CSC Throughput

brobinson · ‎03-30-2010

Heya!

We have a ASA 5510 with CSC-10 and are having performance issues when activated. I am diverting as little traffic as possible to it and have FTP filtering off. I know it depends on what policies you have in place, but does anyone have any idea of the throughput capabilities of the CSC-10 and CSC-20? Thanks!

Ben

Panos Kampanakis · ‎03-31-2010

They should be able to do more than 200Mbps, to 400Mbps.

But it also depends on connection rates and users.

Check if you have debug logs enabled, those tend to increase the CPU.

If it is a load issue you should see memory and/or CPU increased for the module in ASDM.

I hope it helps.

PK

brobinson · ‎03-31-2010

We are purchasing additional RAM for our ASA 5510 from the default since our memory usage is at about 70%. We have a 75 Mb pipe to the internet and about 400 users internally. I have the inspect set to only inspect outgoing internet based SMTP and WWW on the inside interface, but even when there are only 100 users active, browsing the internet is a noticeable difference (slower) with the CSC on.

Panos Kampanakis · ‎03-31-2010

Make sure you

- have CSC debugs disabled

- you are not scanning the CSC itself when it is going out

- you have deferred scanning enabled.

Check CPU and memory of CSC to see if this is due to oversubscription.

100 users it should be able to handle.

PK

brobinson · ‎03-31-2010

Thanks! all three of what you suggested are true (except the last b/c HTTP scanning is not enabled) so if it is oversubscription, is there a way to free up resources or does it do that automatically and we just need to get a bigger CSC? we have everything pretty much disabled right now except for URL filtering and SMTP inspection. Thanks!