topic Re: ASA 5540 Version 7.2(2) CPU spike in Network Security https://community.cisco.com/t5/network-security/asa-5540-version-7-2-2-cpu-spike/m-p/688556#M1031143 <HTML><HEAD></HEAD><BODY><P>It looks like a bug, I suggest you rio change the encryption type. If you are AES -128, changed to 3DES encryption for the VPN traffic. </P></BODY></HTML> Thu, 01 Feb 2007 15:15:30 GMT amritpatek 2007-02-01T15:15:30Z ASA 5540 Version 7.2(2) CPU spike https://community.cisco.com/t5/network-security/asa-5540-version-7-2-2-cpu-spike/m-p/688555#M1031111 <P>Hi,</P><P></P><P>First a bit of history</P><P></P><P>A few months ago we upgraded our PIX 515 from version 6.3(5) to version 7.2.1. we then suffered the consequences with a very heavily utilised CPU and packet loss.. the thing was idling around 50% cpu..</P><P></P><P>Anyway we have just recently replaced out PIX failover pair with a pair of ASA 5540 running version 7.2(2). Initially the replacement went fine and things seem to work ok. However we now seem to have the same problem we had before???!!! I would say total firewall throughput across all 12 physical and logical interfaces is less than 100Mbps , xlates and connections are low and all interfaces are good..</P><P></P><P>The ASA's initially seemed to be good and idle along most of the time at around 5% cpu however we have started so noticed a few issues with some of our VOIP (this goes inside a dmvpn tunnel that passes through the PIX)... so I enabled prioriry queues on the ASA</P><P></P><P>Looking into the VOIP problems it seems that the ASA CPU seems to spike at around 99% for maybe a second (long enough for voip) and then drops..... not sure why this is happening... the ASA 5540 are supposed to be able to handle 650Mbps...???</P><P></P><P>Could this be some sort of bug? If I show CPU hog on the ASA we get the following?</P><P></P><P>Process: Dispatch Unit, NUMHOG: 1406, MAXHOG: 9084, LASTHOG: 1010</P><P>LASTHOG At: 17:12:59 UTC Jan 25 2007</P><P>PC: 89cd5d</P><P>Traceback: 2f16b3 2f0f4d 2f4b81 2ed253 74bbd7 7411ce c3a905</P><P> c3ae4f c3b334 740fab 74bf38 74e086 62b970 21906a</P><P></P><P>I know that this unit is more than capable of handling this.. our old 515E was... can anyone shed any light on this?</P><P></P><P>Thanks</P><P>Matt</P> Mon, 11 Mar 2019 09:24:37 GMT https://community.cisco.com/t5/network-security/asa-5540-version-7-2-2-cpu-spike/m-p/688555#M1031111 mattbclarke 2019-03-11T09:24:37Z Re: ASA 5540 Version 7.2(2) CPU spike https://community.cisco.com/t5/network-security/asa-5540-version-7-2-2-cpu-spike/m-p/688556#M1031143 <HTML><HEAD></HEAD><BODY><P>It looks like a bug, I suggest you rio change the encryption type. If you are AES -128, changed to 3DES encryption for the VPN traffic. </P></BODY></HTML> Thu, 01 Feb 2007 15:15:30 GMT https://community.cisco.com/t5/network-security/asa-5540-version-7-2-2-cpu-spike/m-p/688556#M1031143 amritpatek 2007-02-01T15:15:30Z Re: ASA 5540 Version 7.2(2) CPU spike https://community.cisco.com/t5/network-security/asa-5540-version-7-2-2-cpu-spike/m-p/688557#M1031168 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>I got to the bottom of this, it seemed to be related to esmtp fixup. I turned this off and cpu hog went away... Looking in the logs fixup was not liking some of our mail...</P><P></P><P>Thanks</P></BODY></HTML> Thu, 01 Feb 2007 15:28:16 GMT https://community.cisco.com/t5/network-security/asa-5540-version-7-2-2-cpu-spike/m-p/688557#M1031168 mattbclarke 2007-02-01T15:28:16Z