I am attempting to cut over to an ASA 5520 from an old linux firewall. I have two other sites running the ASAs but I keep having problem after problem with this last site (mainly user error issues and I wouldn't be surprised if I end up at fault for this as well).
I cut over this evening and traffic is flowing, however, HTTP requests are very slow (oddly enough, except to cisco.com - I digress). Anyhow, any web page I attempt to view takes a very long time to load, but it does eventually load. When I say it takes a long time, it is taking more than a min to load a page (we have a 6 meg connection)
Background on network setup:
4 Data T1s bundled on a 3600 Series Router provide internet access.
Linux firewall replaced with ASA 5520
Internal LAN is a 6509 with several VLANs all routable to one another. The MSFC have a default route to the ASA. The ASA has a default route to the 3600 for outside traffic.
Upon shutting down the old Linux firewall I cleared the ARP tables on the 3600 to ensure it was talking to the ASA.
The interesting thing is that pings and trace routes all have decent response times, so I don't think there is actually a packet loss or latency issue, but HTTP requests take for ever.
I have several hosts on my lan that have static mappings for various services like DNS, Mail, etc. The rest of the traffic is going out a Global PAT rule as shown in the config attached.
The following message is scrolling through the logs repeatedly, but I cannot find anything that would be causing the issue and because its 0.0.0.0 I am not sure where to start trying to find the culprit.
Error in Log:
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
%ASA-2-106017: Deny IP due to Land Attack from 0.0.0.0 to 0.0.0.0
