topic Re: Poor throughput with 5505 in Network Security

Poor throughput with 5505

TStraub1818 — Mon, 11 Mar 2019 19:53:53 GMT

I've been dealing with poor throughput on a 5505 and I'm fed up enough to seek some answers. I've got Comcast 50/10 service. Connecting my laptop directly to the Comcast router and using Speedtest.net, I get 52.8 down and 11 up. Fantastic. Going through the 5505 I get 2.7 down and 10.5 up. Yes two MBps! Swapping the 5505 out for a cheap RVS4000 and I get 12.3 down. All Speedtest.net test (and comparable download speed from Microsoft's digitalriver) were performed from the same laptop at the same off-peak time period. You can only imaging the 2.7 slowing to a crawl during the day. What gives?

I didn't set up the 5505 and don't know it inside & out but I'll try to answer whatever questions you may have. I know that the interface is set to 100Mbps Full, same with the port on the Comcast router.

Re: Poor throughput with 5505

Maykol Rojas — Tue, 22 Feb 2011 00:01:41 GMT

Would you please paste the show interface?

Cheers

Mike

Re: Poor throughput with 5505

sean_evershed — Tue, 22 Feb 2011 00:49:37 GMT

Hi,

Have a look at this excellent troubleshooting guide. You may find the answer here.

https://supportforums.cisco.com/docs/DOC-8982

Re: Poor throughput with 5505

TStraub1818 — Tue, 22 Feb 2011 02:01:15 GMT

Result of the command: "sh int"

Interface Vlan1 "inside", is up, line protocol is up
Hardware is EtherSVI
Description: Inside_Network
MAC address c47d.4f60.5fa7, MTU 1500
IP address 192.168.0.1, subnet mask 255.255.255.0
Traffic Statistics for "inside":
569865536 packets input, 491226198579 bytes
434816140 packets output, 273649026166 bytes
7349682 packets dropped
      1 minute input rate 13 pkts/sec, 2813 bytes/sec
      1 minute output rate 11 pkts/sec, 2715 bytes/sec
      1 minute drop rate, 2 pkts/sec
      5 minute input rate 11 pkts/sec, 1858 bytes/sec
      5 minute output rate 8 pkts/sec, 2231 bytes/sec
      5 minute drop rate, 2 pkts/sec
Interface Vlan2 "outside", is up, line protocol is up
Hardware is EtherSVI
Description: Outside_Comcast
MAC address c47d.4f60.5fa7, MTU 1500
IP address xxx.xxx.xxx.153, subnet mask 255.255.255.248
Traffic Statistics for "outside":
436825873 packets input, 282405031486 bytes
559024273 packets output, 506713487379 bytes
794406 packets dropped
      1 minute input rate 8 pkts/sec, 1500 bytes/sec
      1 minute output rate 7 pkts/sec, 2488 bytes/sec
      1 minute drop rate, 0 pkts/sec
      5 minute input rate 6 pkts/sec, 1357 bytes/sec
      5 minute output rate 6 pkts/sec, 1555 bytes/sec
      5 minute drop rate, 0 pkts/sec
Interface Vlan3 "outside2", is up, line protocol is up
Hardware is EtherSVI
Description: Outside_Covad
MAC address c47d.4f60.5fa7, MTU 1500
IP address yy.yyy.yyy.158, subnet mask 255.255.255.248
Traffic Statistics for "outside2":
80323 packets input, 4424083 bytes
70385 packets output, 14331529 bytes
42366 packets dropped
      1 minute input rate 0 pkts/sec, 0 bytes/sec
      1 minute output rate 0 pkts/sec, 14 bytes/sec
      1 minute drop rate, 0 pkts/sec
      5 minute input rate 0 pkts/sec, 0 bytes/sec
      5 minute output rate 0 pkts/sec, 2 bytes/sec
      5 minute drop rate, 0 pkts/sec
Interface Vlan4 "dmz", is down, line protocol is down
Hardware is EtherSVI
Description: DMZ_Network
MAC address c47d.4f60.5fa7, MTU 1500
IP address 10.11.12.1, subnet mask 255.255.255.0
Traffic Statistics for "dmz":
0 packets input, 0 bytes
0 packets output, 0 bytes
0 packets dropped
      1 minute input rate 0 pkts/sec, 0 bytes/sec
      1 minute output rate 0 pkts/sec, 0 bytes/sec
      1 minute drop rate, 0 pkts/sec
      5 minute input rate 0 pkts/sec, 0 bytes/sec
      5 minute output rate 0 pkts/sec, 0 bytes/sec
      5 minute drop rate, 0 pkts/sec
Interface Ethernet0/0 "", is up, line protocol is up
Hardware is 88E6095, BW 100 Mbps
Full-Duplex(Full-duplex), 100 Mbps(100 Mbps)
Available but not configured via nameif
MAC address c47d.4f60.5f9f, MTU not set
IP address unassigned
574363987 packets input, 502681504045 bytes, 0 no buffer
Received 12916396 broadcasts, 128 runts, 0 giants
3167578 input errors, 3167450 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 L2 decode drops
20605 switch ingress policy drops
434815937 packets output, 282442828329 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
0 rate limit drops
0 switch egress policy drops
Interface Ethernet0/1 "", is up, line protocol is up
Hardware is 88E6095, BW 100 Mbps
Full-Duplex(Full-duplex), 100 Mbps(100 Mbps)
Available but not configured via nameif
MAC address c47d.4f60.5fa0, MTU not set
IP address unassigned
436871121 packets input, 290384046447 bytes, 0 no buffer
Received 337973 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 L2 decode drops
45257 switch ingress policy drops
559024191 packets output, 517049433444 bytes, 0 underruns
1 output errors, 1 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
0 rate limit drops
0 switch egress policy drops
Interface Ethernet0/2 "", is up, line protocol is up
Hardware is 88E6095, BW 100 Mbps
Full-Duplex(Full-duplex), 100 Mbps(100 Mbps)
Available but not configured via nameif
MAC address c47d.4f60.5fa1, MTU not set
IP address unassigned
85135 packets input, 7557113 bytes, 0 no buffer
Received 48726 broadcasts, 0 runts, 0 giants
421670 input errors, 33335 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 L2 decode drops
4813 switch ingress policy drops
70385 packets output, 15888135 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
0 rate limit drops
0 switch egress policy drops
Interface Ethernet0/3 "", is down, line protocol is down
Hardware is 88E6095, BW 100 Mbps
Full-Duplex, 100 Mbps
Available but not configured via nameif
MAC address c47d.4f60.5fa2, MTU not set
IP address unassigned
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 L2 decode drops
0 switch ingress policy drops
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
0 rate limit drops
0 switch egress policy drops
Interface Ethernet0/4 "", is down, line protocol is down
Hardware is 88E6095, BW 100 Mbps
Full-Duplex, 100 Mbps
Available but not configured via nameif
MAC address c47d.4f60.5fa3, MTU not set
IP address unassigned
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 L2 decode drops
0 switch ingress policy drops
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
0 rate limit drops
0 switch egress policy drops
Interface Ethernet0/5 "", is down, line protocol is down
Hardware is 88E6095, BW 100 Mbps
Full-Duplex, 100 Mbps
Available but not configured via nameif
MAC address c47d.4f60.5fa4, MTU not set
IP address unassigned
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 L2 decode drops
0 switch ingress policy drops
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
0 rate limit drops
0 switch egress policy drops
Interface Ethernet0/6 "", is down, line protocol is down
Hardware is 88E6095, BW 100 Mbps
Auto-Duplex, Auto-Speed
Available but not configured via nameif
MAC address c47d.4f60.5fa5, MTU not set
IP address unassigned
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 L2 decode drops
0 switch ingress policy drops
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
0 rate limit drops
0 switch egress policy drops
Interface Ethernet0/7 "", is down, line protocol is down
Hardware is 88E6095, BW 100 Mbps
Auto-Duplex, Auto-Speed
Available but not configured via nameif
MAC address c47d.4f60.5fa6, MTU not set
IP address unassigned
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 L2 decode drops
0 switch ingress policy drops
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
0 rate limit drops
0 switch egress policy drops

