Solved

Packets dropped on VLAN interfaces on Cisco ASA

Posted on 2010-11-30
6
3,370 Views
Last Modified: 2012-05-10

Our Cisco ASA is showing a large number of packets dropped on both VLAN interfaces (inside and outside), but the physical interfaces are not reporting the same. What would cause this issue?

fmg-fw# sh int
Interface Vlan1 "inside", is up, line protocol is up
  Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec
        MAC address c84c.7561.2509, MTU 1500
        IP address 192.168.1.1, subnet mask 255.255.255.0
  Traffic Statistics for "inside":
        882431847 packets input, 341832925500 bytes
        978670216 packets output, 973828835219 bytes
        23959504 packets dropped
      1 minute input rate 453 pkts/sec,  226367 bytes/sec
      1 minute output rate 499 pkts/sec,  521565 bytes/sec
      1 minute drop rate, 3 pkts/sec
      5 minute input rate 429 pkts/sec,  227337 bytes/sec
      5 minute output rate 501 pkts/sec,  527221 bytes/sec
      5 minute drop rate, 3 pkts/sec
Interface Vlan2 "outside", is up, line protocol is up
  Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec
        MAC address c84c.7561.2509, MTU 1500
        IP address 66.49.55.74, subnet mask 255.255.255.248
  Traffic Statistics for "outside":
        981700317 packets input, 974118544047 bytes
        832667112 packets output, 335521137359 bytes
        6049933 packets dropped
      1 minute input rate 515 pkts/sec,  525824 bytes/sec
      1 minute output rate 449 pkts/sec,  225330 bytes/sec
      1 minute drop rate, 17 pkts/sec
      5 minute input rate 516 pkts/sec,  530941 bytes/sec
      5 minute output rate 425 pkts/sec,  226324 bytes/sec
      5 minute drop rate, 15 pkts/sec
Interface Ethernet0/0 "", is up, line protocol is up
  Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
        Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
        Input flow control is unsupported, output flow control is unsupported
        Available but not configured via nameif
        MAC address c84c.7561.2501, MTU not set
        IP address unassigned
        983060731 packets input, 992444474940 bytes, 0 no buffer
        Received 11 broadcasts, 0 runts, 0 giants
        2 input errors, 1 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 L2 decode drops
        1330437 switch ingress policy drops
        832669170 packets output, 352310490094 bytes, 0 underruns
        0 pause output, 0 resume output
        0 output errors, 0 collisions, 0 interface resets
        0 late collisions, 0 deferred
        0 input reset drops, 0 output reset drops
        0 rate limit drops
        0 switch egress policy drops
Interface Ethernet0/1 "", is down, line protocol is down
  Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
        Auto-Duplex, Auto-Speed
        Input flow control is unsupported, output flow control is unsupported
        Available but not configured via nameif
        MAC address c84c.7561.2502, MTU not set
        IP address unassigned
        0 packets input, 0 bytes, 0 no buffer
        Received 0 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 L2 decode drops
        0 switch ingress policy drops
        0 packets output, 0 bytes, 0 underruns
        0 pause output, 0 resume output
        0 output errors, 0 collisions, 0 interface resets
        0 late collisions, 0 deferred
        0 input reset drops, 0 output reset drops
        0 rate limit drops
        0 switch egress policy drops
Interface Ethernet0/2 "", is up, line protocol is up
  Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
        Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
        Input flow control is unsupported, output flow control is unsupported
        Available but not configured via nameif
        MAC address c84c.7561.2503, MTU not set
        IP address unassigned
        918970464 packets input, 373128011969 bytes, 0 no buffer
        Received 48511413 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 L2 decode drops
        18539411 switch ingress policy drops
        978672288 packets output, 991975125448 bytes, 0 underruns
        0 pause output, 0 resume output
        0 output errors, 0 collisions, 0 interface resets
        0 late collisions, 0 deferred
        0 input reset drops, 0 output reset drops
        0 rate limit drops
        0 switch egress policy drops
Interface Ethernet0/3 "", is down, line protocol is down
  Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
        Auto-Duplex, Auto-Speed
        Input flow control is unsupported, output flow control is unsupported
        Available but not configured via nameif
        MAC address c84c.7561.2504, MTU not set
        IP address unassigned
        0 packets input, 0 bytes, 0 no buffer
        Received 0 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 L2 decode drops
        0 switch ingress policy drops
<--- More --->
0
Comment
Question by:Aeroquinn
  • 4
  • 2
6 Comments
 
LVL 17

Accepted Solution

by:
StrifeJester earned 500 total points
ID: 34242378
Usually a packet is dropped if there is no response from the other side.  Something like making web requests or telnet requests to an address that doesn't exist.  Technically the interface isn't dropping them because it is sending them to the Vlan for further routing.  Have you recently moved anything around?  Is there a monitoring service that is looking for something doesn't exist.  I am also pretty sure an ACL will trigger a dropped packet but its been a while since I have looked at some those.  If you can post the entire config masking your sensitive data we can look at more closely.
0
 

Author Comment

by:Aeroquinn
ID: 34242418
So, this has nothing to with interface configurations? I know most of the time I will see CRC or interface errors.
0
 
LVL 17

Expert Comment

by:StrifeJester
ID: 34242607
Yup if there are no CRCs it usually just means you have something that is broadcasting or hammering an IP that is not answering anymore.  The VLAN is dropping it instead of flooding all of the other machines on that VLAN.  You could crank up debugging and see if it shows you where the packets are coming from you should be able to see every drop if you crank it high enough but fair warning turning debugging up too high can crash the system.  There is sometimes too much output for it to parse.  If you think it may be an ACL you can add log to the end of the ACL line and that will log it for you to see how many are being hit.  I had this happen on my home router,  my ISP called me and said I was pinging the crap out of something.  I installed and ACL allow rule for ICMP with log and found it was actually my AV software pinging all the update servers, poorly written software caused me hours of headaches hope this help save you some.  Odds are though like I said because it is in the VLAN not the interfaces you are fine.  Offer still stands to go over it though if you like.
0
The problems with reply email signatures

Do you wish that you could place an email signature under a reply? Well, unfortunately, you can't. That great Exchange/Office 365 signature you've created will just appear at the bottom of an email chain. What a pain! Is there really no way to solve this? Well, there might be...

 
LVL 17

Expert Comment

by:StrifeJester
ID: 34242685
Also I did the math:

0.0061627086140586425011819569372717

Thats if it was only dropping input packets on your "outside".  .6% of all packets coming in are dropped thats not a bad number for an outside interface.

Your inside is about 2% doing it the same way, input packets only, without the whole config its hard to know exactly where it is but with that number of packets I wouldn't be concerned unless you are seeing issues with connectivity or performance.
0
 

Author Comment

by:Aeroquinn
ID: 34242699
Thanks for your input.
0
 
LVL 17

Expert Comment

by:StrifeJester
ID: 34242714
No problem, one quick follow up I just ran the same thing on my PIX and we are very similar on the numbers here are mine from a PIX in production.


Traffic Statistics for "external":
        300668882 packets input, 229126775724 bytes
        271074084 packets output, 66678062622 bytes
        6304378 packets dropped
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
Following basic email etiquette rules will help you write a professional email and achieve a good, lasting impression with your contacts.
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now