Solved

ASA5505 Poor Performance

Posted on 2011-03-22
6
1,066 Views
Last Modified: 2012-05-11
Hello there,

We have a Cisco ASA5505 configured at a clients site and it has been SLOW since configuring port forwarding after install.  Here is the configuration, see anything that could be causing this?  There is constantly 732kbps of outgoing WAN traffic that should not be there.

the 22.34.27.22 adress represents our single external IP  (changed for security purposes)
the 192.168.1.232 address is our internal mail/HTTPS server (needs ports 25,4125,443 forwarded)

: Saved
:
ASA Version 8.2(1) 
!
hostname CISCOASA
domain-name company.com
enable password f6YsckNYzxWEjFBV encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 22.34.27.22 255.255.255.252 
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
 domain-name company.com
object-group service DM_INLINE_TCP_0 tcp
 port-object eq https
 port-object eq imap4
 port-object eq pop3
 port-object eq pptp
 port-object eq smtp
object-group service rtp tcp
 port-object eq 4125
access-list outside_access_in extended permit tcp host 192.168.1.232 any object-group DM_INLINE_TCP_0 
access-list outside_access_in extended permit tcp any interface outside eq smtp 
access-list outside_access_in extended permit tcp any interface outside eq https 
access-list outside_access_in extended permit tcp any interface outside object-group rtp 
access-list outside_access_in2 extended permit tcp any interface outside eq pop3 
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface smtp 192.168.1.232 smtp netmask 255.255.255.255 
static (inside,outside) tcp interface https 192.168.1.232 https netmask 255.255.255.255 
static (inside,outside) tcp interface 4125 192.168.1.232 4125 netmask 255.255.255.255 
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 22.34.27.21 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable 444
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.5-192.168.1.36 inside
!

threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
webvpn
!
!
prompt hostname context 
Cryptochecksum:7e7d4d08582f9cc7cdd620eb41ffea82
: end

Open in new window

0
Comment
Question by:PCFix1011
  • 5
6 Comments
 

Author Comment

by:PCFix1011
ID: 35195511
I've noticed that when looking at the traffic usage, there is about 700kbps unaccounted for......  That is, when you add up the "current bytes per second" usage between all protocols, there is a 700kbps discrepancy.  Very strange.
0
 

Author Comment

by:PCFix1011
ID: 35195593
It looks like it may be wild SMTP activity....
0
 
LVL 6

Expert Comment

by:kuoh
ID: 35195650
You should check that the mail server isn't an open relay and that there are no infected PCs on your network sending out spam.  You can start with an ACL that blocks all outbound SMTP traffic except those from the mail server.

KuoH
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 

Author Comment

by:PCFix1011
ID: 35195855
When I disable the SMTP service on the server (SBS03) the traffic stops.  When enabled, it will be fine for a while, and then traffic will jump to the 700kbps range.  The strange thing is when I look at the "current sessions" and the mail queues, there is no activity.  I am beginning to wonder if there is a problem with the SMTP service on the server.
0
 

Accepted Solution

by:
PCFix1011 earned 0 total points
ID: 35196507
As it turns out, the SMTP Virtual Server and SMTP Connector were completely corrupted and malfunctioning.  I disabled the virtual server and created a new one, and deleted the SMTP connector, and re-created, and everything is working properly.

I figured out the corruption problem by using Wireshark to sniff the packets from the SBS03 server.  There were tons of fragmented packets with bad checksum going to various yahoo email servers.  Just about 700kbps of traffic....
0
 

Author Closing Comment

by:PCFix1011
ID: 35225550
CLUSTER FUCK
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Clarification about access via WAN 6 36
Guest Wi-Fi Time out 3 28
Cisco ASA VPN Client Routing 8 43
Palo Alto site-to-site vpn monitoring 5 22
Shadow IT is coming out of the shadows as more businesses are choosing cloud-based applications. It is now a multi-cloud world for most organizations. Simultaneously, most businesses have yet to consolidate with one cloud provider or define an offic…
This past year has been one of great growth and performance for OnPage. We have added many features and integrations to the product, making 2016 an awesome year. We see these steps forward as the basis for future growth.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question