topic Re: Cisco ASA inside interface CRC errors + input errors incrementing in Network Security

Cisco ASA inside interface CRC errors + input errors incrementing

LovejitSingh130013 — Thu, 11 Feb 2021 16:29:28 GMT

Hello @balaji.bandi @Rob Ingram @Marvin Rhoads @Mohammed al Baqari @Richard Burts @Aref Alsouqi @Richard Burts @Joseph W. Doherty @Giuseppe Larosa

I got Cisco ASA 5525 with Firepower services and got FMV VM to manage the Firepower services.

I got 200 Mbps download and Upload and its a dedicated Circuited from Rogers.

The issue is that I am not getting more than 50 Mbps Upload speed while getting 100% (upto 200 Mbps) download. ISP said its something with our Firewall.

I worked Cisco TAC and we checked CPU usage for ASA and firepower which looks great and stable.

I checked Outside interface and did not see any errors etc. but when I checked internal inside interface i see CRC/input errors continuously incrementing.

I checked same thing on switchport connected to it and there are no errors on it.

I also checked that Duplex and speed settings are same and on Auto. and MTU is 1500.

I changed the cable but it did not make any difference.

Can you guys advice what else should i do to find the root cause for these errors on inside interface?

Also what else can contribute in delaying upload speed on ASA?

Thanks

Re: Cisco ASA inside interface CRC errors + input errors incrementing

Rob Ingram — Thu, 11 Feb 2021 16:40:51 GMT

@LovejitSingh130013

How many CRC errors, a few or a lot?

What firepower features do you have enabled? Some features can impact performance quite dramatically.

TAC would be best placed to help you troubleshoot this, how did you leave it with them?

Re: Cisco ASA inside interface CRC errors + input errors incrementing

LovejitSingh130013 — Thu, 11 Feb 2021 16:41:27 GMT

@Rob Ingram

We got IPS+Malware+URL Filtering enabled.

Thanks,

Re: Cisco ASA inside interface CRC errors + input errors incrementing

balaji.bandi — Thu, 11 Feb 2021 16:46:40 GMT

first steps to confirm is you getting real bandwidth or not. Connect any device bypass FP and check are you really getting the mentioned bandwidth from ISP or not.

Then coming back to FP, if you have IPS, you may see some performance issue, this required may have some tuning based on the deployment.

Re: Cisco ASA inside interface CRC errors + input errors incrementing

Rob Ingram — Thu, 11 Feb 2021 16:47:55 GMT

@LovejitSingh130013

Re-run your tests without those features enabled and see if performance improves. Then go from there, adjust policies if required.

Re: Cisco ASA inside interface CRC errors + input errors incrementing

cmarva — Fri, 12 Feb 2021 15:13:41 GMT

can you port a "sho interface" for the inside interface?