ASA connection rate and stateful packet inspections rate limiting

Can anyone please send me a link or links on how configuring "connection rate" and "stateful packet inspections rate" on an ASA?
It seems not easy to find the links
thanks,
Han

Hi Han,
I assume you're referring to the use of resource classes to limit the connection build and inspection rates? If so, this is only available in multiple context mode. You can find some config examples for that feature here:
http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/mode_contexts.html#wp1142960
-Mike

Similar Messages

What Brand/Model Stateful Packet Inspection Wired Router Do You Recommend?

Hi everybody,
After using a Macsense XRouter for many years, I'd like to upgrade to a more robust faster small office router. I'm not trying to find the cheapest router. A substantially faster unit with features like stateful packet inspection is what I'm after. A WIRED router. A more secure, heavy-duty device. I do not want to go wireless now. I have a separate DSL modem, so do not want an ADSL router. Just a router.
CISCO certainly is well known and apparently a good performer. Can anyone suggest CISCO models in the $200-$600 range that would work easily with a Mac? Being able to download firmware upgrades on a Mac easily is vital. I only need about 4 LAN Ethernet ports—SWITCHED.
CISCO must have competitors. Can anyone recommend equivalent Brands that are well regarded for Macs? Model numbers?
Thanks a lot for considering this!
G5 iMac 20" 2.0Ghz (2nd generation) Mac OS X (10.4.5) 2GB RAM
G5 iMac 20" 2.0Ghz (2nd generation) Mac OS X (10.4.5) 2GB RAM

Wow, that was fast. I can't find the button to click on for "helpful" for your post. Where did the button go? It did work on some earlier posts from you, but not all. Anyway, it begins to feel like we're almost out of the woods!
So a broadband router it is. I have zero motivation to try routing between IP subnets, happily.
Nice to have affirmation of the RV0041. It seemed to be the highest level before jumping all the way to Cisco. Yeah, the Telenet firewall configuration requirement on the Zywall 5 was something to choke on. Oh—I did find one review on it. The writer, an IT tech, emphasized in all capitals that a user has to have extensive knowledge of configuring these things BEFORE getting a Zywall. So the Zywall seems to also fit squarely into the IT pro department. On the RV0041, I thought the Gigabit switch feature was very fine.
Actually I have the software firewall "NetBarrier" installed already. Kind of sounds as if a lot of the functions of a network appliance are largely duplicated by NetBarrier. It's given me alerts in real time for attempted port scanning, for example. I do want fast page loading, so the performance lag using a network security device seems like a marked disadvantage.
Would a combination of NetBarrier and the RV0041 largely provide equivalent protection compared to a network security device? I'm willing to live with less protection to an extent to avoid slowing things down.
Once again, many thanks indeed

Why do I receive "4.3.2 connection rate limit exceeded" error message using the mail merge extension and what can be done about it?

I am using TB 31.3.0 with Mail Merge 3.9.1. I routinely send an email to 435 members of an volunteer emergency responders group that I coordinate. I do so using a .csv list with mail merge. While there were no problems in the past, more recently the mail merge function will hang after sending a varied number of messages successfully and I get the following error message:
"An error occurred sending mail. The mail server sent an incorrect greeting: 4.3.2 connection rate exceeded.."
There is an "OK" button in the error message pop up that can be clicked to resume the mail merge process. It would appear that if I click the "OK" button immediately whenever the error message is received I must do so frequently and some members do not receive their email. If I delay clicking the "OK" button, I found that I only needed to click the "OK" button twice to send to all the members.
An on line search suggests this is the result of some sort of throttling by my ISP, Sonic.net. There is also this comment: "If you are receiving this error, you are likely using mailing list software which cannot decipher the temporary fail codes. If so, you will need to set your software to slow down its delivery rate and/or reduce the number of active connections per remote host."
I am not super technical. Is it realistic to think that I can tweak mail merge to that I do not have to babysit my email to this group?

