP windows size, but I never see any documentation about actually controlling via a firewall or router interface. Is that something that is controlled more by the application, or is that a feature of some routers/firewalls? What are some stand alone packet shapers that your know of? I agree I feel that the traffic is getting delayed, or overflowed (like a funnel) at the ISP because they only allot so much that can go down the pipe. And so if I police the traffic, it is just going to be sent again. Thanks for the great disucssion
    – Blake
    Commented Jan 18, 2014 at 0:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.