Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA 5520 packet drops due overrun at DMZ Interface

Hi guys,

 

i am facing the issue that a high amount of packets drop occour at the dmz interface of my ASA and result in a poor performace.
I think its due to overload this interface but i am not sure. I think these are caused by FIFO drops.  Maybe you could have a look and give me some hints.

A http webserver is behind the dmz interface and his one and only to-do is to deliver large downloads to a mobile device application.
 

Used:

ASA5520 with Software Version 9.1(2)

Interface:

Interface GigabitEthernet1/1 "dmz", is up, line protocol is up

  Hardware is VCS7380 rev01, BW 1000 Mbps, DLY 10 usec

            Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps)

            Input flow control is unsupported, output flow control is off

            Media-type configured as RJ45 connector

            MAC address e05f.b904.442f, MTU 1500

            IP address 194.XXX.XXX.XXX, subnet mask 255.255.255.248

            700818945 packets input, 533657238216 bytes, 0 no buffer

            Received 86031 broadcasts, 0 runts, 0 giants

            44542 input errors, 503 CRC, 0 frame, 44039 overrun, 0 ignored, 0 abort

            0 pause input, 0 resume input

            1 L2 decode drops

            633286935 packets output, 329190807035 bytes, 0 underruns

            0 pause output, 0 resume output

            0 output errors, 0 collisions, 0 interface resets

            0 late collisions, 0 deferred

            0 rate limit drops

            0 input reset drops, 0 output reset drops

            input queue (blocks free curr/low): hardware (0/0)   RX and TX are rings full???

            output queue (blocks free curr/low): hardware (0/0)

  Traffic Statistics for "dmz":

            694978423 packets input, 520532256773 bytes

            633334954 packets output, 317560628598 bytes

            1123842 packets dropped

      1 minute input rate 36 pkts/sec,  11542 bytes/sec

      1 minute output rate 40 pkts/sec,  20800 bytes/sec

      1 minute drop rate, 0 pkts/sec

      5 minute input rate 50 pkts/sec,  22335 bytes/sec

      5 minute output rate 55 pkts/sec,  33085 bytes/sec

      5 minute drop rate, 0 pkts/sec

---> The CRC Errors are solved by changing the wires. No Layer 2 issues anymore.

 

GigabitEthernet1/1:

            received (in 14459.120 secs):

                        1455190 packets     1357176600 bytes

                        100 pkts/sec 93268 bytes/sec

            transmitted (in 14459.120 secs):

                        1205554 packets     530192157 bytes

                        83 pkts/sec    36074 bytes/sec

      1 minute input rate 46 pkts/sec,  17419 bytes/sec

      1 minute output rate 55 pkts/sec,  30982 bytes/sec

      1 minute drop rate, 0 pkts/sec

      5 minute input rate 45 pkts/sec,  16497 bytes/sec

      5 minute output rate 52 pkts/sec,  27821 bytes/sec

      5 minute drop rate, 0 pkts/sec

 

---> Average packet size 100 / 93268 = 933 byte/packet

--> One minute average = 17419 / 46 = 379 byte/packet

 

 

Show blocks:

SIZE    MAX    LOW    CNT

     0    700    654    700

     4    300    299    299

    80   1155   1093   1154

   256   3636   3403   3628

  1550   9801   9264   9542

  2048   3100   3054   3100

  2560   2052   2051   2052

  4096    100     98    100

  8192    100     98    100

 16384    154    152    154

 65536     16     14     16

 

Show blocks interface:

 Memory Pool  SIZE  LIMIT/MAX     LOW     CNT  GLB:HELD     GLB:TOTAL

       DMA    2048        512       0     235         0         57096

 Memory Pool  SIZE  LIMIT/MAX     LOW     CNT  GLB:HELD     GLB:TOTAL

       DMA    1550       2560    1170    1537         0             0

 

Show conn count:

5791 in use, 10474 most used

 

Show resource usage:

Resource                 Current        Peak      Limit        Denied Context

Telnet                         0           2          5             0 System

SSH                            0           1          5             0 System

ASDM                           1           3         30             0 System

Syslogs [rate]               178        2493        N/A             0 System

Conns                       6142       10474     280000             0 System

Xlates                        38          51        N/A             0 System

Hosts                       4935        9566        N/A             0 System

Conns [rate]                 110        1405        N/A             0 System

Inspects [rate]                5         969        N/A             0 System

Routes                       119         150  unlimited             0 System

 

Show cpu

CPU utilization for 5 seconds = 12%; 1 minute: 16%; 5 minutes: 17%

Show perfmon

PERFMON STATS:                     Current      Average

Xlates                                0/s          0/s

Connections                          80/s          0/s

TCP Conns                            31/s          0/s

UDP Conns                            41/s          0/s

URL Access                            0/s          0/s

URL Server Req                        0/s          0/s

TCP Fixup                             0/s          0/s

TCP Intercept Established Conns       0/s          0/s

TCP Intercept Attempts                0/s          0/s

TCP Embryonic Conns Timeout           0/s          0/s

HTTP Fixup                            0/s          0/s

FTP Fixup                             0/s          0/s

AAA Authen                            0/s          0/s

AAA Author                            0/s          0/s

AAA Account                           0/s          0/s

VALID CONNS RATE in TCP INTERCEPT:    Current      Average

                                       N/A         707875.00%

I think the percentage is a cosmetic error!

 

Within the ASA logs i see a lot of FIN TIMEOUTS. Source my mobile device on port 50973 --> Destination the Webserver on Port 80.
Could i handle this issue by enabling flowcontrol? Which watermark values i should use? Or is the ASA with its specs not performant enough to process the traffic that occurs?

 

It would be nice if you could share your ideas.

Everyone's tags (1)
270
Views
0
Helpful
0
Replies
CreatePlease login to create content