Cisco Firewall :: 5510 QoS Policing Giving More Bandwidth

May 5, 2011

I'm working in my lab trying to do proof of concept for traffic policing on the ASA 5510 running 8.0(4).  I have two laptops running Ubuntu one on the outside and one on the inside.  Both laptops have 100Mbps interfaces.  My tests consists of downloading a file from one laptop using HTTP.  Without any QoS I can see speeds close to 100Mbps which I would expect.  On a side note, try using XP and you won't come close to those speeds.  Anyhow,  I implement policing using the config below and expect to see the max rate on the laptops during the transfer max out close to the CIR.  However, I see speeds much higher on the laptops.
 
When I set the CIR to 10000 bps with bc at 1500 bytes I get speeds that range from 300Kbps to 700Kbps.  I would expect to see speeds max out at the CIR which would be 10Kbps.I'm having a hard time understanding why my numbers don't match.

View 6 Replies


ADVERTISEMENT

Cisco Firewall :: 5510 Vpn Client Groups Configured / DHCP Server Stops Giving Network Service

Feb 20, 2013

I have a asa 5510 vpn client groups configured and connected to the internal network DHCP server stops giving network service dhcp and the network goes down.

View 6 Replies View Related

Cisco WAN :: QoS Policing / Shaping For ASA 5510

May 28, 2013

We are looking to implement a bandwidth policy for our Internet link.  What i would like to know is if we use a policing policy, will the exceeded dropped packets be resubmitted from the source?  Will the dropped packets be resubmitted?  Are there any differences besides this when using either policing or shaping policies?  Is one better than the other?
 
CISCO ASA 5510 IOS 8.2

View 3 Replies View Related

Cisco Firewall :: 5510 Giving Credentials / Username And Password In Web Page / Page Is Not Responding

May 8, 2012

I have ASA 5510 with CSC-SSM-10 .ASA 5510 IOS version- 8.4.2 and CSC-SSM-10 IOS version 6.6.1162.Web  filtering is working fine with respective to my configuration.From yesterday morning, i was facing issue with the sites like gmail, webmail.After giving credentials like username and password in the web page, the page is not resonding.In troubleshooting process, i removed all the acls, class maps  which will direct all the traffic towards the CSC. In this scenario all my mail service sites are opening.If we apply the these ACLs and Class-Maps, only my mail service sites only affecting.

View 1 Replies View Related

Cisco Firewall :: Bandwidth Allocation On ASA 5510

Nov 8, 2012

I have a cisco ASA firewall 5510.Just i have configurd for 1st port as nameif ouside witch public ip, 2nd port as a nameif inside with local ip, and done the nating, dhcp and dns. now i am able to get internet from inside port, which is getting dhcp.up to that it is ok.
 
And I want to restrict bandwidh 1Mbps for local port (2nd port) how to config 1Mbps banwidth allocation for port no 2, I mean nameif inside should have 1Mbps limet.

View 1 Replies View Related

Cisco Firewall :: ASA 5510 Per User Bandwidth Capping

Oct 31, 2011

I have a 20/20 MB circuit and an ASA 5510 and I am able to setup policing were the interace gets 512k down and 128k up so when I conduct a speed test with one user I get 512k and 128k and when I conduct a speed test with two users each gets 256k and 64k. [code] What I want to happen is that each user gets 512k and 128k until a saturation point is hit and then I want the ASA to slow all users down equally. 

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Bandwidth Management And Content Security

Sep 13, 2012

I have some clarifications regarding ASA firewall, it can be support bandwidth management and content security at the same time. we are looking for below features in ASA5510.
 
IP/Policy based bandwidth management.Controll the bandwidth and allocate the bandwidth to specified users or servers.Content Security.  If not, which device I need to set for Internet Bandwidth Management and content security.

View 3 Replies View Related

Cisco Firewall :: ASA 5510 - Enable SNMP For Bandwidth Monitoring Using PRTG?