then I suggest you send using a mail provider that is not actively trying to block your outgoing mail. Or use a yahoo / google groups mailing list feature so you only send a single mail.
Or use a free account from the likes of http://www.ymlp.com/ who limit free account mailing lists to 1000 subscribers. ( Googled them this morning)

Cisco firewall rate limited syslogs and MARS

We're getting a ton of informational packets (tcp build / teardown) from firewalls here. I can kill this at the source (drop to "notification" level, filter out the build / teardown events, etc.) but would rather not throw this stuff away (good clues in an investigation).
I can filter this on the MARS side so rules don't fire, but that doesn't address the performance hit at the firewall, or the traffic on the network.
I can rate limit at the firewall - if I do will MARS be able to parse this out properly - i.e if there's a rule that fires on a 100 count for example, and a firewall that's set to rate limit a certain event to, say, every 200 instances of the event, and single syslog shows up at MARS with rate limited information in the packet, will the MARS rule fire?
hope this makes sense - thanks

What kind of firewall are you running? ASA? FWSM? Something else?
If you're running an ASA, the ideal solution would be to implement Netflow Secure Event Logging (NSEL). This feature uses Netflow v9 to handle security event logging along with traffic flow data. Using NSEL can provide performance improvements over syslog, both on the ASA, and on your network.
Part of the configuration process includes a command to disable the redundant syslog types already handled by NSEL. Many of those are the same types of logs you mentioned (buildups/teardowns, etc). It's very simple to configure - you can read more about it here, in the ASA 8.2 CLI Configuration Guide:
Configuring Network Secure Event Logging (NSEL)
If you're running a FWSM, the same option isn't available. Instead, you might want to reconsider disabling some of the log types that aren't really providing much benefit relative to the load. In fact, Cisco themselves recommend disabling some of the more unimportant (but frequent) log types.
From the "Cisco SIEM Deployment Guide", one of the "Smart Business Architecture" design guides (emphasis mine):
At logging level Informational, Cisco recommends disabling the following messages, as they are of little interest for SIEM analysis: 305010: The address translation slot was deleted 305011: A TCP, UDP, or ICMP address translation slot was created 305012: The address translation slot was deletedTo disable these messages, use the following configuration commands: no logging message 305010 no logging message 305011 no logging message 305012For more aggressive tuning, you may also consider disabling the following messages: 302014: A TCP connection between two hosts was deleted 302016: A UDP connection slot between two hosts was deletedIf dynamic Network Address Translation (NAT) is not configured on the appliance, message 302013 (for TCP connection slot creation) can also be disabled.
So, that's at least 6 possible log types that can be disabled with no impact: 302013, 302014, 302016, 305010, 305011, and 305012. And that's straight from Cisco's own documentation.
Now, to expand on that ...
- if 302016 (UDP teardown) can be disabled, why not 302015 (UDP create)?
- similarly, what about 302020 and 302021 (ICMP)? Disable those as well?
Final list:
302013
302014
302015
302016
302020
302021
305010
305011
305012
In the end, though, only you can determine which options are acceptable for your environment.
Note: all 3020xx log types listed are disabled automatically during the NSEL configuration process.

ACE20 SSL-connection rate performance

Hello,
One of our customers are challenging our ACE20 modules ssl-connection rate performance. During a loadtest performed against our webportals, they concluded, that the ACE-module showed signs of severe performance degredations, when the number of new ssl-connections hit 40.
While I disagree with that conclusion, I find it somewhat difficult to disprove it. Nothing on the ACE-module suggest any ssl-resource depletion, the highest recorded ssl-connection rate is 677 tps and the license permits 10k. The context is currently sized to 4k. I've gone through numerous troubleshooting steps, trying to locate anything that would suggest a problem with the module, but so far nothing has turned up.
I've been given somewhat conflicting information about what the ssl-connection rate resouce actually represent. Some say is represent the total number of new ssl-connections pr/sec, other say it represents ssl-transaction capacity as a whole, which among other things would include ssl-handshakes. Regardsless, 40 in my opinion seems way to low and this is very inconsistent with the generel load on our modules, which often climbs into the hundreds.
So I'm looking for suggestions on how to conduct a simple ssl/tps test against the ACE-modules. The test is expected to be very basic, as I'm not looking to test the webportal end-to-end, but simply doing an ssl-tps performace test.
Any help will do
Thanks
/Ulrich

