I have pix 515e v7.x and want to limit bandwidth priority, I have looked this link here:
http://www.cisco.com/en/US
but want specific answer if possible.
Let say i want to limit IPs from 192.168.20.80 to 100 (20 hosts) where they can get only up to 60kb per/scond, so how would I do this? thanks
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
The reason being that if you use the outside interface, you must apply the policy to outside IP addresses rather than the internal native IP's of the hosts. Since most configurations apply NAT and hosts do not typically have their own external IP, you would be unable to distinguish the hosts in question from regular traffic as when NAT is applied all hosts appear as the same IP.
The policy on the inside should not effect internal traffic unless I am mistaken. However it would affect traffic destined for other VLANS such as if you had a DMZ. If this is not the case then you should be fine.
If you had an available external IP, you could in addition configure policy NAT on the hosts in question to assign them to a separate IP and then apply the police policy to that IP. However not everyone has enough IP's available to use one for that purpose.
You can use Policy NAT to assign that group hosts their own Global IP, then you can apply the filter policy to the outside interface using that IP.
Please review a previous PAQ of mine for details on setting up Policy NAT.
http://www.experts-exchang
Business Accounts
Answer for Membership
by: raptorjb007Posted on 2008-08-13 at 18:57:56ID: 22227357
You can do this by using policy-maps. The following code should give you a general outline to accomplish what you are looking for. I configured it to be applied to the inside interface so you can limit the hosts using their inside nat'd IP's.
Line 1 is the access-list that is used to determine the hosts that will be limited. You can simply add a line for each host or specify appropriate ranges by adjusting the subnet mask. Feel free to name it whatever you want.
Line 3 and 4 specifies the class-map that you assign the ACL form Line 1 too. The class-map defines what you will be limiting in the policy. Again, name it what you want.
Line 6 and 7 create the policy-map. Name it what you will.
Line 8 assigns the previously created class-map to the policy.
Line 9 limits output to 60kbs with a burst rate of 1.5x the limit, the burst rate is in bytes instead of bits.
Line 10 limits the input.
Line 12 applies the policy to the inside interface.
The end result of this is that the hosts specified in the access list will have the Bandwidth limiting policy applied. Just beware if you have any additional VLANS such as a DMZ, the policy will apply to traffic between those vlans as well.
You can use the "show service-policy" command to view the policy config and statistics to verify the policy is operational.
Select allOpen in new window