At a branch with a single 300 Mbps internet uplink, night-time cloud backup streams saturate the FTD's outside routed interface and voice calls turn choppy. The engineer wants the backup application capped at 150 Mbps without touching other allowed sessions, but a prefilter rule currently fastpaths that application and a site-to-site VPN also terminates on the box. Which configuration change makes the rate limit take effect?
Select an answer to reveal the explanation.
Short Explanation
Fastpathed traffic is not rate limited, so your backup stream won’t be capped. Change the prefilter rule to Analyze, allow the traffic, and police only that application at 150 Mbps on the outside interface—like adding a turnstile just for the backup traffic, without slowing other sessions.
Full Explanation
The required change is to change the prefilter rule from Fastpath to Analyze so the backup traffic reaches an access control allow rule, then apply a 150 Mbps police action that matches only the backup application on the outside routed interface. Cisco documents that QoS rate limits only allowed or trusted traffic and does not rate limit fastpathed traffic, so adding a matching outside-interface policy without changing that rule is insufficient. Applying the police action to the VPN tunnel interface targets the wrong traffic path: the backup streams saturate the routed internet uplink, while the site-to-site VPN is a separate termination on the device. Policing all inside-to-outside sessions on the outside interface could reduce uplink load, but it would also rate-limit other allowed sessions, contrary to the requirement to leave them untouched. Exam caveat: policing enforces a ceiling by dropping excess matching traffic; it does not reserve 150 Mbps for backups or guarantee voice bandwidth, and platform/version support and policy direction can affect behavior. Practical check: after deployment, verify the prefilter rule is no longer Fastpath and the backup traffic is allowed, confirm the QoS match counters increment only for backup flows, and check the outside-interface rate and voice quality during a backup run.