Hi,
The connection will be denied once the SSL connection rate is exceeded.
That can be identified by using the command :
show resource usage all
You will see something like this :
Resource Current Peak Min Max Denied
ssl-connections rate 995 1000 0 1000 28975
You will notice that the deny counter will start increasing once the rate is exceeded.
hope that helps.
regards,
Ajay Kumar

Line profile does not match connection rate.

Hi,
We are 3 Km from our local exchange and our bt homehub router states that we are connected at 1.75mb:
Line state:
Connected
Connection time:
0 days, 00:17:41
Downstream:
1.75 Mbps
Upstream:
448 Kbps
VPI/VCI:
0/38
Type:
PPPoA
Modulation:
G.992.1 Annex A
Latency type:
Interleaved
Noise margin (Down/Up):
6.4 dB / 16.0 dB
Line attenuation (Down/Up):
64.4 dB / 31.5 dB
Output power (Down/Up):
17.1 dBm / 12.4 dBm
FEC Events (Down/Up):
57 / 0
CRC Events (Down/Up):
0 / 0
Loss of Framing (Local/Remote):
0 / 0
Loss of Signal (Local/Remote):
0 / 0
Loss of Power (Local/Remote):
0 / 0
HEC Events (Down/Up):
0 / 0
Error Seconds (Local/Remote):
299 / 130
The bt speed test website gives the following results:
Download speedachieved during the test was - 1129 Kbps
For your connection, the acceptable range of speeds is 400-2000 Kbps.
Additional Information:
Your DSL Connection Rate :1792 Kbps(DOWN-STREAM), 448 Kbps(UP-STREAM)
IP Profile for your line is - 1250 Kbps
Having done a bit of googling it looks as though our line profile should infact be 1500 Kbps given our connection rate of 1.75 Mb. Is it possible to get my line retrained so we can make the full use of our lines potential. That extra speed is crucial in been able to use Iplayer etc....
Thanks in advance.
Mark.

Thanks for your reply Jolly.
When I first activated the broadband I had the filter plugged into the front (centre) socket on the master socket and the line was connecting at approx 1.5 Mb. About two weeks ago I plugged the filter directly into the test socket and I got the increased connection rate as detailed above. I left the router on and everything connected for about 10 days but had no improvement in line profile. Could it be that my connection rate is so marginal on activating the 1.5 Mb line profile that the equipment at the exchange isn't detecting the increased (well kind of!) speed?
The reason I was only connected for 17 min before posting that message was because I decided to restart the router to confirm that I was still connecting at that rate.
I tried speaking to someone in Dehli about this but got absolutely nowhere........

Slow upstream connection rate

I have an downstream connection rate of 3680kbps and an upstream connection rate of 64kps.
As I am (I assume) connected to an 8Mbps enabled exchange (indicated by the 7150kbps max achievable speed in the BT test result) so I thought that the upstream speed should be significantly higher e.g 256kbps or higher.
Any thoughts?
BT Test Result
Download speedachieved during the test was - 2338 Kbps
For your connection, the acceptable range of speeds is 600-7150 Kbps.
Additional Information:
Your DSL Connection Rate :3680 Kbps(DOWN-STREAM), 64 Kbps(UP-STREAM)
IP Profile for your line is - 3000 Kbps
Router ADSL
Link Information
Uptime: 7 days, 3:25:14
Modulation: G.992.1 annex A
Bandwidth (Up/Down) [kbps/kbps]: 64 / 3,680
Data Transferred (Sent/Received) [MB/GB]: 250.20 / 2.20
Output Power (Up/Down) [dBm]: 9.5 / 18.5
Line Attenuation (Up/Down) [dB]: 30.0 / 51.0
SN Margin (Up/Down) [dB]: 7.0 / 5.0
Vendor ID (Local/Remote): TMMB / ALCB
Loss of Framing (Local/Remote): 0 / 0
Loss of Signal (Local/Remote): 17 / 0
Loss of Power (Local/Remote): 0 / 0
Loss of Link (Remote): 0
Error Seconds (Local/Remote): 56 / 0
FEC Errors (Up/Down): 0 / 1,098,087
CRC Errors (Up/Down): 0 / 5,243
HEC Errors (Up/Down): 0 / 4,480
Line Profile: Interleaved

