Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Cisco ASA 5510 setup at a boarding school. I determined that many (most?) of the students were downloading files, watching movies, etc, during the day and this was causing the academic side of our network to suffer. The students should not even be in their rooms during the day, so I configured the ASA to police their network segment and limit their outbound bandwidth. This resolved all of our academic issues, and everyone was happy. Except the resident students.

I have been asked to change/remove the policing policy at the end of the day, to allow the residents access to the unused bandwidth at night. There's no reason to let bandwidth sit unused at night just because it would be abused during the day.

Is there a way to setup Time of Day based Policies on the ASA? Ideally I'd like to be able to open up the network at night and all day during weekends.

If I can't set Time based policies, is is possible to schedule the ASA to load a set of commands at a specific time?

I suppose I could just setup a scheduled task on one of our servers to log in and make the changes with a simple script, but this seems like a hack, and I'm hoping there is a better or more standard way to accomplish this.


Edit: If there is a totally different solution that would accomplish a similar goal, I'd be interested in that as well. Free/Cheap would be ideal, but if a separate internet connection is my only other option, it might be worth fighting for money for hardware or software to do this better or more efficiently.

share|improve this question
up vote 3 down vote accepted

The PIXOS feature you are looking for is called Time Based Access List. It is a two step approach

  1. Create the time-range object
  2. Attach the time-range object to a specific rule

The ASA will then only apply the targeted rule during that time-range. You should be able to get what you want with something like this

hostname(config)#time-range OffHours
hostname(config-time-range)#periodic weekdays 17:00 to 07:00
hostname(config)#access-list Residence line 1 extended permit ip any any time-range OffHours
hostname(config)#access-group Residence in interface inside

Full write-up at Cisco Command Reference

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.