Link to home
Start Free TrialLog in
Avatar of TacomaVA
TacomaVA

asked on

Cisco ASA 5505 - Maximum Bandwidth Usage

Hi,

Managing a Cisco ASA 5505 connected to a DSL modem (10MB upload and about 850kbps download).  Total of about 10 users plus three servers.

On Friday, all 10 users were in the office and the DSL connection was functioning as it should.  Round trip ping times were where they should be and overall, the speed was good.

Today, there is latency when pinging outside hosts and the connection is slow.  The ASDM is showing that the output value for the outside connection is between 850kbps and 900kbps continuous (going on 3+ hours now).  Therefore it appears that I am maxing out the upload portion of my DSL connection.  There are nine users in the office today and to my knowledge none of them are uploading any files that would take 3+ hours.

What could explain the drastic change from Friday to Monday?

Thanks
ASKER CERTIFIED SOLUTION
Avatar of rauenpc
rauenpc
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of TacomaVA
TacomaVA

ASKER

Thanks rauenpc, I'll shutdown the devices this evening and see what happens.

One thing I have noticed is that the output bit rate on the outside interface has varied quite a bit today.  For example, during one 60 second window, the bit rate was 679, 129, 15, 58, 10, 513.  Then a bit later on, during another 60 second window, the bit rate was 867, 870,  860, 875, 706, 652.  Does that mean anything that it is so varied?

Thanks
um... maybe. There are many reasons that it could be varied. This ranges from business as usual to malicious threats. The only good way to determine how normal traffic goes for your office would be to monitor traffic over a period of time so you can see historical data.
Hi rauenpc.  I stopped by the office this evening (15min after close) after everyone had left and I checked the output Kbps for the outside interface.  It was running between 0 and 45 Kbps.  A few of the users had shut their machines down, so I started those machines and verified that all Ethernet equipped devices were powered on.  The outside interface was still showing between 0 and 45 Kbps.

On two machines, I ran a few updates just to put some traffic on the network and when I did, the output for the outside interface increased briefly (~175Kbps), but then went back to between 0 and 45Kbps.
Perhaps this is a sporadic occurrence of high bandwidth utilization, or it could be time-of-day related. You're in a situation that's great when you have fancy data collectors that can show you bandwidth utilization in a historical manner, but unfortunate when you can only take a guess and check approach which can be very fast or tediously slow. Perhaps give shutting machines down a try during times of congestion.
Hi,

What I usually do if there is no monitoring software available to help is that I check the NAT translations and check for weird behaviour. For example hosts running a lot of connections on really high port numbers which in my network can show tendencies of peer to peer traffic.

Command: show xlate

For your servers you can use Performance Monitor (if you run Windows Server) in order to see if there is any unusual behaviour.
Though, for a file server for example this might not give you any clues of course.
Thanks MarcusSjogren and rauenpc.  Today, my output for the outside interface is 800Kbps to 850Kbps.  It's a 10MB download and 868Kbps upload DSL connection.  However, if I run a broadband speed test, I don't get anywhere near those speeds (3.56MB and 500Kbps or so).

At this moment, I have 7 of 10 users using individual FirePass or Cisco VPN clients.  Could seven outbound VPN clients eat up 800Kbps of bandwidth?

Thanks
Sure, just depends on what they are doing. Idle VPN connections will not eat up that much, but the users could be doing all sorts of things. Again, this is a tough troubleshooting spot when there is no monitoring in place such as netflow.

Also, when doing the speed test you will only get the 10m/868k when no one else is using the link. If half of the link of chewed up by others, the speed test will only have the remaining half of the link to test with so your speed results would be about half of your max.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thank you to both of you for your help.  I was able to troubleshoot this issue yesterday evening.

I pulled the send/receive data for each port on the switch and found a port that was sending an excessive amount of data.  That particular user is using a MacBook Pro with Outlook 2011.  This AM I noticed that the bandwidth issues began shortly after this particular user powered on his laptop and began working in Outlook.

After a bit of Google searching, I found out that there is a syncing problem with Outlook for Mac 2011.  I looked at the user's Outlook and found the deleted items folder was trying to upload 275 messages to the Exchange server, but was unable to.  For whatever reason, when Outlook for Mac 2011 was attempting to upload the messages, it consumed the entire upload bandwidth.  Once I fixed the upload issue in Outlook, the upload bandwidth returned to normal levels.

Here are two links for information on this issue:
http://answers.microsoft.com/en-us/mac/forum/macoffice2011-macoutlook/outlook-2011-high-network-bandwidth-useage-after/a92ff1c9-7126-454a-8f7e-f49074094a41

http://community.office365.com/en-us/forums/158/t/59104.aspx
There you go! Good job!

Outlook for MAC is and has always been very shaky so I'm not surprised  at all.

Marcus