Current outbound rate limiting capabilities

Hello All,
I have recently reviewed this thread from back in January-March: https://supportforums.cisco.com/thread/2002325?tstart=60 . I have been facing the same predcament decrsibed be people in this thread. That being end user machines get compromised and then send out large volumes of spam via legitimate accounts on our servers. In our cases, the outbound from addresses have all been the actual user address. The end user environment is ActiveDirectory & Exchange.
If I cannot rate limit based on a sender address, then I am wondering if the 370D model would allow me to somehow define virtual gateways which would correspond to users found within a specific portion of my Active Directory environment. For example, if all sales dept. staff were within a single AD OU, could I create a virtual gateway that corresponds to just these people and have that gateway set with different rate limits than another gateway which corresponds to a different group of users?
Lastly, is it possible with any of the appliance models to define specific outbound rate limits for recipient domains? For example, messages destined for hotmail.com would have a different rate limit than messages destined for gmail.com. Would this functionality work with mixed recipient domains in the To: field?
Thanks,

Yes, you can define outgoing mail policy or outgoing content filter based on sender's LDAP group (e.g. CN=West,OU=Sales,....) and then use a filter action "Deliver from IP interface" to choose to deliver the emails from selected IP interface.
You can define delivery rate limit based on destination domain under 'Mail Policies'-'Destination Controls'.
I recommend to enable antispam scanning for outgoing emails. You can add custom header if the message is a positively-identified spam. Then you can use an outgoing content filter action to redirect spams to be delivered from another IP interface or another mail host if outgoing message contains the custom header. This can allow good and bad emails to be delivered from different IP interfaces.

Similar Messages

Creating a Ring with Ethernet?? Rate Limiting

This is a two question topic. I am in an office building and I want to provide ISP services to people throughout the building. I have 5 2900XL switches with fiber gigabit ports for uplinking to each other. I will put one switch in each floor for clients to plug into, and run fiber from floor to floor.
Using the equiptment I have (i.e. -- not special SONET equiptment or anything), how can I create a redudant ring so that if the fiber is broken traffic will flow in the other direction? I know SONET will do this, but I don't want to buy special equiptment for that.
Also, please remember this will need to be at layer-2 since these are only layer-2 switches, so using dynamic routing to handle the redudancy is not an option.
Finally, each client will be put in their own VLAN. How can I rate limit the outbound traffic? For example, I may want to sell a 6Mbps service and charge more for it than a 3Mbps service.
Is there any way I can use what I have to do what I need? If not, what additional equiptment do I need to buy?

Hi,
You can certainly daisy chain them into a ring type topology, and Spanning Tree Protocol will block one of the redundant links to prevent a loop.
A better, (but more costly design) would be to have two additional switches and dual home all of the 2900xl switches to the "core switches." That will give you redundancy as well as keeping traffic flow such that the 2900 switches aren't used as "transit" switches for devices communicating between non-contiguous switches. However, for 5 switches, this may be overkill :-)
As for rate limiting, the 2900XL series switches do not provide rate-limiting or policing features. They are fairly dumb Layer 2 devices and will not give you the option to limit the bandwidth on any port. The lowest-end switch that we currently sell that can do rate-limiting is the 2960.
HTH,
Bobby
*Please rate helpful posts.

Current Promo Rate Expired Email

In the past month I've received two emails with the subject "Current promo rate expired or soon to be expiring". Both of the emails (when you follow the link inside) offer what appears to be an extension of the deal that just expired for me, $69.99 per month for Blast Plus! with HBO for 2 years with a 2 year agreement. The webpage provides the phone number 1-855-566-1415 to get this offer. The email states that its for all existing customers, the webpage states only limited to new residential customers. Since this reduces my bill by around $20, I called. After speaking with 2 representatives about this deal they came to the conclusion that this deal didn't exist and was not in their system however they came up with a new deal (essentially the same deal but cheaper and only for 1 year) which was $54.99 a month for Blast Plus! with HBO with Showtime and a $50 gift card. This deal is obviously targetted towards a new customer but since its offered I'm not going to argue. After waiting for them to speak with a sales representative to get it added to my account I'm told that I need to call customer solutions at 1-800-934-6489 to get this added to my account since I already have a double-play package. The first representative (actually rep 3, but the first for this phone number) transfers me pretty quickly to someone else. After describing what I'm trying to do, and relaying the entire history of why I was calling she looks up what emails were sent to me. She tells me I was never sent these emails and they only sent me an email on May 27th detailing what packages I had and which were expiring. This particular email I NEVER received. She then tells me that the offer in the two emails (which she says were never sent to me) are not valid for me and that the third offer (the $54.99 a month one) doesn't exist in any system. An hours worth of sitting on a phone proven to be pointless, only to be told that she has nothing for me other than a package that would increase my bill - the exact opposite of what I was offered and she said the other reps must be confused and are wrong. So where do I go from here? How can I take advantage of one of 3 offers that were given which significatly decrease my bill (25-50% decrease) but apparently were never sent and don't exist. Somebody from Xfinity sent them (twice) to me and I would really like to take advantage of them.

