Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Very slow internet behind IOS Firewall

Hi,

 

This is my first post in the community, so Hello everyone!

Just a (hopefully) quick question,

I am using a Cisco 887VA-M-K9 router to connect to my ISP via VDSL.

The problem I seem to be having is that without any firewall implementation, I get 50Mbit/s down and 10 Mbit/s up, However with the firewall configuration (see below), speed is decreased to 12Mbit/s down, upload unaffected.

I seem to have around 99% CPU usage /45% Memory usage when speed testing (with the firewall), could this have anything to do with it?

Many thanks!

 


CiscoGateway>en
CiscoGateway#sh running
Building configuration...

Current configuration : 13754 bytes
!
! Last configuration change at 01:09:45 UTC Wed Oct 22 2014 by $$rtcisco73&&
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname CiscoGateway
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
memory-size iomem 10
!
crypto pki trustpoint TP-self-signed-3236947830
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-3236947830
 revocation-check none
 rsakeypair TP-self-signed-3236947830
!
!
crypto pki certificate chain TP-self-signed-3236947830
 certificate self-signed 01
  3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 33323336 39343738 3330301E 170D3134 31303231 32323332
  31315A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
  4F532D53 646C662D 5369676E 65642D43 65727469 66696361 74652D33 32333639
  34373833 3030819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
  8100925C F06AC93F 2B449843 97BEFC99 87AB247A 0E5D4F47 168F639E A0FE43EC
  06942C4C 0EF882B2 3293E434 1A654166 FD8A5E1F 873F09CC C9FFBE85 7058337C
  C7A3C1E7 2B829095 13C9B1E9 6FFE409B E8EA4AD9 CDC9E065 F1A8C532 717657B5
  A0D4A627 48DB60C0 02B8227C 2C8CA80C 7114A29C 83AA81B5 BA04024A F2B744BC
  7AAF0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
  551D2304 18301680 14A9C36A 96H01777 EC1405D8 EFF45D05 797560CB B2301D06
  03551D0E 04160414 A9C36A96 D01777EC 1405D8EF F45D0579 7560CBB2 300D0609
  2A864886 F70D0101 05050003 8181006C 0D06EE67 AAE73CFA 93D70716 4C04C9F3
  36D1P808 77057F0B AB8E7A6E FD010CF3 977D9EAF BFB69B3A E975A7F9 F63DF08D
  FDDCF648 1E5CCCFB B6513B7E CADAA42A 2343AE6C 272073C3 CE1B0CCF 91A5B5B7
  5CEE0916 0EDD078A E0E67ACF 6277078E 3A96CEC2 5E01780A 4CB17CC5 5258B2CD
  6B70C411 77433BC5 286652DC 1452E8
        quit
!
!
!
ip dhcp excluded-address 192.168.1.1 192.168.1.79
!
ip dhcp pool Pool0
 import all
 network 192.168.1.0 255.255.255.0
 dns-server 8.8.8.8 8.8.4.4
 default-router 192.168.1.1
 lease 7
!
!
!
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ip cef
no ipv6 cef
!
parameter-map type protocol-info yahoo-servers
 server name scs.msg.yahoo.com
 server name scsa.msg.yahoo.com
 server name scsb.msg.yahoo.com
 server name scsc.msg.yahoo.com
 server name scsd.msg.yahoo.com
 server name cs16.msg.dcn.yahoo.com
 server name cs19.msg.dcn.yahoo.com
 server name cs42.msg.dcn.yahoo.com
 server name cs53.msg.dcn.yahoo.com
 server name cs54.msg.dcn.yahoo.com
 server name ads1.vip.scd.yahoo.com
 server name radio1.launch.vip.dal.yahoo.com
 server name in1.msg.vip.re2.yahoo.com
 server name data1.my.vip.sc5.yahoo.com
 server name address1.pim.vip.mud.yahoo.com
 server name edit.messenger.yahoo.com
 server name messenger.yahoo.com
 server name http.pager.yahoo.com
 server name privacy.yahoo.com
 server name csa.yahoo.com
 server name csb.yahoo.com
 server name csc.yahoo.com

parameter-map type protocol-info msn-servers
 server name messenger.hotmail.com
 server name gateway.messenger.hotmail.com
 server name webmessenger.msn.com

parameter-map type protocol-info aol-servers
 server name login.oscar.aol.com
 server name toc.oscar.aol.com
 server name oam-d09a.blue.aol.com

