Cisco Firewall :: Slow SQLnet Throughput On ASA 5540?
Nov 14, 2011
I'm having a throughput problem with a new ASA 5540 running version 8.2 (1). When trying to access a database server using tcp port 1521 (sqlnet) it is about 10 to 20 times slower than when the database is not behind the firewall. We've been running the same software on a database behind an ASA 5520 running version 8.0 (3) with no problems for years. When I check the cpu usage on the 5540 at the ASDM home page, it is rarely above 20% and never above 30% while this is being tested. I tried testing ftp throughput over the same interface and it was normal with ~320 Mbps average rate transferring a 500 MB file.
I have two NAS drives directly connected to my router. I am accessing them through my XP laptop's wireless connection. I am trying to copy a large volume of data from one to the other (28Gb).The problem I have is throughput. I am barely getting 250Kb/s from one drive to the other.Is there a way to speed this up?
I recently setup our small office network using the following setup:
Cablemodem <--> router <--> 1231AP(role root bridge with wireless clients) <-> 1231AP(role non-root bridge with wireless clients)Code on both APs: 12.3(8)JEE.Office network generally has less than 3 wireless clients connected at any one time to either AP. AP's are a mere 50' apart; clients are all less than 30' from either AP; they all show excellent signal and connected at 54mbps signaling rates.
All is/has been working very well & very stable with the exception of speed. We have business class service from RR, approx 25mbps dl, 2mbps ul. Any hardwired client to the router switch ports are able to download at speeds averaging 23mbps. Any wireless client connected to either AP is never able to exceed download speeds of 5mbps. With no other wireless clients connected except my one test client, I was not able to exceed 5mbps throughput from either AP that I connected to.
I can confirm that the ethernet connection between the router and root bridge is up at 100mbps-FD and not showing any errors: [code]
Are these very slow thoughput speeds normal of this hardware combination?I did much searching/googling and found claims that by eliminating TKIP it almost doubles the actual wireless speeds our clients can obtain.
I am experiencing slow throughput on a L2L IPsec tunnel that we have between one of our offices on the west coast (WC) US and another on the east coast (EC) US. The tunnel endpoint on the WC resides on a 5510 and a 5545x on the EC. The DIA circuit speed on the WC is 45 Mbps and 200 Mbps on the EC. The throughput of this IPsec tunnel is maxing out at approx. 4 – 5 Mbps. The utilization of the DIA circuits at both offices is under 5% when running various FTP test transfers. Both devices have low memory and CPU utilization.
We have a 2nd office on the EC (45 Mbps DIA) which I built a tunnel on a 5510 with the WC office and it is experiencing the same slow throughput. In covering all my bases we have a colocation facility on the WC and in building a tunnel between the 2 WC offices I WAS seeing close to full line rate speeds over the tunnel. Additionally, I built a tunnel between the 2 EC offices and I saw full line rate speeds. With the physical distance between the WC & EC offices I would expect some loss in throughput speeds but I would not expect it to drop as low as 4 – 5 Mbps. In thinking something may be up with the 5510 in our WC office we shipped a 5505 to the WC office and we built the same IPsec tunnels on it and it is experiencing the same.
In working with our support vendor to try and solve the WC <-> EC throughput issue they had me change the MTU, TCP mss, DF-bit, types of encryption/hash on the IPsec tunnel but nothing has resolved it. We are not showing fragmentation or PMTU issues on the tunnel. In contacting the ISP of our WC office they mentioned that they do not have any type or rate limiting in place. Our WC ISP had a CCIE review our configurations but nothing was found.
We have had a shift in our work force and find a large number of uses now working from home. Lately (this weekend) they have been complaining about VPN client downloads being very slow. I have tested the IPSec client and the SSL client and compared them to an Internet download on the network using the exact same laptop and the exact same web site www.speednet.net. Here at the office I see 50M, over both VPN's I see (if I am lucky) 1M, all reading within a 15 minute period and all over the same 600M pipe to the Internet
We have never noticed this before this work force shift to home. Eliminating all other factors, which we think we have, would you expect VPN clients to behave this way?