May 1, 2012

I am using ASA 5510 Firewall and i have established VPN tunnels too  , now i want to Monitor the bandwidth utilization , i have installed PRTG Monitor application and want to add the firewall , how to enable the SNMP in ASA .

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Rate Limit The Internet Bandwidth / Speed?

Jul 29, 2012

In ASA 5510. How I can limit the users in (VLAN 20) to use the internet with a limited Bandwidth/speed with 3 mbps upload and 5 mbps download?
 
In case the outside interface (Native vlan) which is connected to the ISP and have a bandwidth/speed of 30 mbps upload and 50 mbps download.

View 4 Replies View Related

Cisco Firewall :: QoS Policing Configuration On An ASA 5505?

Jun 10, 2013

I'm working on QoS policing configuration on an ASA 5505.The ASA is situated behind a cable modem which provides an SLA of 3.2Mbps out.I've configured a QOS policy to place VoIP and other essential traffic (RDP/Citrix/PCoIP) into a priority queue, whilst policing default class to 3.2Mbps to police out to the cable modem.I can see on the outside interface graphs that this is rating the output traffic down to 3.2Mbps as expected, but noticing at certain points of high output traffic drops down to 1.6Mbps.  I can't see anything obvious in syslog or any other areas to look, so looking for any pointers as to why the speed is suddenly dropping down.  Likewise if I rate the output to 2Mbps, it will suddenly drop down to 1Mbps at high output rates.the ASA is running on 8.0(5) and I enclose a copy of the sample QoS config below and attached a sanitized run config, as well as screenshot taken of the outside interface Bit Rates plus service-policy.
 
access-list VoIP-Traffic-OUT extended permit tcp 172.16.6.0 255.255.255.0 host 68.98.217.252 eq h323
access-list VoIP-Traffic-OUT extended permit udp 172.16.6.0 255.255.255.0 host 68.98.217.252 object-group rtp
access-list VoIP-Traffic-OUT extended permit tcp 172.16.6.0 255.255.255.0 host 68.98.217.252 eq 2000  
access-list VMs-Traffic-Out extended permit tcp 172.16.6.0 255.255.255.0 192.168.168.0 255.255.255.0 eq 3389
access-list VMs-Traffic-Out extended permit tcp 172.16.6.0 255.255.255.0 192.168.168.0 255.255.255.0 eq citrix-ica
access-list VMs-Traffic-Out extended permit tcp 172.16.6.0 255.255.255.0 192.168.168.0 255.255.255.0 eq 4172

[code]....

View 6 Replies View Related

Cisco VPN :: VPN Connectivity Lost After Giving It Key Asa 5510

Apr 3, 2011

I have a L2L IPSEC tunnel between a set of failover pair of two ASA5510's and a single ASA5505. Over time they will loose connectivity through the tunnel. The tunnel itself stays up, but cannot pass any traffic.When looking at the tunnel I always see this on the set of 5510's (marked in bold @ IPSEC ID 3)?

View 5 Replies View Related

Cisco Firewall :: 5505 - How To Apply Policing On ASAs With Leased Lines

Jul 2, 2012

I'm trying to configure policing and/or shaping on a setup of 2 x ASA 5505 Sec Plus. The units are placed in office A and office B and each have a ISP connection to the internet and a leased line with a capacity of 4/4 Mbit/s for interoffice communication.
 
On each ASA there's four subnets. VLAN 200 is used to connect the offices through the leased line.
 
Subnets:
Outside = 2
Data = 10
Voice = 100
Linknet = 200
 
I've read a lot of articles and posts about shaping and policing on the ASA but still can't get it to work like I wan't to. I'm trying to limit all traffic besides IP-telephony traffic to 3 Mbit/s and thus reserving 900 Kbit/s for voice traffic. I tried setting a service-policy on the linknet interface on each ASA and set Traffic match to Any traffic and QoS settings for both input and output.
 
I can see traffic passing the policy when I run the "show service-policy police" command but it never seems to be high enough to be policed which is strange since the ASDM monitoring shows that I'm pushing 3900 kbit/s. I file transfers verifies that policing does'nt work.

