Bandwidth Restriction

Question

Hi,
i have got internet router cisco 1700 series, my fastethernet has got 1 public IP address eg. 10.10.10.1 connected to LAN& S0/0 as got public IP address eg. 1.1.1.1 which is connected to ISP(1 Mbps lease line). i have been using few public IP address to my LAN for FTP,Webserver,Mail Server etc... now is there any option in the router where i can restrict only 128 Kbps alone for my FTP server. where FTP server IP is 10.10.10.2, since FTP alone is occupying almost entire bandwidth, users on my LAN trying to access internet is become very very slow.

Answer 1

Hello,
unfortunately the config above will not work, because it does not describe FTP traffic properly.
TCP port 21 is only the control session, whereas the data transfer with active FTP is done through TCP port 20. Data transfer in general will cause your congestion problems. With passive FTP you will have dynamically assigned port numbers and then an access-list is NOT able to grab the majority of FTP transfer at all.
So you need to use NBAR for your case. The config would look like this:
ip cef
class-map match-all FTPserver
match ip address 100
match protocol ftp
policy-map Output1
class FTPserver
shape average 128000
interface Serial0
description 1Mbps to ISP
ip address 1.1.1.1 255.255.255.252
bandwidth 1024
service-policy output Output1
access-list 100 permit host 10.10.10.2 any
The class-map FTP describes traffic, which is from host 10.10.10.2 AND is FTP. This includes active and passive FTP control session and data session.
In the policy this traffic is limited to 128 kbps through shaping, i.e. there is never more than 128 kbps utilization from FTP traffic on your WAN link.
In case you would like to limit FTP only in case there is other traffic please use the following policy:
class-map match-all FTPserver
match ip address 100
match protocol ftp
class-map match-all NonFTPserver
match not class FTPserver
policy-map Output1
class NonFTPserver
bandwidth percent 75%
This will guarantee 75% of the bandwidth to traffic not being FTP from your server. This will only restrict FTP traffic when thre is no other traffic.
Cisco does recommend not to plan for more than 75% percent of interface bandwidth, because of L2 keepalives, and system messages in general.
Hope this helps! Please rate all posts.
Regards, Martin