gnurph
asked on
Cisco ASA 5510 Slow Throughput
I have a Cisco ASA 5510 that I'm having throughput problems with. I can't seem to get more than about 13MBps throughput from the inside <-> outside or inside <-> dmz (I have not tried dmz <-> outside.) All interfaces are hard coded to speed 100 / duplex full; the devices on either side of the firewall are Cisco devices (a 3550 that is our Internet router) with a hard coded 100 / full applied to the interface facing the firewall, and on the inside I have a 3560 with a hard coded 100 / full applied to the interface facing the firewall. Neither the 3550 or the 3560 are showing errors on the interfaces facing the firewall. In short - I don't think this is a speed/duplex issue.
I have replaced the wiring to no avail. I am running the latest switch IOS on both the 3560 and the 3550, and 8.2(4) on the ASA. All devices have been rebooted (and we've had this issue for a while, but now that I have a 75MBps circuit to the 3550, I'd like to get more than 13MBps through the firewall.) The speed is being tested with speedtest.net as well as a speed testing system provided by the ISP; if I plug a laptop into another port on the 3550 and configure it correctly, I get a speed rating of about 70MBps.
The firewall is on a VLAN that has only it and the interface on the 3560 switch. I believe this is a variation of the recommended method of connecting the firewall to the network (rather than having it on a network with other devices.)
Let me be clear - it works - it's just very slow in comparison to what I expect.
I have replaced the wiring to no avail. I am running the latest switch IOS on both the 3560 and the 3550, and 8.2(4) on the ASA. All devices have been rebooted (and we've had this issue for a while, but now that I have a 75MBps circuit to the 3550, I'd like to get more than 13MBps through the firewall.) The speed is being tested with speedtest.net as well as a speed testing system provided by the ISP; if I plug a laptop into another port on the 3550 and configure it correctly, I get a speed rating of about 70MBps.
The firewall is on a VLAN that has only it and the interface on the 3560 switch. I believe this is a variation of the recommended method of connecting the firewall to the network (rather than having it on a network with other devices.)
Let me be clear - it works - it's just very slow in comparison to what I expect.
ASKER
The speed test was conducted via http://www.speedtest.net and http://speedtest.alliedtelecom.net - as I noted, both gave about the same results inside the firewall and outside the firewall -
about 13Mbps inside
about 70Mbps outside
Having multiple machines doing downloads won't impact that - their sum total will be about 13Mbps. If I can get 70Mbps outside with a single machine, I certainly should get something close to that inside with a single machine.
about 13Mbps inside
about 70Mbps outside
Having multiple machines doing downloads won't impact that - their sum total will be about 13Mbps. If I can get 70Mbps outside with a single machine, I certainly should get something close to that inside with a single machine.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Problem solved. For reference, this ASA was also serving as a Cisco phone proxy; the telephony vendor had placed a 9Mbps policy limit on bandwidth to try and ensure that the telephone connections didn't get dropped due to high bandwidth utilization - the ASA was originally on a 10Mbps circuit.
Thanks, guys - I'll split the points on general principles.
Thanks, guys - I'll split the points on general principles.
ASKER
Problem solved by beating my head against the wall after I remembered what the phone vendor did.
Login into the ASDM and watch the bandwidth usage graph.
Find a place where you can download a very large file. Windows AIK is a good choice. it's 1.7GB.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=696dd665-9f76-4177-a811-39c26d3b3b34&displaylang=en
Start that download.
Now do the same thing on 5 other computers, or as many as you can.
What does the bandwidth usage graph show? Due to alot of things, your not likely to see transfers at 75mbit just because you have 75mbit. Now if you start alot of file transfers running at the same time, you're more likely to see alot of bandwidth usage....