topic frustrating performance issues with CBAC in Network Security

frustrating performance issues with CBAC

tato386 — Mon, 11 Mar 2019 21:08:07 GMT

I have half a dozen, late model 2800 series routers connected to 30M+ cable modem connections running recent IOS and CBAC firewall. Very simple config. NAT overload on the public interface of the router. Inbound acces-list that allows ICMP traffic. Inspect lists on inside interface inbound direction. Very straightforward. Performace for clients behind the CBAC/router is abysmal in all cases except one. Download at 3-5MB. Uploads slightly better at 4-8MB but nothing close to 30MB. One router gets over 20MB up and down but it is the exception. All routers are identical in IOS version and config. Cannot figure out for the life of me why only one gets decent speed.

Of course when you connect a PC client directly to the modems they all reach very close to advertised speed. If all routers where slow then I would think that a 2800 running CBAC simply can't achieve that type of throughtput but we are only talking 30MB here and besides one router does get good speed.

Anybody have any ideas and/or recommendations?

Thanks,
Diego

frustrating performance issues with CBAC

Collin Clark — Fri, 05 Aug 2011 15:48:54 GMT

What do the resource utilizations on the router look like (ie CPU, MEM, NAT Trans)? What is the performance when you plug the PC directly into the router?

frustrating performance issues with CBAC

tato386 — Tue, 09 Aug 2011 01:48:48 GMT

Resources on the router are all showing very light loads. Additionaly we do the test after hours in order to achieve the most accurare results possible. Even with just one PC accessing the Internet we never get more that 5MB or so on a 30MB cable modem connection.

When we connect the PC directly to the cable modem we get 20-25MB downloads which would be fine with us if we could achieve these same speeds from behind the router.

Thanks,

Diego

frustrating performance issues with CBAC

lcaruso — Tue, 09 Aug 2011 02:07:11 GMT

I'd be inclined to take a peek at sh int for any issues.

If it's recent IOS, why not try ZBF instead?

As far as the one router that works, compare its interface stats, all firmware, etc down to the smaller details against the others and see if you can spot any differences.