MTU is set at default from day one. The only thing we have done to VPN configuration over the last week was to add a tunnel gateway to the ASA 5540 VPN configuration which is only a hop away from the firewall inside interface.
I will provide configuration data if you request but my question is just a general one at this point. Is this normal and can you make a suggestion as to how we can improve? We are research, running wireshark on the test laptop so as the day progresses we will have more information to provide if needed.
We've installed cisco devices accross our site in the last year or so and slowing getting on top of it now. How ever our old unmanaged kit seems to be out performing it. It's most like down to my misconfiguration which has lead me to here. Below is the details of hardware and configuration between devices. 3750 Core consisting of the following stacked. [code] I've got MRTG monitoring traffic and the throughput seems to max out 24m/s,
When transferring traffic between two VLANs my throughput rate seems to drop to about 1.5 - 3.0 megabits / second.
My setup is like this...
Two Nexus 5020 switches. (switch01 and switch02) Two Nexus 2232PP fabric extender switches. (switch03 and switch04) Two Dell R815s with Chelsio and Intel NICs. (host1 and host2)
The servers run Xenserver 6.0, but as part of testing with this I've tried installing RedHat 6.2, VMware ESX 5.0 (vsphere 5).
The issue occurs when using trunking and transferring data from one VLAN to another. Example...
VM1 is in VLAN401 with an IP address of 10.100.40.40. The VM is on Host1. VM2 is in VLAN402 with an IP address of 10.100.50.50. The VM is on Host2.
I've been using a network throughput tool called iPerf to test and I find that I can only get a throughput rate of about 3.0megabits.
If I switch VM2 to be in VLAN401 with an IP address of 10.100.40.41 I get a throughput rate of about 6.7gigabits/sec.
In the above scenario, I'm using a Layer3 interface on the Nexus 5020, but in production we use a Vyatta virtual firewall.
I worked with Citrix for about 3 months and that was a dead end.
I realize this is just a small business switch, basically a rebranded Linksys, but why I'm only getting 200Mbits/s
- 48 port - 10/100/1000 , set to standalone mode
- 3 separate PCs on this switch , all are fast machines with Core 2 duo / plenty of RAM etc...
- all 3 auto-sense 1Gbps connection
I use iperf tool for bandwidth testing and no matter which PC I pick as server, which as client I get about 150 to 250Mbits/s
I am not looking for full 1000 here, but 200 seems rather sad....
- jumbo frames seem to make no difference
- I am using TCP test in iperf , standard no extra flags , 10 seconds, 20 seconds or even 30 seconds all come out the same.
- wiring is shady as some of it is just Cat5 , but when going from one laptop on the switch to another with brand new Cat6 cables I STILL only got 200.
I've just upgraded to FIOS quantum service. (50 MB down, 25 up). I have a Linksys 2500 connected to the FIOS router. The FIOS (ActionTec) router provides the full advertised speeds with any speed test service I try. But with the 2500 connected to the FIOS router I get download speeds about 3MB. The MTU on the linksys is 1500. It's connected correctly and is running it's own DHCP server. (Why am I doing this? I try to avoid the ActionTec routers, they have broken many services in the past.)The 2500 firmware is up to date. I've tested on the wireless and wired (ethernet) interfaces.
We have ASA 5540. We setup Site-to-Site VPN and Remote Access VPN (Cisco VPN client). If are running full tunnel on the Cisco VPN client, the internet access is slow. For example, when we are running full-tunnel, the internet speed is 16 Mbps based on Speedtest.net. When we go to Speedtest.net, some of the graphics do not load. If we are running Split-tunnel, the internet access speed is 78 Mbps based on Speedtest.net and the Speedtest.net web site loads all the graphics.
I'd like to see some REAL LIFE comparisons of ASA firewall throughput (a bit like this one for ISR G2 Routers - [URL].
The reason I ask is that I recently upgraded a firewall from an ASA5505 to an ASA5520 on a small network where the only outside connectivity was a single 10meg Internet circuit with an IPSEC VPN (not landed on the firewall but on a router) to another site.
When I swapped out the firewall the users noticed a big improvement. The firewall is not doing anything out of the ordinary - no IPS or VPN, just standard state full inspection.