If you have a lot of low frequency band interference, then the DSLAM would have decreased your upstream rate to reduce errors.
You have quite a number of losses of signal (local) which could indicate a possible missing microfilter on a phone somewhere.
Telephones without microfilters tend to attenuate the lower frequencies and cause signal losses. At the higher "downstream" frequencies they tend to have less of an effect.
There are some useful help pages here, for BT Broadband customers only, on my personal website.
BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones.

Broadband connection rate very low

Hello,
around about the start of August 2011 my connection started to drop out frequently. Before this began to happen my connection had been around 2000kb to 2500kb since installation.
i have reported the fault twice and both times I have been informed that the issues has been fixed but i have recieved no change in my connection or the behavour of the line the home hub stats are as follows
ADSL Line Status
Connection Information
Line state:
Connected
Connection time:
0 days, 00:08:34
Downstream:
320 Kbps
Upstream:
448 Kbps
ADSL Settings
VPI/VCI:
0/38
Type:
PPPoA
Modulation:
G.992.1 Annex A
Latency type:
Interleaved
Noise margin (Down/Up):
8.8 dB / 17.0 dB
Line attenuation (Down/Up):
52.9 dB / 31.5 dB
Output power (Down/Up):
13.4 dBm / 12.3 dBm
FEC Events (Down/Up):
2076 / 0
CRC Events (Down/Up):
0 / 0
Loss of Framing (Local/Remote):
0 / 0
Loss of Signal (Local/Remote):
0 / 0
Loss of Power (Local/Remote):
0 / 0
HEC Events (Down/Up):
0 / 0
Error Seconds (Local/Remote):
39 / 26
and a test with BT speedtest reveals the following
Download speedachieved during the test was - 222 Kbps
For your connection, the acceptable range of speeds is 50-250 Kbps.
Additional Information:
Your DSL Connection Rate :320 Kbps(DOWN-STREAM), 448 Kbps(UP-STREAM)
IP Profile for your line is - 250 Kbps
The results above are a good day with the connection often the connection rate is 100-150kb
I have only 1 telephone socket in my house which my home hub is connected to. i have also connected into the test socket with no change in the connection rate.
When I do a line check from my neighbours computer the results read that this issue is known to BT. also if I check my neighbours line from my computer it reports this issue is also known to BT.
My neighbour and i have the same issues with our broadband connection at the minute. So this just confirms to me that the issue is beyond our homes.
I am almost at the end of my teather with this issue as my internet is unseable most days
i hope someone can help me.
Chris

if bothe you and your neighbour are having the same problems then would appear to require an engineer. contact the mods for assistance http://bt.custhelp.com/app/contact_email/c/4951
If you like a post, or want to say thanks for a helpful answer, please click on the Ratings star on the left-hand side of the post.
If someone answers your question correctly please let other members know by clicking on ’Mark as Accepted Solution’.

Maximum number of connection profiles and group policies for Cisco ASA

Hi,
We have a Cisco ASA 5520 running 8.0(2) that we use only for Remote Access VPN.
Does anyone know how many connection profiles and group policies that are supported on the box? I have not been able to find this in the manual.
Thanks in advance for your help!
Best regards,
Harry

There is no limit for connection profiles or group policies that can be configured on ASA. However the numbers do depend upon the memory available in the device as the profiles are stored in memory during execution.