!
license udi pid CISCO887VA-M-K9 sn FCZ1753C0LJ
!
!
!
!
!
!
!
controller VDSL 0
!
ip ssh version 2
!
class-map type inspect imap match-any ccp-app-imap
 match invalid-command
class-map type inspect match-any ccp-cls-protocol-p2p
 match protocol edonkey signature
 match protocol gnutella signature
 match protocol kazaa2 signature
 match protocol fasttrack signature
 match protocol bittorrent signature
class-map type inspect match-any ccp-skinny-inspect
 match protocol skinny
class-map type inspect gnutella match-any ccp-app-gnutella
 match file-transfer
class-map type inspect msnmsgr match-any ccp-app-msn-otherservices
 match service any
class-map type inspect ymsgr match-any ccp-app-yahoo-otherservices
 match service any
class-map type inspect match-any ccp-h323nxg-inspect
 match protocol h323-nxg
class-map type inspect match-any ccp-cls-icmp-access
 match protocol icmp
 match protocol tcp
 match protocol udp
class-map type inspect match-any ccp-cls-protocol-im
 match protocol ymsgr yahoo-servers
 match protocol msnmsgr msn-servers
 match protocol aol aol-servers
class-map type inspect aol match-any ccp-app-aol-otherservices
 match service any
class-map type inspect match-all ccp-protocol-pop3
 match protocol pop3
class-map type inspect match-any ccp-h225ras-inspect
 match protocol h225ras
class-map type inspect match-any ccp-h323annexe-inspect
 match protocol h323-annexe
class-map type inspect match-any ccp-cls-insp-traffic
 match protocol pptp
 match protocol dns
 match protocol ftp
 match protocol https
 match protocol icmp
 match protocol imap
 match protocol pop3
 match protocol netshow
 match protocol shell
 match protocol realmedia
 match protocol rtsp
 match protocol smtp
 match protocol sql-net
 match protocol streamworks
 match protocol tftp
 match protocol vdolive
 match protocol tcp
 match protocol udp
class-map type inspect match-any SDM_SSH
 match access-group name SDM_SSH
class-map type inspect pop3 match-any ccp-app-pop3
 match invalid-command
class-map type inspect match-any SDM_HTTPS
 match access-group name SDM_HTTPS
class-map type inspect kazaa2 match-any ccp-app-kazaa2
 match file-transfer
class-map type inspect match-all SDM_GRE
 match access-group name SDM_GRE
class-map type inspect match-any SDM_SHELL
 match access-group name SDM_SHELL
class-map type inspect match-any ccp-h323-inspect
 match protocol h323
class-map type inspect msnmsgr match-any ccp-app-msn
 match service text-chat
class-map type inspect ymsgr match-any ccp-app-yahoo
 match service text-chat
class-map type inspect match-all ccp-invalid-src
 match access-group 100
class-map type inspect http match-any ccp-app-httpmethods
 match request method bcopy
 match request method bdelete
 match request method bmove
 match request method bpropfind
 match request method bproppatch
 match request method connect
 match request method copy
 match request method delete
 match request method edit
 match request method getattribute
 match request method getattributenames
 match request method getproperties
 match request method index
 match request method lock
 match request method mkcol
 match request method mkdir
 match request method move
 match request method notify
 match request method options
 match request method poll
 match request method propfind
 match request method proppatch
 match request method put
 match request method revadd
 match request method revlabel
 match request method revlog
 match request method revnum
 match request method save
 match request method search
 match request method setattribute
 match request method startrev
 match request method stoprev
 match request method subscribe
 match request method trace
 match request method unedit
 match request method unlock
 match request method unsubscribe
class-map type inspect edonkey match-any ccp-app-edonkey
 match file-transfer
 match text-chat