ComcastZach wrote:
I could use 1 million dollars and case of beer if you have those handy ;-)
As the one who escalated the issue which got the issue resolved, I want a cut of that 1 million dollars.
All I want is enough to get rid of the old out-dated kitchen, get a old tree cut down. a new roof on the house and a new wide southern style veranda front porch.

Major bug in SMTP rate-limiting implementation

I use my home computer to, among other things, host a mailing-list for a fan-club of a contemporary Russian poet. The total list of subscribers is about 40 people and messages are, on average, rare.
However, when a discussion picks up, the number of e-mails can briefly spike easily exceeding Verizon's "you must be spamming" threshold. Imagine: one person asks a question and two others respond. Both the question and the responses get sent to the list, so that's 3x40=120 e-mails. If the discussion gets any longer, the e-mail account gets suspended for several days for exceeding the quota...
I understand, why Verizon rate-limits the outgoing e-mail sending and don't object to it in principle. However, the current implementation has a major flaw. When the threshold is exceeded, instead of blocking all subsequent messages with a permanent error (5xx in SMTP-speak), the server ought to issue a temporary failure (4xx in SMTP-speak).
This would block any spam-bots just as effectively, but allow legitimate messages to be properly queued by the sender's computers for resending. The 5xx code signals a permanent error so instead of being queued, the innocent message is suddenly bounced.
A friend of mine is an RCN-subscriber and we know, that RCN implements rate-limiting exactly this way: if you are sending "too much", your messages will start being temporarily rejected for a while.
Solved!
Go to Solution.

Anthony, this is not a "disagreement" -- I'm pointing out a bug. The bug manifested itself with the following two problems:
Although none of the e-mails sent by my computer were spam, I was "identified" as a spammer and my access to SMTP was suspended for days. For no good reason.
Even if it were possible to appeal such automatic verdict (and I did try to talk to a customer support representative), permanent rejections in the case of a temporary error are wrong -- and in violation of SMTP specifications.
I did post the same text under the "New Ideas", but I don't think, "new idea" is the good place for this. I'm not suggesting a new service, but demanding a fix to the existing one.

AirPort Extreme Multicast Rate limitation

I am currently using an iMac G5 which has an AirPort Extreme card with firmware 405.1. I have an AirPort Extreme (802.11n) base station that is running firmware version 7.1.1. My Radio Mode is "802.11n (802.11b/g compatible)." My wireless security is WPA/WPA2 personal.
When I go into my Wireless Options, my Country is United States, my Transmit power is 100% and my WPA Group Key Timeout is one day. It is not a closed network and I do not use interference robustness.
When I open the options for "Multicast Rate," the highest available rate is 11 Mbps. From what I understand, wireless G is capable of 56 Mbps (and that is how Apple advertised the Airport Extreme card when I bought it). Why is my multicast rate limited to 11 Mbps and how can I raise it to 56 Mbps?

I've always been a little foggy on multicast. The apple support article seems to imply that it only matters when "certain audio and video streaming servers or other applications with multicast capability" are on your network. (http://docs.info.apple.com/article.html?path=Airport/5.0/en/ap2087.html)
What if you don't have one of these multicast servers or applications on your network? Does the multicast rate have any effect on your network performance?
My understanding is that the answer is YES - regardless of whether you have one of these multicast servers or not, setting your multicast rate to X means that only airport clients that can achieve a speed of X or greater will be able to connect to the base station. If you set it to 1, then you will extend the range of your network. But sometimes, in a WDS, where multiple base stations on the same channel overlap, I find that my clients have trouble deciding which base station to connect to. So actually, it works better to set the rate a little higher. But I am never quite sure if this is true, or if its just my imagination.
At any rate (no pun intended) , I'm still foggy on multicast and would really appreciate if someone out there could clear things up or direct me to a link that explains what i need to know (starting with an actual definition of multicast).
Thanks

Pull DPs and rate limiting.

