• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 7975
  • Last Modified:

Cisco ASA 5510 Slow Throughput

I have a Cisco ASA 5510 that I'm having throughput problems with.  I can't seem to get more than about 13MBps throughput from the inside <-> outside or inside <-> dmz (I have not tried dmz <-> outside.)  All interfaces are hard coded to speed 100 / duplex full; the devices on either side of the firewall are Cisco devices (a 3550 that is our Internet router) with a hard coded 100 / full applied to the interface facing the firewall, and on the inside I have a 3560 with a hard coded 100 / full applied to the interface facing the firewall.  Neither the 3550 or the 3560 are showing errors on the interfaces facing the firewall.  In short - I don't think this is a speed/duplex issue.

I have replaced the wiring to no avail.  I am running the latest switch IOS on both the 3560 and the 3550, and 8.2(4) on the ASA.  All devices have been rebooted (and we've had this issue for a while, but now that I have a 75MBps circuit to the 3550, I'd like to get more than 13MBps through the firewall.)  The speed is being tested with speedtest.net as well as a speed testing system provided by the ISP; if I plug a laptop into another port on the 3550 and configure it correctly, I get a speed rating of about 70MBps.

The firewall is on a VLAN that has only it and the interface on the 3560 switch.  I believe this is a variation of the recommended method of connecting the firewall to the network (rather than having it on a network with other devices.)

Let me be clear - it works - it's just very slow in comparison to what I expect.

0
gnurph
Asked:
gnurph
  • 4
  • 2
3 Solutions
 
gavvingCommented:
Lets try this test.

Login into the ASDM and watch the bandwidth usage graph.

Find a place where you can download a very large file.  Windows AIK is a good choice.  it's 1.7GB.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=696dd665-9f76-4177-a811-39c26d3b3b34&displaylang=en

Start that download.

Now do the same thing on 5 other computers, or as many as you can.

What does the bandwidth usage graph show?  Due to alot of things, your not likely to see transfers at 75mbit just because you have 75mbit.  Now if you start alot of file transfers running at the same time, you're more likely to see alot of bandwidth usage....

0
 
gnurphAuthor Commented:
The speed test was conducted via http://www.speedtest.net and http://speedtest.alliedtelecom.net - as I noted, both gave about the same results inside the firewall and outside the firewall -

about 13Mbps inside
about 70Mbps outside

Having multiple machines doing downloads won't impact that - their sum total will be about 13Mbps.  If I can get 70Mbps outside with a single machine, I certainly should get something close to that inside with a single machine.
0
 
rfc1180Commented:
> Neither the 3550 or the 3560 are showing errors on the interfaces facing the firewall.  In short - I don't think this is a speed/duplex issue.

What about on the ASA interfaces?

> if I plug a laptop into another port on the 3550 and configure it correctly, I get a speed rating of about 70MBps

That is a good test, eliminates the ISP and the 3550 (possibly, maybe a hardware issue on the port, maybe something related to the ASIC, buffers, etc).

what happens when you connect a laptop directly to the interface on the ASA, same thing?
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
gavvingCommented:
I missed that bit of information in the original post, sorry about that.  

I can get 75mbit on our 5510s through our Internet connection, so I know it can do it.  Ours is configured in much the same way.  Going through layer-3 3560s with the ASA on it's own vlan.  I know you mentioned that you checked the ports for errors on the switches connected to the ASA, but did you check the ASA interfaces for errors?  Does the 'show int' output show errors?  Also what is your CPU usage that you normally see on the ASA?  When you do the speed test is the CPU usage effected?  You can monitor that with ASDM as well, or 'show cpu usage'.
0
 
gnurphAuthor Commented:
Problem solved.  For reference, this ASA was also serving as a Cisco phone proxy; the telephony vendor had placed a 9Mbps policy limit on bandwidth to try and ensure that the telephone connections didn't get dropped due to high bandwidth utilization - the ASA was originally on a 10Mbps circuit.

Thanks, guys - I'll split the points on general principles.
0
 
gnurphAuthor Commented:
Problem solved.  For reference, this ASA was also serving as a Cisco phone proxy; the telephony vendor had placed a 9Mbps policy limit on bandwidth to try and ensure that the telephone connections didn't get dropped due to high bandwidth utilization - the ASA was originally on a 10Mbps circuit.

Thanks, guys - I'll split the points on general principles.
0
 
gnurphAuthor Commented:
Problem solved by beating my head against the wall after I remembered what the phone vendor did.
0

Featured Post

Become a Leader in Data Analytics

Gain the power to turn raw data into better business decisions and outcomes in your industry. Transform your career future by earning your MS in Data Analytics. WGU’s MSDA program curriculum features IT certifications from Oracle and SAS.  

  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now