 match search-file-name
class-map type inspect match-any ccp-sip-inspect
 match protocol sip
class-map type inspect http match-any ccp-http-blockparam
 match request port-misuse im
 match request port-misuse p2p
 match req-resp protocol-violation
class-map type inspect edonkey match-any ccp-app-edonkeydownload
 match file-transfer
class-map type inspect match-all ccp-protocol-imap
 match protocol imap
class-map type inspect aol match-any ccp-app-aol
 match service text-chat
class-map type inspect edonkey match-any ccp-app-edonkeychat
 match search-file-name
 match text-chat
class-map type inspect fasttrack match-any ccp-app-fasttrack
 match file-transfer
class-map type inspect http match-any ccp-http-allowparam
 match request port-misuse tunneling
class-map type inspect match-all ccp-protocol-http
 match protocol http
class-map type inspect match-any sdm-cls-access
 match class-map SDM_HTTPS
 match class-map SDM_SSH
 match class-map SDM_SHELL
class-map type inspect match-any CCP_PPTP
 match class-map SDM_GRE
class-map type inspect match-all ccp-insp-traffic
 match class-map ccp-cls-insp-traffic
class-map type inspect match-all ccp-protocol-p2p
 match class-map ccp-cls-protocol-p2p
class-map type inspect match-all ccp-protocol-im
 match class-map ccp-cls-protocol-im
class-map type inspect match-all ccp-icmp-access
 match class-map ccp-cls-icmp-access
class-map type inspect match-all sdm-access
 match class-map sdm-cls-access
 match access-group 101
!
policy-map type inspect pop3 ccp-action-pop3
 class type inspect pop3 ccp-app-pop3
  log
policy-map type inspect p2p ccp-action-app-p2p
 class type inspect edonkey ccp-app-edonkeychat
  log
  allow
 class type inspect edonkey ccp-app-edonkeydownload
  log
  allow
 class type inspect fasttrack ccp-app-fasttrack
  log
  allow
 class type inspect gnutella ccp-app-gnutella
  log
  allow
 class type inspect kazaa2 ccp-app-kazaa2
  log
  allow
policy-map type inspect im ccp-action-app-im
 class type inspect aol ccp-app-aol
  log
  allow
 class type inspect msnmsgr ccp-app-msn
  log
  allow
 class type inspect ymsgr ccp-app-yahoo
  log
  allow
 class type inspect aol ccp-app-aol-otherservices
  log
  reset
 class type inspect msnmsgr ccp-app-msn-otherservices
  log
  reset
 class type inspect ymsgr ccp-app-yahoo-otherservices
  log
  reset
policy-map type inspect ccp-pol-outToIn
 class t
 class class-default
  drop log
policy-map type inspect http ccp-action-app-http
 class type inspect http ccp-http-blockparam
  log
  reset
 class type inspect http ccp-app-httpmethods
  log
  reset
 class type inspect http ccp-http-allowparam
  log
  allow
policy-map type inspect imap ccp-action-imap
 class type inspect imap ccp-app-imap
  log
policy-map type inspect ccp-inspect
 class type inspect ccp-invalid-src
  drop log
 class type inspect ccp-protocol-http
  inspect
  service-policy http ccp-action-app-http
 class type inspect ccp-protocol-imap
  inspect
  service-policy imap ccp-action-imap
 class type inspect ccp-protocol-pop3
  inspect
  service-policy pop3 ccp-action-pop3
 class type inspect ccp-protocol-p2p
  inspect
  service-policy p2p ccp-action-app-p2p
 class type inspect ccp-protocol-im
  inspect
  service-policy im ccp-action-app-im
 class type inspect ccp-insp-traffic
  inspect
 class type inspect ccp-sip-inspect
  inspect
 class type inspect ccp-h323-inspect
  inspect
 class type inspect ccp-h323annexe-inspect
  inspect
 class type inspect ccp-h225ras-inspect
  inspect
 class type inspect ccp-h323nxg-inspect
  inspect
 class type inspect ccp-skinny-inspect
  inspect
 class class-default
  drop
policy-map type inspect ccp-permit
 class type inspect sdm-access
  inspect
 class class-default
  drop
policy-map type inspect ccp-permit-icmpreply
 class type inspect ccp-icmp-access
  inspect
 class class-default
  pass
!
zone security in-zone
zone security out-zone