Hi,
I have a 2012 SP1 environment and 77 sites globally. These sites vary from 34Mb to 1Mb links, and use rate limiting. I want to implement Pull DPs to help distribution issues but am up against the rate limiting issue. I cant configure these remote sites to
use a more local site and keep their control over how much bandwidth they use, and so wondered how other people got around this issue?
I currently have a star network, but want to make 5 of the larger bandwidth sites be source locations for content too.
Thanks
Kim

Hi,
For Pull DP's you can restrict the bandwidth that is used by BITS on the Pull DP. It is covered here as well:http://blogs.technet.com/b/configmgrteam/archive/2013/06/06/introducing-the-pull-distribution-points.aspx
You can use either the admin console or a group policy for instance.
Regards,
Jörgen
-- My System Center blog ccmexec.com -- Twitter
@ccmexec

Credit - use current convertion rate (possible?)

Good Morning all!!
I need help with something regarding sales credit value.
There are situations where the customer has a credit limit configured in one currency (lets say dollar) and has it´s sales invoices in another (lets say euro).
If I create an invoice today for a customer configured like mentioned above, SAP uses the credit value from the invoice date (in the past). This is the normal behavior and I will try to explain in a sample bellow:
01/01 - Invoice 00001 - Value: 100 euros (credit: 75 dollars) - converted using conversion rate from 01/01
02/01 - Invoice 00002 - Value: 100 euros (credit: 80 dollars) - converted using conversion rate from 02/01
The credit limit compromised by invoices is: 155 dollars (75+85). It adds up the value in dollars from the date 01/01 and 02/01 - the date when the invoice was created.
Lets say today (13/01) the conversion rate is very vey high, like 1 euro = 4 dollars; I would like SAP to recalculate the value in Euro from invoices 00001 and 00002, so the new credit limit compromised by invoices would be 800 dollars.
Is there any way I can make SAP recaculate the old invoice values, converting its values in credit management for the current conversion rate (and not the old one)?
Thank you!

Hi Michelle,
Your requirement seesm to be pretty unique.
Firstly you will have to look at the specific functionality which links the value in a sales document (sales order or invoice) to the credit limit of the customer.
This is done by the Update field maintained in the Credit Control Area that has been assigned to the Compnay Code of the customer.
The currency that is maintained in the Credit Control are is the currency that is used to update in FD33.
Request you to check this.
Thanks and regards,
J Nagesh

Use Current Exchange Rate from the Exchange Rate Table itu00B4s not working

Hi Experts:
Working with manager user, Iu2019m trying to create a Goods Receipt PO through the Draw Document Wizard, but the option u201CUse Current Exchange Rate from the Exchange Rate Tableu201D it is not working, it does not bring me the USD exchange rate of today defined in the table; it brings the USD exchange rate from the base document (AP Reserve Invoice), and Iu2019m not allowed to change it. What should I do?. We are working wih SAP Business One SP01 PL06. Thanks
CLAUDIA

Hi,
There is a SAP Note related to your issue, have a look at this.
[http://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/oss_notes/sdn_oss_sbo_adm/~form/handler%7b5f4150503d3030323030363832353030303030303031393732265f4556454e543d444953504c4159265f4e4e554d3d373033303238%7d]
...For companies using the Continous Stock System feature, there are three additional scenarios in which the row Exchange Rate will be copied from the base document regardless of the calculation method chosen in the 'Draw Document Wizard':
a) Goods Receipt PO -> Goods Return.
b) Goods Return -> Goods Receipt PO.
c) AP Reserve Invoice -> Goods Receipt PO.
Hope this helps,
Son.

Revenue at fixed exchange rate and Tax at current exchange rate.

Hello,
We have a requirement wherein a foreign currency sales order is negotiated at fixed exchange rate. At the time of billing while revenue should be booked at negotiated exchange rate, tax(mwst) should be calculated at current exchange rate.
Is this possible and how ?
Kindly share your expertise
Regards
Unit.