I have a Cisco 5508 setup at a host site with 3 other sites connected using hreap on 1252APs. When doing testing of network speed I find that the throughput from the wireless to wired network is at about 18mbps yet the same test on wired side is 85-100mbps and wireless to wireless is 18mbps
I am encountering some problems setting up my new polycom hdx 8000 behind ASA 5540?I have opened reuired ports through the firewall ( incoming and outgoing). I have enabled inspection h323 on ASA and enabled the option NAT is 323 compatible on Polycom.
3230-3243 tcp h323 tcp h323 udp 3230-3285 udp
Here is the problem.I get connected to the call but I cannot the remote site cannot see and hear me.But I can see and hear them.
I have a Cisco 881 (without wifi model) connected to a 100Mb unmanaged switch and a cable modem with a 120Mb down, 10Mb up connection. When I connect the modem directly to my laptop, I can reach the 120Mb/s down and 10Mb/s upload speed. When I connect the modem to the 881, the max download is about 30Mb/s. Upstream 10Mb is no problem. I've been trying to change the duplex and speed settings on the FastEthernet4 interface, but this has only a worsening effect. I should be able to get about 100Mb/s (since switch is only 100) right?
The issue was about Cisco ASA5510 Sec Plus.2 Interfaces, LAN and DMZ.Both 1000 FD, no interface errors like CRC or something similar.If I start a data transfer (like FTP) or a data stream test (like Netperf), from DMZ to INSIDE I get a theoughput.If I start the same from INSIDE to DMZ (same hosts), i get a troughput almost ten times slower.If i do the same using netperf in UDP (not TCP) I get the same in both directions.
Do some have some realistic performance numbers for a ASA 5505 on a mixed setup with local internet breakout and site to site vpn ( and don't tell me 150 mbps 3des throughput on a 100 mbps ethernet) - what can be expected in a live environment where we f.ex feed it with a 100 mbps internet connection - with a site to site vpn with f.ex 20 office workers running office on a remote terminalserver and mixed local internet breakout.
I'm new to the Networking world and am trying to establish a base for my network. I'm running ASA 5510 8.4(4), how can I measrue throughput ? In the ASDM, there is a nice feature for CPU, and the command show CLI also provides good info about CPU, but how can I get the throughput on a port basis ?
What is the difference between IP throughput routing throughput and firewall throughput
the reason is i am trying to spec a router for a mate who is setting up an online server for an old game ultima online which will have around 300-400 people each pulling around 10kb/sec
I recommended an 880 service router but when he spoke to a guy at the shop they said this would only run at 25mb/sec and he is plugging in to a 100MB/sec line
But the current router that is a home dlink which cost at most 60 Euros on a speed tester can pull 95mb/secI just don’t get how a 60 Euros router can download quicker than a 300-400 Euro router
They said try a ASA5505 that can do 150MB/sec of firewall throughput
I'm not clear about the capabilities of the ASA 5510 GigE interfaces (eth0/0 and eth0/1) with an without IPSEC tunnels enabled.
This page [URL] shows a figure of 170Mbps 'Maximum 3DES/AES VPN Throughput'. Does that mean per IPSEC tunnel or for the whole interface if it is IPSEC-enabled?
Looking at the ASA spec sheets, the ASA 5510 has a firewall throughput of 300Mbps. Does this mean 300Mbps half duplex or full duplex?
We are looking to replace our current firewall. Peak traffic at the moment is 250Mbps upstream and 20Mbps downstream, max concurrent sessions is 24K. Will I need to look at a ASA 5520 for the replacement?
I have a asa5580 with multiple interfaces. To replicate me databases to another site, I mainly use two interfaces on that firewall. Those interfaces have a steady pace, around 95%.
I am wondering when I should consider that the thoughput between those two interfaces is too much? Is there a good document that could explain me clearly why?
Also I want to be sure that I won't affect the normal traffic between the other interfaces. Is there a way to garantee certain traffic over others on an ASA? I don't have any router in me setup layer 3 role is perform by asa firewalls (static routes).
How do i measure the total throughput going via 5585-X.It has the firewall througput of 5Gbps. Looking at aggregate of all the interfaces traffic going through it seems about 4gbps is going through.
