Solved

Cisco ASA 5510 Slow Throughput

Posted on 2011-03-02
7
7,226 Views
Last Modified: 2012-05-11
I have a Cisco ASA 5510 that I'm having throughput problems with.  I can't seem to get more than about 13MBps throughput from the inside <-> outside or inside <-> dmz (I have not tried dmz <-> outside.)  All interfaces are hard coded to speed 100 / duplex full; the devices on either side of the firewall are Cisco devices (a 3550 that is our Internet router) with a hard coded 100 / full applied to the interface facing the firewall, and on the inside I have a 3560 with a hard coded 100 / full applied to the interface facing the firewall.  Neither the 3550 or the 3560 are showing errors on the interfaces facing the firewall.  In short - I don't think this is a speed/duplex issue.

I have replaced the wiring to no avail.  I am running the latest switch IOS on both the 3560 and the 3550, and 8.2(4) on the ASA.  All devices have been rebooted (and we've had this issue for a while, but now that I have a 75MBps circuit to the 3550, I'd like to get more than 13MBps through the firewall.)  The speed is being tested with speedtest.net as well as a speed testing system provided by the ISP; if I plug a laptop into another port on the 3550 and configure it correctly, I get a speed rating of about 70MBps.

The firewall is on a VLAN that has only it and the interface on the 3560 switch.  I believe this is a variation of the recommended method of connecting the firewall to the network (rather than having it on a network with other devices.)

Let me be clear - it works - it's just very slow in comparison to what I expect.

0
Comment
Question by:gnurph
  • 4
  • 2
7 Comments
 
LVL 9

Expert Comment

by:gavving
ID: 35023377
Lets try this test.

Login into the ASDM and watch the bandwidth usage graph.

Find a place where you can download a very large file.  Windows AIK is a good choice.  it's 1.7GB.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=696dd665-9f76-4177-a811-39c26d3b3b34&displaylang=en

Start that download.

Now do the same thing on 5 other computers, or as many as you can.

What does the bandwidth usage graph show?  Due to alot of things, your not likely to see transfers at 75mbit just because you have 75mbit.  Now if you start alot of file transfers running at the same time, you're more likely to see alot of bandwidth usage....

0
 

Author Comment

by:gnurph
ID: 35023395
The speed test was conducted via http://www.speedtest.net and http://speedtest.alliedtelecom.net - as I noted, both gave about the same results inside the firewall and outside the firewall -

about 13Mbps inside
about 70Mbps outside

Having multiple machines doing downloads won't impact that - their sum total will be about 13Mbps.  If I can get 70Mbps outside with a single machine, I certainly should get something close to that inside with a single machine.
0
 
LVL 24

Assisted Solution

by:rfc1180
rfc1180 earned 250 total points
ID: 35023456
> Neither the 3550 or the 3560 are showing errors on the interfaces facing the firewall.  In short - I don't think this is a speed/duplex issue.

What about on the ASA interfaces?

> if I plug a laptop into another port on the 3550 and configure it correctly, I get a speed rating of about 70MBps

That is a good test, eliminates the ISP and the 3550 (possibly, maybe a hardware issue on the port, maybe something related to the ASIC, buffers, etc).

what happens when you connect a laptop directly to the interface on the ASA, same thing?
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 9

Assisted Solution

by:gavving
gavving earned 250 total points
ID: 35023463
I missed that bit of information in the original post, sorry about that.  

I can get 75mbit on our 5510s through our Internet connection, so I know it can do it.  Ours is configured in much the same way.  Going through layer-3 3560s with the ASA on it's own vlan.  I know you mentioned that you checked the ports for errors on the switches connected to the ASA, but did you check the ASA interfaces for errors?  Does the 'show int' output show errors?  Also what is your CPU usage that you normally see on the ASA?  When you do the speed test is the CPU usage effected?  You can monitor that with ASDM as well, or 'show cpu usage'.
0
 

Accepted Solution

by:
gnurph earned 0 total points
ID: 35023548
Problem solved.  For reference, this ASA was also serving as a Cisco phone proxy; the telephony vendor had placed a 9Mbps policy limit on bandwidth to try and ensure that the telephone connections didn't get dropped due to high bandwidth utilization - the ASA was originally on a 10Mbps circuit.

Thanks, guys - I'll split the points on general principles.
0
 

Author Comment

by:gnurph
ID: 35023550
Problem solved.  For reference, this ASA was also serving as a Cisco phone proxy; the telephony vendor had placed a 9Mbps policy limit on bandwidth to try and ensure that the telephone connections didn't get dropped due to high bandwidth utilization - the ASA was originally on a 10Mbps circuit.

Thanks, guys - I'll split the points on general principles.
0
 

Author Closing Comment

by:gnurph
ID: 35067791
Problem solved by beating my head against the wall after I remembered what the phone vendor did.
0

Featured Post

Live: Real-Time Solutions, Start Here

Receive instant 1:1 support from technology experts, using our real-time conversation and whiteboard interface. Your first 5 minutes are always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Hello to you all, I hear of many people congratulate AWS (Amazon Web Services) on how easy it is to spin up and create new EC2 (Elastic Compute Cloud) instances, but then fail and struggle to connect to them using simple tools such as SSH (Secure…
Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now