ACE 4710 SSL connection rate

What exactly happens when the SSL connection rate is exceeded. Is the connection dropped, queued or what ?
Defined as the SSL TPS. In our case 1000 but upgradeable to 5000

Hi,
The connection will be denied once the SSL connection rate is exceeded.
That can be identified by using the command :
show resource usage all
You will see something like this :
Resource Current Peak Min Max Denied
ssl-connections rate 995 1000 0 1000 28975
You will notice that the deny counter will start increasing once the rate is exceeded.
hope that helps.
regards,
Ajay Kumar

Pull DPs and rate limiting.

Hi,
I have a 2012 SP1 environment and 77 sites globally. These sites vary from 34Mb to 1Mb links, and use rate limiting. I want to implement Pull DPs to help distribution issues but am up against the rate limiting issue. I cant configure these remote sites to
use a more local site and keep their control over how much bandwidth they use, and so wondered how other people got around this issue?
I currently have a star network, but want to make 5 of the larger bandwidth sites be source locations for content too.
Thanks
Kim

Hi,
For Pull DP's you can restrict the bandwidth that is used by BITS on the Pull DP. It is covered here as well:http://blogs.technet.com/b/configmgrteam/archive/2013/06/06/introducing-the-pull-distribution-points.aspx
You can use either the admin console or a group policy for instance.
Regards,
Jörgen
-- My System Center blog ccmexec.com -- Twitter
@ccmexec

702W Access Point and Bi-Directional Rate Limiting

Has anyone checked whether BDRL (Bi-Directional Rate Limiting) is supported on relatively new 702W APs.
I need it to work in FlexConnect mode.
Thanks,
Nick

It is not supported,
http://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113682-bdr-limit-guide-00.html

Rate Limiting - Will Content Engine 590 solve my problem?

We have a Cache Engine 550 deployed in our network which is great for reducing traffic on the Link to the Internet, however I have now run into a little problem with the device as we are now trying to implement Bandwidth Shaping using the existing Cisco infrastructure and thus the Cisco IOS.
One of the IOS features concerned is Committed Access Rate (CAR).
We would like to do some traffic shaping according to certain IP Protocols such as FTP, HTTP as well as rate limiting certain of our customers (IP Blocks) so that they dont saturate the Serial link to our ISP.
The problem we have is that the Cache Engine 550 replaces the original requestors IP with its own as it (the CE) now takes over as the requestor to the Internet thus we have all HTTP traffic via our ISP having the source as that of the Cache Engine.
Due to this we cannot Rate-Limit a particular customer (IP range).
Question-------
Does the Content Engine 590 (ACNS, ICDN) enable me to complete my task and control the Serial connection the way I would like to?
Can I do a sort of IP Spoofing so that the original IP is still in place, but the Content Engine still does its job of Caching?
I have already looked at the Packeteer unfortunately it only has Ethernet ports.
The WiseWan 401 with HSSI port looked promising, but I feel that even though it will do great shaping and graphs it will still not solve the problem of a saturated link upstream to the ISP (from the boxes point of view), I will still sit with packets being dropped and thus bandwidth wasted.
Anyone out there with any other solution?
Thanks in advance.
Lutz.

Hi,
We have just implemented IP spoofing in version 4.2 of ACNS code. (Caching) which will only run on a 590/560/507/7320 cache.
Version 4.2 sould be available at the end of July early August. This will slove you problem with identifing traffic to rate limit.
Cheers
Phil

BT Wi-Fi connection drops and cannot be closed

I use BT Wi-Fi on a monthly subscription - 500 minutes for £6 a month, plus 12p a minute for any extra minutes.
Occasionally my connection drops, and I have to reconnect and login again, which I can do OK.
But when I check later how many minutes I used, via my online subscription info, it's clear that I end up with two connections running in parallel. The connection which dropped carries on as active in the background somewhere until it is eventually auto-disconnected (after 15 or 20 minutes ?) due to inactivity. So I lose those minutes each time this happens.
There is no way to close the dropped connection. Even if I log out of my new 2nd connection, it only closes that one, not the dropped one which I can't access.
Today this happened when I was at the end of my monthly allowance, so because I couldn't close the connection I've now gone around 30 minutes over my allowance, which will cost me £3.60.
Please can we have a way of closing all connections on a BT Wi-Fi account, to deal with this issue.
And a refund would be good, as I had no way of preventing my account going into the 12p a minute rate.

