cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

307
Views
0
Helpful
7
Replies
Enthusiast

FirePOWER add latency without any visible reason

Hello!

I have ASA with FirePOWER (no AMP and URL). And have many (over 10) zones.

yesterday my SIP server sometimes  loss registration and vice also have poor quality.

I try to PING 8.8.8.8 and get floating delay from 25 to 500! ms.

i exclude sip server traffic from FirePOWER module and get delay about 23-25 ms.

I change active ASA (also with FirePOWER) and first time after, delay was be normal, but not long time. How I can understand what traffic make FirePOWER unusable?

PS:

I do not have high traffic, but have many connection from outside to my WEB (https) server.

--------------------------------------------------------------------------

Helping seriously ill children, all together. All information about this, is posted on my blog
Everyone's tags (1)
7 REPLIES 7
Hall of Fame Master

Re: FirePOWER add latency without any visible reason

What version are you running? There is a bug with 6.3 that can affect observed icmp latencies.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvo80715

Enthusiast

Re: FirePOWER add latency without any visible reason

Hi.

6.3 and now 6.3.13.

I have delay not only ICMP. SIP and DNS also delayed.

In bug reference I see workaround - disable hardware ssl acceleration but I do not use decryption.

What method of diagnostic you can recommended in case like this?

Thank you!

--------------------------------------------------------------------------

Helping seriously ill children, all together. All information about this, is posted on my blog
Hall of Fame Master

Re: FirePOWER add latency without any visible reason

They turned on "enable by default" behavior in 6.3. That has an unanticipated negative impact - even though you are not using the feature.

The BugID only indicates icmp traffic is affected by the bug; but it may be that they didn't get any user reports of SIP and DNS traffic from users and thus haven't noted those are affected.

You can do ahead and disable it from the cli (reboot required for it to take effect).

And - yes - it is configured from the cli. It's one of the few features that is done that way with FTD.

Highlighted
Enthusiast

Re: FirePOWER add latency without any visible reason

Sorry I provide wrong version:

 

ZES-ASA01/pri/act# sh module sfr

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
sfr FirePOWER Services Software Module ASA5515 FCH18217YHB

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
sfr f40f.1b76.d347 to f40f.1b76.d347 N/A N/A 6.2.3.13-53

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------
sfr ASA FirePOWER Up 6.2.3.13-53

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
sfr Up Up

And I think workaround is not applicable for me, sfr module not accepted commands:

system support ssl-hw-offload disableFTD

system support ssl-hw-force-offload-disable

--------------------------------------------------------------------------

Helping seriously ill children, all together. All information about this, is posted on my blog
Hall of Fame Master

Re: FirePOWER add latency without any visible reason

Ah correct - sorry that command is for FTD only. You did say you are using ASA with Firepower service module.

Are you inspecting icmp, sip and dns in your ASA config? What is the ASA version (not Firepower version)?

Enthusiast

Re: FirePOWER add latency without any visible reason

Cisco Adaptive Security Appliance Software Version 9.6(4)3

policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
inspect pptp
inspect icmp error
class IPS-CM
sfr fail-open

--------------------------------------------------------------------------

Helping seriously ill children, all together. All information about this, is posted on my blog
Hall of Fame Master

Re: FirePOWER add latency without any visible reason

Everything appears in order with your config.

I'd suggest opening a TAC case for a more detailed look in real time.