5

Due to the fact we've gotten a tremendous internet upgrade, I have attempted to setup a traffic policing rule at our local ASA. Currently one of our offices has a 1GB internet uplink which saturates some of the lower speed offices.

I'm attempting to blanket-rate-limit all esp traffic out of that site with the below configuration. My understanding of this rule would be that "all esp protocol traffic traversing NYHQ-OUTSIDE_COGENT would be rate limited to 8kb/sec" however both sending and receiving through that interface runs at a blistering 60 megabytes per second.

Can anyone point out where I am making a mistake?

EDIT: This is the sh inv for the ASA in question:


NYHQ-ASA# sh inv
Name: "Chassis", DESCR: "ASA 5515-X with SW, 6 GE Data, 1 GE Mgmt, AC"
PID: ASA5515


access-list NYHQ-OUTSIDE_COGENT_mpc extended permit esp any any

class-map Cogent-Class
 match access-list NYHQ-OUTSIDE_COGENT_mpc

policy-map Cogent-Policy
 class Cogent-Class
  police input 8000
  police output 8000
!
service-policy Cogent-Policy interface NYHQ-OUTSIDE_COGENT
Improve this question
6
  • Given your other recent SF question about NAT, is there any chance that you're using IPSec with NAT-T? If so, could you try adding udp/4500 to NYHQ-OUTSIDE_COGENT_mpc?
    – Mike Pennington
    May 19, 2014 at 21:43
  • @MikePennington running a packet capture on the NYHQ-OUTSIDE_COGENT shows that the traffic on the interface is proto 50, not udp/4500.
    – Peter Grace
    May 20, 2014 at 3:26
  • Peter have you found a resolution for the problem? If not have you considered classifying on all IP traffic to the site instead of only ESP? I consider it possible that the ASA may not be classifying on ESP correctly
    – Mike Pennington
    Jun 3, 2014 at 12:39
  • Nope, I've been pretty stumped; I'll try changing the rule to classify all traffic and see whether that helps.
    – Peter Grace
    Jun 3, 2014 at 13:40
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Jan 5, 2021 at 19:33

1 Answer 1

Reset to default
2

I also had a similar requirement some time back please see this post which details limiting from the tunnel-group which will catch anything going via that specific VPN, cisco-asa-rate-limit-vpn-tunnel

Hope this helps, any questions let me know. Please see more details:

The tunnel group should already be in place as per the usual config:

tunnel-group 85.205.255.6 type ipsec-l2l
tunnel-group 85.205.255.6 ipsec-attributes
 pre-shared-key *

1) Create a class map to define the traffic which should be matched, in our case we will be matching any traffic which pass the tunnel-group:

class-map VF-VPN-Class
 match tunnel-group 85.205.255.6
 match flow ip destination-address

2) Create a policy map, associate the class map against it, and define an action for matched traffic, below the data is in bps:

policy-map outside-policy
 class VF-VPN-Class
  police output 75000000 37500

3) Activate the policy map by assigning it to the external interface:

service-policy outside-policy interface outside

4) Verify that the policy has taken effect by pinging across the tunnel from a server behind the firewall:

(asa)# sh service-policy
Interface outside:
  Service-policy: outside-policy
    Class-map: VF-VPN-Class
      Output police Interface outside:
        cir 75000000 bps, bc 37500 bytes
        conformed 4 packets, 440 bytes; actions:  transmit
        exceeded 0 packets, 0 bytes; actions:  drop
        conformed 200 bps, exceed 0 bps
Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.