Cisco Systems and the ASA Services Module Manual De Usuario

The ASA supports the following QoS features:

Policing—To prevent individual flows from hogging the network bandwidth, you can limit the 
maximum bandwidth used per flow. See the 

more information.

Priority queuing—For critical traffic that cannot tolerate latency, such as Voice over IP (VoIP), you 
can identify traffic for Low Latency Queuing (LLQ) so that it is always transmitted ahead of other 
traffic. See the 

 for more information.

Traffic shaping—If you have a device that transmits packets at a high speed, such as a ASA with 
Fast Ethernet, and it is connected to a low speed device such as a cable modem, then the cable 
modem is a bottleneck at which packets are frequently dropped. To manage networks with differing 
line speeds, you can configure the ASA to transmit packets at a fixed slower rate. See the 

 for more information.

A token bucket is used to manage a device that regulates the data in a flow. For example, the regulator 
might be a traffic policer or a traffic shaper. A token bucket itself has no discard or priority policy. 
Rather, a token bucket discards tokens and leaves to the flow the problem of managing its transmission 
queue if the flow overdrives the regulator.

A token bucket is a formal definition of a rate of transfer. It has three components: a burst size, an 
average rate, and a time interval. Although the average rate is generally represented as bits per second, 
any two values may be derived from the third by the relation shown as follows:

average rate = burst size / time interval

Here are some definitions of these terms:

Average rate—Also called the committed information rate (CIR), it specifies how much data can be 
sent or forwarded per unit time on average.

Burst size—Also called the Committed Burst (Bc) size, it specifies in bits or bytes per burst how 
much traffic can be sent within a given unit of time to not create scheduling concerns. (For traffic 
shaping, it specifies bits per burst; for policing, it specifies bytes per burst.)

Time interval—Also called the measurement interval, it specifies the time quantum in seconds per 
burst.

In the token bucket metaphor, tokens are put into the bucket at a certain rate. The bucket itself has a 
specified capacity. If the bucket fills to capacity, newly arriving tokens are discarded. Each token is 
permission for the source to send a certain number of bits into the network. To send a packet, the 
regulator must remove from the bucket a number of tokens equal in representation to the packet size.

If not enough tokens are in the bucket to send a packet, the packet either waits until the bucket has 
enough tokens (in the case of traffic shaping) or the packet is discarded or marked down (in the case of 
policing). If the bucket is already full of tokens, incoming tokens overflow and are not available to future 
packets. Thus, at any time, the largest burst a source can send into the network is roughly proportional 
to the size of the bucket.

Note that the token bucket mechanism used for traffic shaping has both a token bucket and a data buffer, 
or queue; if it did not have a data buffer, it would be a policer. For traffic shaping, packets that arrive that 
cannot be sent immediately are delayed in the data buffer.