Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Diagnosing CPU intensive FWSM context

Hello all.

I have a FWSM version 2.2(1) running in transparent mode which is housed in a 6509 with sup720.

There are 7 security contexts defined in the FWSM. One of the contexts houses a fairly busy Internet facing FTP cluster and DNS cluster. This is consistently using 65% CPU and 70Mb memory. Other contexts are using around 1-2% CPU and a couple of Mb of memory.

While other contexts have more traffic passing through them the cpu intensive context maintains a much higher number of concurrent TCP and UDP connections - around 38k TCP and 20k UDP.

I think that the connection timeouts are not optimally configured which is making the problem worse. They are still on their defaults for all contexts, which are:

Connection: 01:00:00

H.225: 01:00:00

H.323: 00:05:00

SIP: 00:30:00

SIP Media: 00:02:00

MGCP: 00:05:00

Authorization absolute: 00:05:00

Authorization inactivity <= DISABLED

Half-closed: 10:00

UDP: 00:02:00

RPC: 00:10:00

Translation slot: 03:00:00

It strikes me that a 1 hour connection timeout is excessive - however I know that others use FWSM with busy networks and don't encounter an issue with the default timeouts.

Has anyone else changed the default FWSM timeouts and encountered reduced CPU useage?

Any suggestions of how I can diagnose the CPU useage and/or optimise the connection timeouts?

Many thanks in advance for any replies!!


Re: Diagnosing CPU intensive FWSM context

To set the maximum idle time duration, use the timeout command. TCP connection slots are freed approximately 60 seconds after a normal connection close sequence. Refer URL for more information on timeout values