I'm intending to purchase a Cisco ASA 5510, but am wondering whether or not I should expect to be able to do things such as mentioned in the question title with a typical firewall (or specifically with the aforementioned model, if you know), as well as things like blocking specific HTTP User-Agents, and limiting the size of HTTP request bodies, setting up more complicated throttling rules like requests per minute with burst allowances, etc.

I know these things can be handled by my web server, but would prefer to be able to offload the work on my firewall, and also remove the necessity of having these security-ish-related items being handled by my web server.


In general, you will find that the Cisco ASA is a fantastic firewall, and you can do a lot with it. That said, many advanced features are either much easier to configure - or only available - when you integrate the ASA into one of Cisco's other products. Your two scenarios are one of each:

The ASA can do throttling per-IP without any additional licenses or modules, using traffic policing and traffic shaping. See here for traffic policing and shaping sample configs. These are set up to shape by QoS value or URL, not IP address, but changing to IP address is trivial. https://supportforums.cisco.com/docs/DOC-1230

For the more advanced deep-packet inspection things like blocking or throttling based on user-agent, you will need an AIP SSM module in your ASA 5510. This also gives the firewall fairly advanced IPS capabilities in conjunction with Cisco IPS. To configure IPS style blocking and shunning based on hosts and policy rules, see here: http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_example09186a0080afe111.shtml


It really depends on the type of firewall that you buy. The range of features of the firewall depends on the price and brand. I'm not too familiar with Cisco ASA 5510, but based on the price from what I see online, I would be surprised if it was not able to do so. At my company we use Palo Alto firewalls that are a bit more expensive, but they allow us to throttle request, block HTTP User-Agents, among many other features.

Your best bet would be to contact your local Cisco reseller, and talk to them about the features of the ASA 5510. They should be very knowledgeable about the product, and if it doesn't offer the features you desire, they may be able to show you other models or even other brands that do meet your needs.

  • PANs are pretty amazing. I wish I could justify purchasing one for work. – EEAA Oct 23 '12 at 0:23
  • They really are. The price is high for them, some of the most expensive out there, but being able to filter based on application and not port is amazing. I love the interface, once you learn them working with them is just so easy. – LandonWO Oct 23 '12 at 6:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.