Hi,
I think that it should be possible. Since I do not have system in front of me to test, I could not test it. As per the pricing procedure the price of the product gets defaulted. This can be manually modified and key in the revenue figure at a fixed exchange rate. In the case of tax calculation, the system will take the current exchange rate. If possible, pl take the help of SD Consultant.
Trust this helps,
Cheers,

Non-leading ledger depreciation area posting depreciation expense at current exchange rate - need to be historical

Hi all,
We are facing an issue where we have a depreciation area "02" posting to our non-leading ledger. It is set to post depreciation only.
I noticed the depreciation expense is hitting the non-leading ledger and translating (CAD) into group currency (USD) at the current exchange rate. But in the leading ledger, the rate is historical.
How can we have the non-leading ledger post at historical exchange rates for depreciation postings?
thx..

Hi Jay,
Check the exchange rate type & translation date maintained for the non leading ledger in OB22.
Regards,
Mukthar

When exporting a slideshow, what does "current frame rate" mean?

I'm exporting a slideshow from iPhoto '11 and I'm using custom settings
I am wondering when you click the custom settings button
what does "current frame rate" mean?
does it mean use the current frame rate that it uses to let me preview the slideshow?

Welcome to the Apple Discussions. What happens to the slideshow other than giving you this error. Don't know what it means. However, several users have reported iPhoto crashing when trying to export a slideshow. You might search this forum for that to see if you're experiencing something similar. As far as I know there was no fix found.
Be sure to report it to Apple via via http://www.apple.com/feedback/iphoto.html.
OT

Rate limiting on Catalyst 2950T switches

Hi,
I would like to allow some users full access to internal servers, but only provide them with 2 Mbps access to the Internet. As far as I understand I cannot use the deny statement when defining the access-list for the class-map and therefore I am asking for your help. (The config below work well for rate-limiting all traffic, but I would need full access for traffic matching access-list 111):
access-list 111 remark [ Traffic not to be rate limited ]
access-list 111 permit ip 10.0.0.0 0.255.255.255 192.168.0.0 0.0.255.255
access-list 112 remark [ Traffic to be rate limited ]
access-list 112 permit ip 10.0.0.0 0.255.255.255 any
class-map match-all Internet-Class
match access-group 112
policy-map Internet
description [ Rate limit Internet access ]
class Internet-Class
police 2000000 65536 exceed-action drop
interface FastEthernet0/1
service-policy input Internet
interface FastEthernet0/24
service-policy input Internet
Any help would be very appreciated!
Regards,
Harald

Thanks again for the reply!
My "working" configuration is as follows:
access-list 111 remark [ Traffic not to be rate limited ]
access-list 111 permit ip 10.0.0.0 0.255.255.255 192.168.0.0 0.0.255.255
access-list 112 remark [ Traffic to be rate limited ]
access-list 112 permit ip 10.0.0.0 0.255.255.255 172.16.0.0 0.0.255.255
class-map match-all Local-Class
match access-group 111
class-map match-all Internet-Class
match access-group 112
policy-map Internet-Policy
description [ Rate limit Internet access ]
class Internet-Class
police 2000000 65536 exceed-action drop
class Local-Class
police 98000000 65536
interface FastEthernet0/1
description [ Local LAN facing interface ]
service-policy input Internet-Policy
interface FastEthernet0/24
description [ Internet facing interface ]
service-policy input Internet-Policy
However, I would like to change "172.16.0.0 0.0.255.255" in access-list 112 to "any" since it should apply to all Internet traffic. If I try to do that I get the mask error I previously mentioned.
Regards,
Harald

Policy-map based rate-limiting per vlan

Hi
I was thinking if someone could help me to come up with solution to a problem. Scenario as follow:
I have a trunk interface with multiple vlans on:
interface GigabitEthernet2/0/3
description TRUNK-to-*********
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 415,416,610,1191-1193,1195
switchport mode trunk
duplex full
storm-control broadcast level pps 1k
storm-control multicast level pps 3k
storm-control unicast level pps 250k
storm-control action trap
spanning-tree portfast trunk
spanning-tree bpdufilter enable
I'm trying to rate limit two of the vlans that are present on this trunk interface - vlan 415 and vlan 1192.
So I'm putting the class-map (to be later applied under the policy-map which is not significant here):
(config)#class-map match-any 120-mbps-class
(config-cmap)#match input-interface vlan 415
(config-cmap)#match input-interface vlan 1192
Now, when you show the class-map I created, I can see this:
sh class-map 120-mbps-class
Class Map match-any 120-mbps-class (id 1)
   Match input-interface Vlan415
   Match input-interface FastEthernet0
For some bizzare reason class-map is matching the Fa0. I have researched this, and this is most probably because you can only match 1 vlan instance under the class-map.
And here's my problem - I can't police whole interface as the other vlans should not be policed - how can I police those two vlans ?
Any thoughts ? All help appreciated as always.
Rob.

