Due to the fact we've gotten a tremendous internet upgrade, I have attempted to setup a traffic policing rule at our local ASA. Currently one of our offices has a 1GB internet uplink which saturates some of the lower speed offices.
I'm attempting to blanket-rate-limit all esp traffic out of that site with the below configuration. My understanding of this rule would be that "all esp protocol traffic traversing NYHQ-OUTSIDE_COGENT would be rate limited to 8kb/sec" however both sending and receiving through that interface runs at a blistering 60 megabytes per second.
Can anyone point out where I am making a mistake?
EDIT: This is the sh inv for the ASA in question:
NYHQ-ASA# sh inv
Name: "Chassis", DESCR: "ASA 5515-X with SW, 6 GE Data, 1 GE Mgmt, AC"
access-list NYHQ-OUTSIDE_COGENT_mpc extended permit esp any any
match access-list NYHQ-OUTSIDE_COGENT_mpc
police input 8000
police output 8000
service-policy Cogent-Policy interface NYHQ-OUTSIDE_COGENT