topic Re: ZBF - Inspection slows down HTTP Downloads in Network Security

ZBF - Inspection slows down HTTP Downloads

fernandoseidler — Mon, 11 Mar 2019 20:03:34 GMT

Hi,

I Have a 2821 Router with a IOS Version 12.4(13r)T.

When i enabled the firewall, my download speed slows down to 10-20kbps (the normal is 5-6 Mbps).

Anyone can help?

Thanks

Fernando

Re: ZBF - Inspection slows down HTTP Downloads

praiyeng — Wed, 09 Mar 2011 17:49:44 GMT

hi ,

Provide the complete ZBF config and enable the following command " ip inspect log drop-pkt"

this would display the log which explains if there is a packet drop due to zbf

Re: ZBF - Inspection slows down HTTP Downloads

fernandoseidler — Wed, 09 Mar 2011 18:13:51 GMT

i've send the config by message...

Re: ZBF - Inspection slows down HTTP Downloads

praiyeng — Wed, 09 Mar 2011 18:21:34 GMT

I havent recieved any message yet

Re: ZBF - Inspection slows down HTTP Downloads

fernandoseidler — Wed, 09 Mar 2011 18:44:42 GMT

i'm sending the zbf configuration

i've erased the acl rules...

Re: ZBF - Inspection slows down HTTP Downloads

fernandoseidler — Wed, 09 Mar 2011 18:59:00 GMT

The ZBF is dropping the packets:

Mar 9 15:52:02: %FW-6-DROP_PKT: Dropping tcp session 200.237.193.51:80 my_ip_address:44520 due to Out-Of-Order Segment with ip ident 0

any idea?

Re: ZBF - Inspection slows down HTTP Downloads

PAUL GILBERT ARIAS — Wed, 09 Mar 2011 19:05:57 GMT

Fernando, have you tried disabling http inspection just to make check if that is the issue?

Re: ZBF - Inspection slows down HTTP Downloads

its.hospitality — Thu, 07 Apr 2011 13:47:29 GMT

We had the same issue with ZBF and HTTP downloads using a "fast" WAN line (~10 mbps).

I fixed it by increasing the size of the OOO queue and the allocated memory:

1) check your current values:

show parameter-map type ooo global

2) Apply higher values for queue length and memory limit. I am fine with the following:

conf t

parameter-map type ooo global

tcp reassembly queue length 200

tcp reassembly memory limit 4096

Cheers,

Matteo

Re: ZBF - Inspection slows down HTTP Downloads

fernandoseidler — Thu, 07 Apr 2011 16:35:17 GMT

Hi Matteo,

Thank you VERY MUCH!

The solution works perfectly...

Downloads are OK now...

Thanks!

Fernando

Re: ZBF - Inspection slows down HTTP Downloads

its.hospitality — Wed, 13 Apr 2011 16:34:57 GMT

Thanks for your message; we have created a ticket with the id "[scescs #1244875]" for your request.

There is no need to reply to this message right now. However if you reply, please use in the subject line. That allows us to attach your reply to the ticket.

Sincerely,

your IT Support Team

Re: ZBF - Inspection slows down HTTP Downloads

blumoorpheus — Thu, 19 May 2011 08:58:29 GMT

Hi,

i have the same problem fernando, but, on the Cisco 877, the parameter (parameter-map type ooo global) does not work.

My ios is 12.4(24).T4

L'help for the command "parameter-map type" is:

Avezzano(config)#parameter-map type ?
                           consent        Parameter type consent
                           inspect        inspect parameter-map
                           protocol-info protocol-info parameter-map
                           regex          regex parameter-map
                           trend-global   Trend global parameter-map
                           urlf-glob      URLF glob parameter-map
                           urlfpolicy     Parameter maps for urlfilter policy

Pls help me.

X Matteo Castelli

cioa Matteo, vedo che sei italiano.

Come ho detto sopra i comandi da te specificati, nell'877 non funzionano.

Hai idea di come aumentare la coda e la quantità di memoria su questo router?

Re: ZBF - Inspection slows down HTTP Downloads

fernandoseidler — Thu, 19 May 2011 15:44:35 GMT

Hi Franco

It appears that command "parameter-map type ooo..." was introduced in IOS 15.0(1)M. Before that, the out-of-order packet processing was only supported in the classic firewall, not Zone Based Firewall.

If you upgrade your IOS, the command will work...

Sorry for my english...