View 2 Replies View Related

Cisco Firewall :: ASA5550 - Implement Traffic Shaping / Policing Primarily For P2P Traffic?

Mar 10, 2011

We are looking to implement traffic shaping/policing primarily for P2P traffic. As natively the ASA5550 is only capable of p2p inspection if the traffic is tunneled via port 80 is the AIP-SSM the way forward? We have 2 5550s in active/active failover config. As a side note we are also looking to implement an IDS/IPS system so could this module cover all?Is this module going to provide the desired outcome or is there another module/device out there better suited for this? I would prefer to use the ASA5550s as opposed to implementing another product if only that we can make use of the investment we already made on these devices.

View 1 Replies View Related

Cisco :: Get VPN IP Address Without Giving Someone Access To The Firewall Itself?

Dec 6, 2011

Is there a way to get VPN IP address without giving someone access to the firewall itself? LIke a script you can put on a website?

View 2 Replies View Related

PPPoE Bridge In Router And Giving Firewall A Public IP?

Jan 5, 2013

I have 2 public ip, 1.1.1.1 anda 1.1.1.2. I'm connected to the ISP using PPPoE. I also have a router and a firewall. I want to assign 1.1.1.1 to router and 1.1.1.2 to the firewall. I do not want to NAT 2 times (one in router and one in firewall)That's why i want to bridge Fa0/0 and Fa0/1.Could this be done in Cisco router? I've done this command but it's not working as i want. I'm using bridge irb and bridge-group.

View 6 Replies View Related

Cisco WAN :: 5510 Dynamic Bandwidth With Shaping

Mar 29, 2011

We have an ISP connection that is connected via an ethernet interface on a 5510 ASA. We are allotted 10Mbps. I have currently have the interface set to 10Mbps Full. However we want to upgrade the connection to 25Mbps. I know I can set the port speed to 100Mbps and then set a shape/police statement and shape down to 25Mbps.
 
Management wants to be able to call the ISP and arbitrarily adjust that speed up temporarily at any time without any user/admin intervention on our side. I can simply leave the port at 100Mbps i.e. no shape statement on my side however I will run into problems with large amounts drops, overruns, retransmissions, etc due to the ISP shaping the connection speed during normal operations. However they then could then adjust the speed at any time without needing me.
 
I do not know the best way to make this work. Is there some sort of dynamic/smart shaper in the ASA or another cisco device?

View 2 Replies View Related

Cisco Firewall :: ASA5510 - Giving Error 421 SMTP And Connection Lost

Oct 10, 2011

I 've got some problem with my Mail Server since I've migrated to an ASA5510.Actually the server is in a DMZ with a private Ip ( 10.x.x.2) and it is translated to a Public IP ( 194.x.x.65).Some Users received in there mailbox a system administor error message :Object : Impossible to deliver : testYour message could not be deliver to one or more of its recipients: 421 SMTP connection went away!When they try to re sent it some times later, message is sent whithout problem.

View 3 Replies View Related

Cisco Firewall :: ASA 5505 Not Giving Out DHCP To Clients / Only Discovery Packet?

May 3, 2012

My ASA 5505 has stopped giving out DHCP address to my machines.Everything was working fine and nothing has changed in the network. I've reloaded the firewall and clear all DHCP on the firewall I've even re-entered the cmd on the ASA.
 
I'm able to staticlly assigned address to the clients and all is way. When I do a DHCP debug on the ASA I don't see any events relating to the DHCP service apart from checking for lease expiry.
 
I've also tried to plug a machine straight into the ASA and no result. I finally did a packet capture and I am seeing the client machine sending out a DHCP discover packet and nothing else is responding.
 
My ASA config is:
 
dhcpd address 192.168.3.10-192.168.3.33 inside
dhcpd dns 8.8.4.4 interface inside
dhcpd option 3 ip 192.168.3.1 interface inside
dhcpd enable inside

View 7 Replies View Related

Cisco :: 5510 Bandwidth Management / Policy Not Working

Jul 27, 2011

We have a Service Policy rule setup on our 5510 for SMTP traffic.
 