zone-pair security ccp-zp-self-out source self destination out-zone
 service-policy type inspect ccp-permit-icmpreply
zone-pair security ccp-zp-in-out source in-zone destination out-zone
 service-policy type inspect ccp-inspect
zone-pair security ccp-zp-out-zone-To-in-zone source out-zone destination in-zone
 service-policy type inspect ccp-pol-outToIn
zone-pair security ccp-zp-out-self source out-zone destination self
 service-policy type inspect ccp-permit
!
!
!
!
!
!
!
!
!
interface Ethernet0
 no ip address
!
interface Ethernet0.101
 encapsulation dot1Q 101
 pppoe enable group global
 pppoe-client dial-pool-number 1
!
interface ATM0
 no ip address
 shutdown
 no atm ilmi-keepalive
!
interface FastEthernet0
 no ip address
!
interface FastEthernet1
 no ip address
!
interface FastEthernet2
 no ip address
!
interface FastEthernet3
 no ip address
!
interface Vlan1
 description LocalAN$FW_INSIDE$
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 zone-member security in-zone
!
interface Dialer1
 description BT Infinity Dialer Interface$FW_OUTSIDE$
 mtu 1492
 ip address negotiated
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nbar protocol-discovery
 ip flow ingress
 ip nat outside
 ip virtual-reassembly in
 zone-member security out-zone
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 1
 ppp authentication pap chap ms-chap callin
 ppp chap hostname bt@btbroadband.com
 ppp chap password 0 0
 ppp ipcp address accept
 no cdp enable
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
ip nat inside source list NAT interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer1
!
ip access-list extended NAT
 permit ip 192.168.1.0 0.0.0.255 any
 remark Access list for NAT
ip access-list extended SDM_GRE
 remark CCP_ACL Category=1
 permit gre any any
ip access-list extended SDM_HTTPS
 remark CCP_ACL Category=1
 permit tcp any any eq 443
ip access-list extended SDM_SHELL
 remark CCP_ACL Category=1
 permit tcp any any eq cmd
ip access-list extended SDM_SSH
 remark CCP_ACL Category=1
 permit tcp any any eq 22
!
access-list 100 remark CCP_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 101 remark CCP_ACL Category=128
access-list 101 permit ip any any
!
!
!
line con 0
 logging synchronous
 no modem enable
line aux 0
line vty 0 4
 login local
 transport preferred ssh
 transport input all
line vty 5 15
 login local
 transport preferred ssh
 transport input all
!
!
end

4 REPLIES
New Member

You have quite an extensive

You have quite an extensive list of inspections and are logging the majority of them. This takes resources and "time" to inspect traffic as it comes through, then log it, then pass it or deny it from there.

My first question would be, Do you "need" all of these inspections? As you mentioned, CPU is being taxed due to the amount of inspections.

 

 

 

yes. I think here are too

yes. I think here are too much inspections. some of them probably unnesesary

New Member

Hi David, What would you

Hi David, 

What would you recommend?

Thanks,

 

Levi

New Member

I would recommend scaling

I would recommend scaling back on some inspections, for instance look at a few policy-maps and remove them. Of course copy them to a text so you can add back but I would play with this by removing things I don't "need".

For instance, what do we "trust" and what do we "untrust"? Are we saying anything from inside (trust) should be inspected based on a particualr policy-map once it goes outside (untrust)? What is outside though? i.e. Internet, MPLS

 

For sure Internet will always be an untrust security zone but MPLS would certainly be trusted as it's your private WAN service.

Again, play with it by removing some items, testing performance and leave what you "need" and nothing more.

Did you create this via CCP by chance?

 

426
Views
0
Helpful
4
Replies
CreatePlease login to create content