Hi Daniel,
I have labed it and unfortuantely it does not work as expected. I have put 1x 3750 and 1x 2960 trunk between them, each box had an access port for laptop to create some traffic across. All vlan-based qos has been applied on 3750G.
3750G config
Interface g1/0/20
descriprion trunk
swicthport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 100,120
Interface g1/0/1
description access
switchport mode access
switchport access vlan 100
Interface vlan 100
ip address 192.168.100.254
service-policy input PARENT-POLICER
Interface vlan 120
ip address 10.10.10.1
Policy-map PARENT-POLICER
class PERMIT-ANY-CLASS
trust COS
service-policy CHILD-POLICER
class-map match-any PERMIT-ANY-CLASS
match access-group name POLICY-LIST
Extended IP access list POLICY-LIST
    10 permit ip any any
Policy-map CHILD-POLICER
class INTERFACE-POLICE-CLASS
police 100000 8000 exceed-action drop
Class Map match-any INTERFACE-POLICE-CLASS
Match input-interface GigabitEthernet1/0/20
2960 config:
interface g0/20
switchport mode trunk
switchport trunk allowed vlan 100,120
interface g0/1
switchport mode access
switchport access vlan 100
interface vlan 100
ip address 192.168.100.253
interface vlan 120
ip address 10.10.10.2
So as you can see vlan 100 is the one it need to be rate limited (I have only rate limited to 100kbps just to see if it's working) and vlan 120 is only on the trunk ports to confirm if the traffic for this one is not affected.
Unfortunately when the policing is applied on 3750 vlan 100 (and policing is working fine) then I can see the packet loss while pinging between switches on vlan 120 suggesting that the policy is affecting the other vlan as well. When I take the policy out of the vlan 100 I cannot observe the packet loss on vlan 120 meaning is no longer affected.
Not sure if I have explained this clear enough so far, if not let me know.
Do you have any suggestions ?
Thanks!

EMAIL RATE LIMITATION error msg

I sent an email to my sis [whom I email on a regular basis] and 3 days later it came back undelivered with the following message:
Temporary error returned by SMTP partner.
smtp;421 RP-001 The mail server IP connecting to Windows Live Hotmail server has exceeded the rate limit allowed.
Reason for rate limitation is related to IP/domain reputation problems.
Does this mean I might have a virus that's using my email client to spam other people? What does it mean?

A valid email address should have the form "[email protected]" with only one "@" character and no spaces.

WLC - Rate-limiting with QoS Roles

We have a large number of locations that we would like to deploy the 2100 series wireless controllers. Among other things, we would like to provide generic rate-limiting to all users(per-user bandwidth limits). This is a hospitality guest access environment and content filtering is really not a concern. We would, however, like to prevent one or a few users from saturating the circuit at the expense of other users. It looks like the WLCs can handle this with a QoS Profile assigned to the guest wlan and bandwidth-limiting QoS Roles applied to each user. The issue we may run into is web-authentication needs to be disabled. There is another device on these locations that will be providing those services.
Is it possible to apply a QoS Role by default to all users who associate to a controller without authentication? Also, if anyone has attempted this design model I would greatly appreciate some input on any unexpected or undesirable results you may have noticed.
I appreciate everyones help.

Thanks so much for such a quick response. I may be misunderstanding some of the documentation and would really appreciate some clarity. I am understanding a QoS Profile to be applied to one or more WLANs and all user traffic from clients of those WLANs will fall under the qos policy as a group(bandwidth limitations would be applied to all of the user traffic combined). For example, a profile capping downstream bandwidth at 1544kbps would limit all user traffic from all of the clients associated to that ssid at 1544kbps. If we were to assume some degree of fair bandwidth distribution and there are 10 users receiving traffic at a given time, then each user would receive no more than 154.4kbps. Or, are QoS Profiles actual templates that are applied to each user that associates to that ssid? For instance, if we consider a profile capping 1544kbps downstream applied to a WLAN with 10 users associated. Each user would be able to download up to 1544kbps and the full bandwidth usage for that WLAN would be 15440kbps.
Thanks again for your help.

Current outbound rate limiting capabilities

Similar Messages

Maybe you are looking for