Problem is, this week someone sent a larger email 20+mb to dozens of recipeints and the outside interface was hitting 10mb, which is not what I would have expected with this rule in place, so I'm questioning the configuration. We know it was email because I disabled the server that receices our outbound mail to apply a signature and the traffic dropped immediately.

View 2 Replies View Related

Cisco :: Using SNMP To Monitor Bandwidth Utilization History ASA 5510

Dec 22, 2008

I matched the traffic statistics on one of my Cisco ASA site-site tunnels with the OID:1.3.6.1.4.1.9.9.171.1.4.3.1.1.25.4142 (cipSecTunHistInOctets).  I was real proud of myself for a few days until I checked the history and found the OID wasnt working.After some troubleshooting I found that the last four digits (4142 in this case) change whenever the tunnel drops and re-establishes itself. Any way to collect tunnel utilization history on an ASA with SNMP?  Is there a different OID I can use thats based on the endpoint IP?

View 2 Replies View Related

Cisco Security :: 5510 Allocate A Bandwidth Of 512kbps For Each Connect

Jul 29, 2011

Recently i had a requirement for implementing a Qos on one of my Mpls link which is of  2Mbps, the requirement was to allocate a bandwidth of 512kbps for each connect that comes in and 512 kbps for out going, and it is in ASA 5510 firewall.
 
So i have done the configuration successfully, now the issue is,  the bandwidth is limited to 512kbps only for all the connection,how many may be the connections,  it working below 512kbps,
 
But my requriemt was for the first connection, it should allocate 512kbps , and for the second another 512kbps so on.its not happening, the bandwith got struckup at 512kbps , all the connection are sharing this bandwidth only.

View 1 Replies View Related

Cisco WAN :: Policing On 7613 SVI?

Aug 4, 2011

We have built some policers to apply to vlan SVIs on our 7613 so that we can rate limit input and output traffic.  We followed the Cisco formula and got this.
 
policy-map vlan-shape-3meg
  class class-default
   police cir 3000000 bc 562500 be 1125000    conform-action transmit     exceed-action drop     violate-action drop
  
There have been some complaints about this not actually meeting the limit.  When I do a show policy-map interface xxx I get this.  Based on that it looks like the Be value is being change to match the Bc value. 
 
On a separate note, I noticed that every policer we built with the cisco formula actually ends up with a Tc greater than the max Tc of .125 seconds. It seems odd that a recommended formula would end up creating values outside the maximum allowed limits by the software.
 
I'm not a QoS expert so if any of this seems like basic stuff it's just because I'm a little slow on QoS.   
 
Vlan2
   Service-policy input: temp-remove
   class-map: class-default (match-any)
Match: any
police :

[code]....
 
One other thing...in order to apply policers input and output on an SVI does mls qos vlan-based have to be configured on the trunks tagged with the corresponding Vlan?

View 1 Replies View Related

Cisco WAN :: Configuring QoS Policing In 2911?

Sep 27, 2012

I configuring QoS policing in a Cisco 2911 in a 128K/256/512 link, but when I apply the configuration in interface I receive the error below:
 
Configured Percent results in out of range kbps.Allowed range is 8-2000000. The present CIR value is 6. 
 
Current configuration : 191 bytes
!
interface GigabitEthernet0/1
description ***V-SAT***
bandwidth 128

[Code].....

View 7 Replies View Related

Cisco :: Policing In Multiple Context Mode?

Jan 4, 2012

I know most QoS capabilities aren't available in multiple context mode, but I need to do some really simple policing on one of my contexts. I just want to apply a hard 20Mbps cap on an interface. I've seen a few places that suggest that basic policing is possible in multiple context mode, but apparently not by the normal commands.

