FirePOWER add latency without any visible reason

[Oleg Volkov]

Hello!

I have ASA with FirePOWER (no AMP and URL). And have many (over 10) zones.

yesterday my SIP server sometimes  loss registration and vice also have poor quality.

I try to PING 8.8.8.8 and get floating delay from 25 to 500! ms.

i exclude sip server traffic from FirePOWER module and get delay about 23-25 ms.

I change active ASA (also with FirePOWER) and first time after, delay was be normal, but not long time. How I can understand what traffic make FirePOWER unusable?

PS:

I do not have high traffic, but have many connection from outside to my WEB (https) server.

[Marvin Rhoads]

What version are you running? There is a bug with 6.3 that can affect observed icmp latencies.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvo80715

[Oleg Volkov]

Hi.

6.3 and now 6.3.13.

I have delay not only ICMP. SIP and DNS also delayed.

In bug reference I see workaround - disable hardware ssl acceleration but I do not use decryption.

What method of diagnostic you can recommended in case like this?

Thank you!

[Marvin Rhoads]

They turned on "enable by default" behavior in 6.3. That has an unanticipated negative impact - even though you are not using the feature.

The BugID only indicates icmp traffic is affected by the bug; but it may be that they didn't get any user reports of SIP and DNS traffic from users and thus haven't noted those are affected.

You can do ahead and disable it from the cli (reboot required for it to take effect).

And - yes - it is configured from the cli. It's one of the few features that is done that way with FTD.

[Oleg Volkov]

Sorry I provide wrong version:

ZES-ASA01/pri/act# sh module sfr

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
sfr FirePOWER Services Software Module ASA5515 FCH18217YHB

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
sfr f40f.1b76.d347 to f40f.1b76.d347 N/A N/A 6.2.3.13-53

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------
sfr ASA FirePOWER Up 6.2.3.13-53

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
sfr Up Up

And I think workaround is not applicable for me, sfr module not accepted commands:

system support ssl-hw-offload disableFTD

system support ssl-hw-force-offload-disable

[Marvin Rhoads]

Ah correct - sorry that command is for FTD only. You did say you are using ASA with Firepower service module.

Are you inspecting icmp, sip and dns in your ASA config? What is the ASA version (not Firepower version)?

[Oleg Volkov]

Cisco Adaptive Security Appliance Software Version 9.6(4)3

policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
inspect pptp
inspect icmp error
class IPS-CM
sfr fail-open

[Marvin Rhoads]

Everything appears in order with your config.

I'd suggest opening a TAC case for a more detailed look in real time.

[irshad.hirani]

Did we have a resolution to this? Oleg were you able to resolve this with TAC?

[Oleg Volkov]

No, we except part of traffic from FP and now latency is acceptable.

[BURKHARD LANDWEHR]

We have the same Problem with 6.6.1-91 and ASA 5555x any new ideas?

[Oleg Volkov]

After upgrade FP and except many traffic from it, we have no problem.