Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're going to have an ISP turn up a 100 mbit circuit at our office building (multiple floors, multiple offices). We need to control how much bandwidth is allocated to/used devices on the LAN. For example office 01 is connected to switchport 01 and we need to provide them with the ability to browse the internet at 1 mbit speed (out of a 100 mbit that we have available).

How can we accomplish this?

We currently own a couple of ASA 5510's and 3560 switches. Can we use this equipment or are there other devices that should be purchased that would allow us to do what we need to do more efficiently?


share|improve this question
up vote 1 down vote accepted

The small ISP where I work uses a packet shaper from these guys ( to manage bandwidth allocation among our clients. If you have the ability to keep different offices/floors on different subnets (can be classless), very granular bandwidth control should be very easy - down to limits on a single host, if you want.

If you don't want an off the shelf solution, you can create a packet shaper yourself from a Linux server with dual NICs using tc. I've experimented with this, but decided that given limited admin time, an off-the-shelf solution was the better buy. This article should get you started:

share|improve this answer

This might get you started in the direct direction:

share|improve this answer
But that limits LAN bandwidth as well - I don't think you'd want to limit, for example, the bandwidth between a workstation and the local fileserver, just the external bandwidth to the outside (internet, WAN, whatever.) – mfinni Sep 1 '11 at 18:15
Good catch! Per VLAN - – user48838 Sep 1 '11 at 18:33
Also, the article describes how to limit traffic in the inbound direction (to the switch). That's traffic coming from workstations - "upload". Can the same technique be used to limit traffic leaving the switchport, going towards the workstations - "download"? – Marvin Sep 1 '11 at 18:41
Maybe if the VLAN membership tagging/identification can take place on each of the individual workstation NICs. – user48838 Sep 1 '11 at 19:05
As shiftycow has identified, the more flexible approach at the logical level will be to use an additional traffic shaper. We briefly looked at the NetEqualizer, but went with for their flexibility in management and reporting. You can "slice-n-dice" per IP, net-range and even application asymmetrically in both directions. – user48838 Sep 1 '11 at 19:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.