View 5 Replies View Related

Cisco WAN :: ASR1001 / Traffic Policing And Shaping

Feb 25, 2012

I want to take 100Mb incoming from a service provider and police it off into several VRFs for customers.One of these VRFs will be 30M.I further need to traffic shape this (30Mb) out to 40 x 0.75Mbps (burstable to 30M) customers.
 
I am using an ASR1001.

View 2 Replies View Related

Cisco Switching/Routing :: Nexus 3048 QoS Policing

May 29, 2012

Any way of policing traffic on the Nexus 3k platform?  I can't find a reference to say policing/shaping is supported.

View 5 Replies View Related

Cisco Switching/Routing :: Policing Traffic On 4510?

Nov 21, 2012

I have two servers on one subnet that each need to replicate to a single server on another subnet. They also need to replicate to each other. This replication is unidirectional so I will refer to the 2 server subnet as the source subnet and the single server subnet as the destination subnet. In order to keep this replication running without killing the MPLS links on either end, we are trying to use a policy-map that limits bandwidth from the source subnet.The Problem:We have created a policy that polices traffic during specific times of day and limits the bandwidth as prescribed, however, bandwidth is also being limited between the 2 servers on the source subnet which is not needed or desired.Class 512K set dscp ef police 1024000 bps 1024000 byte conform-action transmit exceed-action dropClass Map match-any 512K (id 4) Match access-group name DAGExtended IP access list DAG 10 permit ip host 10.20.0.3 host 10.20.0.10 time-range DAG-REP (active) (22793 matches) 20 permit ip host 10.20.0.4 host 10.20.0.10 time-range DAG-REP (active) (14156 matches)The service policy is applied on the input side of the 2 interfaces on which our devices are connected.As you can see, the access list identifies the interesting traffic as traffic from two specific hosts to one specific host. The problem we are having is that bandwidth is also being throttled between the two source hosts even though it is not defined to do so.What can I do to limit traffic from the two source devices to the single destination device without limiting bandwidth between the two source devices?

View 1 Replies View Related

Cisco Switching/Routing :: C3750 - ACL Building For QOS Or Policing

Jun 6, 2012

I would like to apply policing on a C3750 interface, for all traffic matching 10.0.0.0 / 8, except for sub net 10.0.0.0 / 24. I plan to apply the following configuration, with an ACL that denies 10.0.0.0 / 24 then accept 10.0.0.0 / 8. I am quite sure of the answer but need a confirmation about the following configuration correct ? (10.0.0.0 / 24 will be not blocked, and no policing will be apply on it?)
 
ip access-list extended TEST
deny tcp 10.0.0.0 0.0.0.255 any eq 5000
permit tcp any 10.0.0.0 0.255.255.255 any eq 5000
[code]....

View 2 Replies View Related

Cisco Switching/Routing :: 3560 Egress Policing And Classification

Jan 17, 2012

I have a customer who requires to identify and police traffic on egress on a 3560 trunk link.  I cannot use ingress classifications because we do not know what route the traffic will take yet.  The egress interface connects to multipoint wireless equipment with 4 different bandwidth point to point links. So the ingress traffic may be routed via any one of 4 point to point wireless links connected to the single egress interface.  Am I correct in assuming we cannot mark on the egress direction then put the traffic in a SRR shaped egress queue based on the marking ? So we would only have the option to egress queue based on markings applied or trusted on the inbound direction ? I had thought of some kind of policy map/aggregate policer configuration based on the exit VLAN but it seems we can only apply this type of config inbound. From reading the 3560 configuration guides it seems the 3560 cannot deploy the kind of requirements this customer needs.  Perhaps they should have deployed some kind of Metro switch ?

View 1 Replies View Related

Cisco WAN :: Traffic Policing On 7609 With ES20 Line Card

May 5, 2013

I am trying to configure traffic policing on a 7609 with ES20 line card - however it doesn't appear to be working.  The customer is randomly getting DoS attacked, and the policy doesn't appear to be dropping any exceed/violate traffic.This is an egress policy on a sub-interface. 

