I have a single 100mb leased line that will be shared by three unrelated companies.

We are looking to buy a cisco ASA 5512-X and I need to use policing to ensure that each company receives 1/3 of the bandwidth. So I can set three vlans but can I do policing across/between the three vlans.

As an alternative would it be possible to configure the ASA so that I can assign a public IP address to each of the internal interfaces while still policing traffic between them. The companies would them be able to attach a router to there own assigned lan port.

Possibly the easiest way to set this up would be to set the ASA to transparent mode with policing per IP. The ASA would use one of the public IPs, but you'd need a /29 anyway.

firewall transparent
!
interface Ethernet0/0
 nameif outside
 security-level 0
!
interface Ethernet0/1
 nameif inside
 security-level 100
!
ip address 1.2.3.4 255.255.255.0
route outside 0.0.0.0 0.0.0.0 1.2.3.5 1
!
access-list rate-limit-tenant1 extended permit ip any 1.2.3.1 255.255.255.255
access-list rate-limit-tenant1 extended permit ip 1.2.3.1 255.255.255.255 any
access-list rate-limit-tenant2 extended permit ip any 1.2.3.2 255.255.255.255
access-list rate-limit-tenant2 extended permit ip 1.2.3.2 255.255.255.255 any
access-list rate-limit-tenant3 extended permit ip any 1.2.3.3 255.255.255.255
access-list rate-limit-tenant3 extended permit ip 1.2.3.3 255.255.255.255 any
!
class-map rate-limit-tenant1
 match access-list rate-limit-tenant1
class-map rate-limit-tenant2
 match access-list rate-limit-tenant2
class-map rate-limit-tenant3
 match access-list rate-limit-tenant3
!
policy-map rate-limit-tenant1
 class rate-limit-nuwave
  police input 33300000 10240
  police output 33300000 10240
!
policy-map rate-limit-tenant2
 class rate-limit-nuwave
  police input 33300000 10240
  police output 33300000 10240
!
policy-map rate-limit-tenant3
 class rate-limit-nuwave
  police input 33300000 10240
  police output 33300000 10240
!

This gives each of the 3 tenants 33.3Mbps with a small burst. The ASA uses 1.2.3.4 for managment access, and 1.2.3.5 is the ISP's gateway in this example. This does not use vLANs, but they're not necessary anyway. If you did want to use them then you'd have to have separate subnets for each tenant, and would have to operate in routed mode instead of transparent.

I have not tried copying any pasting this code into a default configuration. I believe it's close, but not all that's necessary.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.