Re: Poor throughput with 5505

TStraub1818 — Tue, 22 Feb 2011 02:03:01 GMT

Thanks for the link, it looks like a very good doc. I'm going through it now.

Re: Poor throughput with 5505

Maykol Rojas — Tue, 22 Feb 2011 02:14:58 GMT

Hi,

Well I cannot see a clear reason why the slow internet... just one question, do you have http inspection turned on?

You can do a show run policy-map and check. If you do, please remove it, do a clear local and then do the test again.

Cheers

Mike

Re: Poor throughput with 5505

TStraub1818 — Tue, 22 Feb 2011 02:21:05 GMT

Ok, thanks for looking at it.

I saw the HTTP inspection in the doc sean_evershed recommended. It was off:

Result of the command: "sh run policy-map"

!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!

Re: Poor throughput with 5505

cciesec2011 — Tue, 22 Feb 2011 02:22:00 GMT

by turning OFF http inspection, isn't that a security risk? Isn't that the whole reason why you buy a firewall in the first place?

You can always recommend him the same recommendation usually recommended by Cisco TAC: upgrade to the lastest code.

Re: Poor throughput with 5505

jubetz — Tue, 22 Feb 2011 03:01:33 GMT

Serious amounts of CRC errors on e0/0:

Interface Ethernet0/0 "", is up, line protocol is up
Hardware is 88E6095, BW 100 Mbps
Full-Duplex(Full-duplex), 100 Mbps(100 Mbps)
Available but not configured via nameif
MAC address c47d.4f60.5f9f, MTU not set
IP address unassigned
574363987 packets input, 502681504045 bytes, 0 no buffer
Received 12916396 broadcasts, 128 runts, 0 giants
3167578 input errors, 3167450 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 L2 decode drops
20605 switch ingress policy drops
434815937 packets output, 282442828329 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
0 rate limit drops
0 switch egress policy drops

If that counter is incrementing while you're passing traffic. This is usually a speed/duplex mismatch. How did you verify speed duplex on the comcast router side. Both sides have to be auto, or both sides have to be hard-coded.

HTH,

-jb

Re: Poor throughput with 5505

Maykol Rojas — Tue, 22 Feb 2011 03:06:37 GMT

Missed that T_T.... If the duplex is fine on comcast (And I guess you would need to call them), try changing the network cable.

Cheers

Mike

Re: Poor throughput with 5505

TStraub1818 — Tue, 22 Feb 2011 03:16:25 GMT

e0/0 is internal - connected to a 'cuda 310. e0/1 is Comcast, manually set to 100 full, I double checked it. I'll see about setting e0/0 to auto since I don't think I can set the 310 manually, and I'll swap cables too for good measure.

Thanks for the help so far!

Re: Poor throughput with 5505

TStraub1818 — Tue, 22 Feb 2011 03:39:29 GMT

Set e0/0 to auto and it appears to have cleared up the issues. I'll check it out more tomorrow and post back.

Re: Poor throughput with 5505

TStraub1818 — Tue, 22 Feb 2011 16:32:58 GMT

Middle of the day and I just downloaded a 585MB file in 90 seconds. I think the problem is resolved! Thanks all!

Re: Poor throughput with 5505

jubetz — Tue, 22 Feb 2011 17:00:24 GMT

Great news. Glad we could help.

-jb