View 5 Replies View Related

Cisco Switching/Routing :: 3750x Inbound Port Policing?

Dec 11, 2012

dont seem to be able to get policing working inbound on a port 3750X v 15.0(2)
 
Config is below:
 
ip access-list extended SMB
permit tcp host 192.168.1.14 host 172.16.1.30
permit tcp host 192.168.1.14 host 172.16.1.31

[Code]....

View 6 Replies View Related

Cisco Switching/Routing :: IPv6 Filtering / Policing On 2960 Switch?

Jan 3, 2012

Trying to control capacity utilization for guest users connecting to a 2960 switch. No problem for IPv4 users, but IPv6 is giving me fits. What I've found out by trial and error so far implies that there is just enough IPv6 smarts in a WS-C2960-24TT-L running c2960-lanbasek9-mz.150-1.SE to make it impossible to control IPv6 traffic. Blocking IPv6 would be sufficient short term, but MAC filtering on type 0x86DD does not appear to work either. Here are the results I've gotten so far:
 
What "works":

*  Protocol ipv6 or an IPv6 ACL in a class map.

* Using a class map referencing ipv6 protocol or an ipv6 ACL in a policy map.

* IPv4 inbound filters and policing.

* Blocking of IPv4 traffic by a MAC ACL blocking type 0x0800 (IPv4) - note that the docs explicitly state that MAC filters do NOT filter IP traffic, except for on this box on this release they do.
 
What does not work:
 
* Applying a policy map referencing a class map referencing protocol ipv6 or an IPv6 ACL to an interface. The service policy is accepted by the parser, but is not inserted into the running configuration.

* "class-default" in a policy map only matches IPv4 traffic, not all other traffic.

* Blocking of IPv6 traffic by a MAC ACL blocking type 0X86DD. No problem applying the access-group to the interface, it just doesn't do anything.
 
I am aware that this box is not supposed to support IPv6 other than for multicast, but as implemented, this is a hole an abuser could drive a MAC truck through.
 
My questions:
 
Is this situation unique to this particular 2960 switch or SW release (I also tried 12.2(58)SE2) or does it afflict all 2960's running LANbase?
 
Assuming the answers to the first two question are negative, what is the minimum requirement to get working IPv6 policing in an edge switch?

View 0 Replies View Related

Cisco WAN :: C7200-IK9SU2-M / QoS Traffic Shaping Not Working (but Policing Does Work)

Feb 8, 2011

I have lots of PPPoE users that get Virtual Access interfaces created upon login based on a virtual template. I need to traffic shape them. I know how to get it to work on an individual basis, because the policing within a service policy works fine. As soon as i change it to shaping it leaves things wide open.I really dont care how it gets done, I just need to be able to specify a speed to be traffic shaped and apply that to a virtual template. I need to limit speeds on the download and upload, i understand that the upload i will use the policing, but the download i need it to smooth out the flow and be traffic shaped, not policed.
 
Here is my Policies and classes:

***
policy-map CHILD class class-default  bandwidth 1650policy-map PARENT class class-default  shape average 1650000  service-policy CHILD****
Here is my Virtual Template:
****
interface Virtual-Template8 description pppoe-auth-FTTH ip unnumbered FastEthernet0/0 ip access-group subs-in-FTTH in ip mtu 1493 timeout absolute 6120 0 peer default ip address pool FTTH-POOL ppp authentication pap pppoe-auth ppp authorization pppoe-auth ppp timeout idle 84600 service-policy output PARENT

[code]....
 
The results i am getting is unrestrcited throughput, i am seeing about 40mb of throughput when the target is to limit to 1.65MB. As you can see from the output the PARENT class is seeing 279116 packets, but the shaper only saw 59. In all the examples i see on the internet these two numbers should be the same. Why is the shaper not acting on all the traffic crossing that class/policy?
 
Hardware/IOS:
Cisco IOS Software, 7200 Software (C7200-IK9SU2-M), Version 12.4(12), RELEASE SOFTWARE (fc1)

View 11 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved