topic Slow inbound http, fast outbound http - ASA5510 in Network Security

Slow inbound http, fast outbound http - ASA5510

mjacobsecaq — Mon, 11 Mar 2019 19:18:29 GMT

Hiyas,

We recently purchased an ASA 5510 and i'm having a slight problem configuring it.

When I enable the following (just default traffic inspection), download speed drops to ~ 3Mb/s from > 10Mb/s.

class-map global-class
 match default-inspection-traffic
!
!
policy-map global-policy
 class global-class
  inspect ctiqbe
  inspect rsh
  inspect esmtp
  inspect h323 ras
  inspect ftp
  inspect http
  inspect sip
  inspect icmp error
  inspect xdmcp
  inspect h323 h225
  inspect netbios
  inspect icmp
  inspect ils
  inspect rtsp
  inspect skinny
  inspect tftp
  inspect sqlnet
  inspect pptp
  inspect dns
  inspect mgcp
  inspect sunrpc
  inspect snmp
!
service-policy global-policy global

Only HTTP traffic is affected, FTP still goes at the full 10Mb/s up and !0MB/s down.

When I disable the above service policy rule, everything goes fast again.

If anyone can help or provide any insight here it would be greatly appreciated.

Thanks,

Matt

Re: Slow inbound http, fast outbound http - ASA5510

Jennifer Halim — Mon, 06 Dec 2010 06:57:22 GMT

When you enable the inspection for HTTP, that will slow down the HTTP traffic a little because it is performing deep packet inspection for HTTP traffic.

For more details on what "inspect http" does, please check the following command reference:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/i2.html#wp1735782

You can temporarily disable only the HTTP inspection from the global policy map as follows:

policy-map global-policy

class global-class

no inspect http

The above will disable just the HTTP inspection, and you can check the speed.

For more security, you would need to enable the http inspection, however, with security as it needs to inspect the packet in more details, it will impact the performance/speed.

Hope that answers your question.

Re: Slow inbound http, fast outbound http - ASA5510

mjacobsecaq — Thu, 09 Dec 2010 06:46:01 GMT

Thanks for your answer Jennifer.

I assumed this would be the case, but a 70% reduction in throughput just seemed a little high to me.

Thanks again,

Matt