I use show traffic command and add up the trasmit and receive traffic on each live interface.Is that correct method and are there any more commands?
i need to upgrade ASA 5540 from 7.1 to 8.4 for secure connect feature of Cisco Jabber Configuration. Support forum guides that, i need to follow upgrade path from 7.1 --> 7.2 --> 8.0 --> 8.2 -->8.4 and also do a memory upgrade from 1GB to 2GB.
[URL]
I need to use this feature for only three or maximum four users in company then would i really need to do memory upgrade? or can i go with 1GB memory?also how i can get the prices of part number "ASA5540-MEM-2GB=" at cisco.com?
ASA-ISB-HQ# sh version Cisco Adaptive Security Appliance Software Version 7.1(2) Device Manager Version 5.1(2)
I have a Cisco PIx firewall that is connected to a cable modem with Time warner cable. I am supposed to have 35 down and 5 up for my speed on that modem. When I bypass the firewall and connect directly to the cable modem, I get download speeds in excess of 30 and upload speeds of about 5. However, when I connect via my workstation, which goes through the PIX, I am lucky to get speeds in the 1.2 for a download and 2-3.5 for the upload. I am using a laptop to test. We have gigabyte Cat5e cabling and gigabyte switches.
Below are statements from the config.The interface lines are per below:
interface ethernet0 100full interface ethernet1 100full interface ethernet2 auto shutdown MTU outside 1500
How can i adjust this so I can make use of the 30 speed of the modem?
I Have Cisco 5540 with AIP-SSM-40, recently i config AIP-SSM-40 to capture all traffic from all interface any to any with promiscous mode and if card fail traffic still flow throuh asa, but after that i can't login to cisco ASDM, the error is "Un Able To Launch Device Manager From xx.xx.xx.xx"
I have a remote site customer with a Cisco ASA 5540 running SSLVPN (Anyconnect)(8.03). It currently only serves about 450 SSLVPN clients. Since last friday, they've seen the CPU utilization go up to high 90% while only serving 400+ remote users. I saw some high cpu utilization bugs, but none looked to be relevant. How I can find the root cause of the CPU high utilization?
Just upped our external ASA-5540 pair to 8.4(1), and now one of our nat's is busted.
Here's the lowdown:
Our public IP for our IronPorts ends in .167. That IP is natted to a VIP on our ACE, which load balances to the IronPorts.
The outside interface of the ASA uses .162, which has been the pat for all outbound traffic for a few years... except for the subnet that houses the IronPorts. Due to reverse lookup, that subnet uses the .167 IP address for all outbound traffic.
After the code upgrade, the nat won't work. No email sent or received. Nothing but Deny's on the ASA with flags reading either "SYN" or "RST". IE: Apr 27 12:56:11 10.22.151.41 local5.crit %ASA-2-106001: Inbound TCP connection denied from 69.25.174.17/36917 to 207.236.211.167/25 flags SYN on interface outside
If I return the subnet pat back to the outside interface, then inbound traffic works fine, though reverse lookup fails and anyone running a reasonable spam filter won't send to us.
I have two Cisco ASA 5540, these ASA running ver 7.2. and used mainly as VPN gateways.My question is simple, Apart from the extra AnyConnect client functionality and the higher encryption, is there any specific security benefits (related to the VPN use) for upgrading to ver. 8.x ?
I have to use GNS3 for simulate ASA5540.but it does not work. I've installed latest GNS3(0.8.3.1 all in one) in Win7 32bit environment, and used IOS file is asa842-k8.bin.but i can't unpack it properly. it said "Couldn't find any ZIP header in asa842-k8.bin".
I have two ASA 5540 working in Active/Standby mode. After I've upgraded them to 8.2.3 ver. I have the following issue: once a day presently active device arbitary reloadI have no err in show version and in syslogs:11:15:50 ASA : %ASA-6-302020: Built inbound ICMP connection for faddr 10.10.0.36/512 gaddr 10.0.0.16/0 laddr 1011:15:58 ASA : %ASA-1-104001: (Primary) Switching to ACTIVE - HELLO not heard from mate.