this is a customer help customer forum and your posts do not go to BT
have you tried the helpline 0800 022 33 22
If you like a post, or want to say thanks for a helpful answer, please click on the Ratings star on the left-hand side of the post.
If someone answers your question correctly please let other members know by clicking on ’Mark as Accepted Solution’.

Policy-map based rate-limiting per vlan

Hi
I was thinking if someone could help me to come up with solution to a problem. Scenario as follow:
I have a trunk interface with multiple vlans on:
interface GigabitEthernet2/0/3
description TRUNK-to-*********
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 415,416,610,1191-1193,1195
switchport mode trunk
duplex full
storm-control broadcast level pps 1k
storm-control multicast level pps 3k
storm-control unicast level pps 250k
storm-control action trap
spanning-tree portfast trunk
spanning-tree bpdufilter enable
I'm trying to rate limit two of the vlans that are present on this trunk interface - vlan 415 and vlan 1192.
So I'm putting the class-map (to be later applied under the policy-map which is not significant here):
(config)#class-map match-any 120-mbps-class
(config-cmap)#match input-interface vlan 415
(config-cmap)#match input-interface vlan 1192
Now, when you show the class-map I created, I can see this:
sh class-map 120-mbps-class
Class Map match-any 120-mbps-class (id 1)
   Match input-interface Vlan415
   Match input-interface FastEthernet0
For some bizzare reason class-map is matching the Fa0. I have researched this, and this is most probably because you can only match 1 vlan instance under the class-map.
And here's my problem - I can't police whole interface as the other vlans should not be policed - how can I police those two vlans ?
Any thoughts ? All help appreciated as always.
Rob.

Hi Daniel,
I have labed it and unfortuantely it does not work as expected. I have put 1x 3750 and 1x 2960 trunk between them, each box had an access port for laptop to create some traffic across. All vlan-based qos has been applied on 3750G.
3750G config
Interface g1/0/20
descriprion trunk
swicthport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 100,120
Interface g1/0/1
description access
switchport mode access
switchport access vlan 100
Interface vlan 100
ip address 192.168.100.254
service-policy input PARENT-POLICER
Interface vlan 120
ip address 10.10.10.1
Policy-map PARENT-POLICER
class PERMIT-ANY-CLASS
trust COS
service-policy CHILD-POLICER
class-map match-any PERMIT-ANY-CLASS
match access-group name POLICY-LIST
Extended IP access list POLICY-LIST
    10 permit ip any any
Policy-map CHILD-POLICER
class INTERFACE-POLICE-CLASS
police 100000 8000 exceed-action drop
Class Map match-any INTERFACE-POLICE-CLASS
Match input-interface GigabitEthernet1/0/20
2960 config:
interface g0/20
switchport mode trunk
switchport trunk allowed vlan 100,120
interface g0/1
switchport mode access
switchport access vlan 100
interface vlan 100
ip address 192.168.100.253
interface vlan 120
ip address 10.10.10.2
So as you can see vlan 100 is the one it need to be rate limited (I have only rate limited to 100kbps just to see if it's working) and vlan 120 is only on the trunk ports to confirm if the traffic for this one is not affected.
Unfortunately when the policing is applied on 3750 vlan 100 (and policing is working fine) then I can see the packet loss while pinging between switches on vlan 120 suggesting that the policy is affecting the other vlan as well. When I take the policy out of the vlan 100 I cannot observe the packet loss on vlan 120 meaning is no longer affected.
Not sure if I have explained this clear enough so far, if not let me know.
Do you have any suggestions ?
Thanks!

ASA connection rate and stateful packet inspections rate limiting

Similar Messages

Maybe you are looking for