A few months ago we upgraded our PIX 515 from version 6.3(5) to version 7.2.1. we then suffered the consequences with a very heavily utilised CPU and packet loss.. the thing was idling around 50% cpu..
Anyway we have just recently replaced out PIX failover pair with a pair of ASA 5540 running version 7.2(2). Initially the replacement went fine and things seem to work ok. However we now seem to have the same problem we had before???!!! I would say total firewall throughput across all 12 physical and logical interfaces is less than 100Mbps , xlates and connections are low and all interfaces are good..
The ASA's initially seemed to be good and idle along most of the time at around 5% cpu however we have started so noticed a few issues with some of our VOIP (this goes inside a dmvpn tunnel that passes through the PIX)... so I enabled prioriry queues on the ASA
Looking into the VOIP problems it seems that the ASA CPU seems to spike at around 99% for maybe a second (long enough for voip) and then drops..... not sure why this is happening... the ASA 5540 are supposed to be able to handle 650Mbps...???
Could this be some sort of bug? If I show CPU hog on the ASA we get the following?
Process: Dispatch Unit, NUMHOG: 1406, MAXHOG: 9084, LASTHOG: 1010
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...