topic Re: Cisco ASA Duplex Setting in Network Security

Cisco ASA Duplex Setting

muhammadfazil.ff31 — Sat, 05 Dec 2020 11:50:47 GMT

Hi,

I have a Cisco ASAv configured in GNS3. I am trying to configure the duplex setting for interface GigabitEthernet0/0 and I had configured the duplex as well and now when I run "show interface GigabitEthernet0/0" I am seeing the below output.

Interface GigabitEthernet0/0 "inside", is up, line protocol is up

Hardware is i82540EM rev03, BW 1000 Mbps, DLY 10 usec

Half-Duplex(Full-duplex), 10 Mbps(1000 Mbps)

Input flow control is unsupported, output flow control is off

MAC address 0c38.d1ac.7f01, MTU 1500

IP address 11.0.1.1, subnet mask 255.255.255.0

7615426 packets input, 657418256 bytes, 0 no buffer

Received 3 broadcasts, 0 runts, 0 giants

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

0 pause input, 0 resume input

0 L2 decode drops

8216317 packets output, 774592698 bytes, 0 underruns

0 pause output, 0 resume output

0 output errors, 0 collisions, 2 interface resets

0 late collisions, 0 deferred

3 input reset drops, 0 output reset drops

input queue (blocks free curr/low): hardware (498/461)

output queue (blocks free curr/low): hardware (511/509)

Traffic Statistics for "inside":

8699 packets input, 593554 bytes

9180 packets output, 736088 bytes

0 packets dropped

1 minute input rate 0 pkts/sec, 6 bytes/sec

1 minute output rate 0 pkts/sec, 8 bytes/sec

Now if you see the duplex line where the line is "Half-Duplex(Full-duplex), 10 Mbps(1000 Mbps)". Just wanted to know what does the Full-duplex mean here in the bracket. Does the interface is still running in Full-duplex mode even though if it is configured as Half-Duplex?

Thanks in Advance

Mohammed Fazil

Re: Cisco ASA Duplex Setting

Marvin Rhoads — Sat, 05 Dec 2020 14:43:29 GMT

The convention for the show interface output is "[configured setting] (operating mode)".

An actual ASAv should not allow you to choose half-duplex 10 Mbps. What image are you using? I suspect one of the ASA images made for a hardware appliance running in GNS3 - not an actual ASAv image.

Here are the options for an actual ASAv running on ESXi:

ccielab-asa(config)# int gi0/1
ccielab-asa(config-if)# duplex ?

interface mode commands/options:
  auto  Enable AUTO duplex configuration
  full  Force full duplex operation
ccielab-asa(config-if)# speed ?

interface mode commands/options:
  1000  Force 1000 Mbps operation
  auto  Enable AUTO speed configuration
ccielab-asa(config-if)# end    
ccielab-asa#

Re: Cisco ASA Duplex Setting

muhammadfazil.ff31 — Sun, 06 Dec 2020 07:41:32 GMT

Thanks for the response Marvin.

I am using the below version of ASAv.

Cisco Adaptive Security Appliance Software Version 9.9(2)

Firepower Extensible Operating System Version 2.3(1.84)

Device Manager Version 7.9(2)

Compiled on Sun 25-Mar-18 17:32 PDT by builders

System image file is "boot:/asa992-smp-k8.bin"

Config file at boot was "startup-config"

ciscoasa up 23 secs

Hardware: ASAv, 2048 MB RAM, CPU Pentium II 3499 MHz,

Model Id: ASAv10

Internal ATA Compact Flash, 8192MB

Slot 1: ATA Compact Flash, 8192MB

BIOS Flash Firmware Hub @ 0x0, 0KB

Just wanted to confirm the value which is in the operating mode is the one which is currently running one? And the value which is in configured setting is the one which is just configured but since the device does not support half duplex it is not in operating mode if my understanding is correct.

Also I read the below statement from the configuring guide.

The interface type, maximum bandwidth, delay, duplex, and speed. When the link is down, the duplex and speed show the configured values. When the link is up, these fields show the configured values with the actual settings in parentheses. The following list describes the common hardware types:

The above statement is taken from the link below

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s7.html

Also in the below documentation i see the duplex configuration full is supported which is for ASA-5510 and higher.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/interface_start.html

Can you please explain me a little more clearer as i am confused with referring documentation.

Thanks and Regards,

Mohammed Fazil

Re: Cisco ASA Duplex Setting

Marvin Rhoads — Sun, 06 Dec 2020 14:36:25 GMT

I believe the documentation is in error in that it doesn't mention the limitations of ASAv interfaces.

As confirmed in the document you cite, the value in parentheses is the actual setting (operating mode as I termed it - less ambiguously in my opinion).

Re: Cisco ASA Duplex Setting

muhammadfazil.ff31 — Mon, 07 Dec 2020 05:31:02 GMT

Thank you Marvin for your help in making me understand the duplex setting in ASA.