topic Performance Issue Suspected with Zones and Inspect Configuration in Network Security

Performance Issue Suspected with Zones and Inspect Configuration

jaesposito — Mon, 11 Mar 2019 20:45:53 GMT

All,

I suspect that I am experiencing performance issues related to my firewall zone configuration AND/OR the inspection being done on packets. With that in mind, I have two basic questions based on my attached configuration:

1.) In looking at my configuration, what purpose do these default firewall zones AND inspect commands have for this router, which I am using on a plain DSL connection in my home?

2.) Could any part of this configuration be responsible for slowing down some of my home devices such as my AppleTV for streaming Netflix, YouTube?

The router is a 881W and is running 12.4.24.T5. If you feel that any parts of this configuration are unnecessary and might be contributing to my performance issues, please feel free to chime in.

Thank you for the help!

James E

Performance Issue Suspected with Zones and Inspect Configuration

Maykol Rojas — Thu, 16 Jun 2011 04:36:08 GMT

Hi,

May be out of order packets and the inspection is messing with them, your config looks fine. Would you please put the following command on the Routing:

Conf t

ip inspect log drop-pkt

do term mon

Try to access Youtube from the PC, TV, or whatever device has slow connection, gather the logs, and paste them over here.

Cheers

Mike

Performance Issue Suspected with Zones and Inspect Configuration

jaesposito — Thu, 16 Jun 2011 23:24:41 GMT

Ok. I added that config parameters. Here is the log output when I attempt to use Netflix on the AppleTV (IP 192.168.1.102):

000040: *Jun 16 18:07:54.567 PCTime: %FW-6-DROP_PKT: Dropping tcp session 8.12.223.254:80 192.168.1.102:51763 due to Out-Of-Order Segment with ip ident 0

000041: *Jun 16 18:08:24.871 PCTime: %FW-6-DROP_PKT: Dropping tcp session 8.12.223.254:80 192.168.1.102:51763 due to Out-Of-Order Segment with ip ident 0

000042: *Jun 16 18:08:55.115 PCTime: %FW-6-DROP_PKT: Dropping tcp session 8.12.223.254:80 192.168.1.102:51764 due to Out-Of-Order Segment with ip ident 0

000043: *Jun 16 18:09:25.759 PCTime: %FW-6-DROP_PKT: Dropping tcp session 8.12.223.254:80 192.168.1.102:51766 due to Out-Of-Order Segment with ip ident 0

000044: *Jun 16 18:09:55.911 PCTime: %FW-6-DROP_PKT: Dropping tcp session 8.12.223.254:80 192.168.1.102:51768 due to Out-Of-Order Segment with ip ident 0

000045: *Jun 16 18:10:26.355 PCTime: %FW-6-DROP_PKT: Dropping tcp session 8.12.223.254:80 192.168.1.102:51770 due to Out-Of-Order Segment with ip ident 0

000046: *Jun 16 18:10:56.367 PCTime: %FW-6-DROP_PKT: Dropping tcp session 8.12.223.254:80 192.168.1.102:51770 due to Out-Of-Order Segment with ip ident 0

000047: *Jun 16 18:11:26.839 PCTime: %FW-6-DROP_PKT: Dropping tcp session 8.12.223.254:80 192.168.1.102:51773 due to Out-Of-Order Segment with ip ident 0

000048: *Jun 16 18:11:57.447 PCTime: %FW-6-DROP_PKT: Dropping tcp session 8.12.223.254:80 192.168.1.102:51774 due to Out-Of-Order Segment with ip ident 0

000049: *Jun 16 18:12:27.691 PCTime: %FW-6-DROP_PKT: Dropping tcp session 8.12.223.254:80 192.168.1.102:51776 due to Out-Of-Order Segment with ip ident 0

000050: *Jun 16 18:12:27.691 PCTime: %FW-6-DROP_PKT: Dropping tcp session 8.12.223.254:80 192.168.1.102:51776 due to Out-Of-Order Segment with ip ident 0

000051: *Jun 16 18:12:57.931 PCTime: %FW-6-DROP_PKT: Dropping tcp session 8.26.210.253:80 192.168.1.102:51777 due to Out-Of-Order Segment with ip ident 0