topic Re: Zabbix is pinging devices via asa 5505 with 33% loss in Network Security

Zabbix is pinging devices via asa 5505 with 33% loss

dijix1990 — Sat, 27 May 2023 11:18:45 GMT

We placed our devices behind our asa 5505 and after it I noticed that zabbix is pinging every devices behind the asa with loss where is the problem? Asa can't skip icmp without loss?

Re: Zabbix is pinging devices via asa 5505 with 33% loss

Flavio Miranda — Sat, 27 May 2023 12:33:04 GMT

Try to enable icmp inspection, if not yet.

Re: Zabbix is pinging devices via asa 5505 with 33% loss

dijix1990 — Sat, 27 May 2023 14:22:26 GMT

I didn't have it, but it didn't help

policy-map global_policy
class netflow-export-class
class inspection_default
inspect icmp

icmp permit any interface_switch

maybe the asa is dropping 1 out of 3 packets from zabbix because of the policy rate in default mode? there is very simple config for 100 devices, just permit icmp from zabbix to devices and permit snmp from zabbix to devices.
On the asa about 3000 conn

Re: Zabbix is pinging devices via asa 5505 with 33% loss

dijix1990 — Sat, 27 May 2023 14:48:54 GMT

hm it happens every 15 minutes

Re: Zabbix is pinging devices via asa 5505 with 33% loss

Kasun Bandara — Sun, 28 May 2023 01:12:17 GMT

@dijix1990 hi, check firewall logs and make sure its dropped by firewall. if not this can be different issue like asymmetric routing,

Re: Zabbix is pinging devices via asa 5505 with 33% loss

dijix1990 — Sun, 28 May 2023 01:39:34 GMT

Hi, I have already watched and there was nothing. There are no drops at all.

1. Zabbix has ip 172.18.200.200 and is pinging devices which were placed in network 172.18.210./24 every 15 seconds

2. asa has ip 172.18.200.1 (vlan 100) and 172.18.210.1 (vlan200)

3.Zabbix can reach net 172.18.210.0/24 via 172.18.200.1

4. devices have default gateway as 172.18.210.1

When I move gw 172.18.200.1 and 172.18.210.1 to isr819 ping check becames perfect, I tested it for a day, there were no drops.

So it isn't asymmetric routing too

Re: Zabbix is pinging devices via asa 5505 with 33% loss

Kasun Bandara — Sun, 28 May 2023 01:47:10 GMT

@dijix1990 hi, in that case we can suspect ASA. are you with latest recommended OS for ASA?

Re: Zabbix is pinging devices via asa 5505 with 33% loss

dijix1990 — Sun, 28 May 2023 02:46:49 GMT

Yes. I installed this software asa924-33-k8.bin

Re: Zabbix is pinging devices via asa 5505 with 33% loss

Kasun Bandara — Sun, 28 May 2023 03:25:36 GMT

@dijix1990 can you try enable debugging and share the output for specific flow?

Re: Zabbix is pinging devices via asa 5505 with 33% loss

dijix1990 — Sun, 28 May 2023 03:27:26 GMT

To be honest no, but I will try today

Re: Zabbix is pinging devices via asa 5505 with 33% loss

dijix1990 — Sun, 28 May 2023 12:29:09 GMT

Just start debug icmp trace?