IPS in ASA 5510 killing upload speed

[Jake Pratt]

I recently upgraded from a 20 Mb metro ethernet circuit to a 100 Mb connection.  My ASA 5510 is seriously throttling my upload speed.  I have narrowed it down to the IPS module.  If I stop sending traffic to the IPS, I get upload speeds between 50-85 Mbps.  If I start sending it through again, my upload speeds are between 3-7 Mbps.  In both cases, my download speeds range between 70-92 Mbps, so it's really only affecting my upload speeds.  Is there anything I can do to my IPS traffic, so I can still use my modules, and still take advantage of the huge upload speeds we pay for?

Here is some info from my ASA:

I am matching all traffic:

access-list traffic_for_ips extended permit ip any any

Here are my policy and class settings:

class-map inspection_default
match default-inspection-traffic
class-map botnet-DNS
match port udp eq domain
class-map ips_class_map
match access-list traffic_for_ips
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect ftp
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect skinny 
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp
  inspect dns preset_dns_map
class ips_class_map
  ips inline fail-open
policy-map botnet-policy
class botnet-DNS
  inspect dns dynamic-filter-snoop
!
service-policy global_policy global
service-policy botnet-policy interface Outside

If anyone has any ideas, I would love to hear them.  Thanks.

[Siddharth Chandrachud]

Hi Jake,

So it seems you opened a TAC case for this and it was the TAC engineer who provided you the bug id and the workaround.

This is the correct and recommended way in troubleshooting this issue.

Access to the service account gives you access to the bash shell.

A word of caution :  Making changes with the service account is something I would NOT recommend, unless TAC is assisting/recommeding with instructions. Serious issues in sensor behavior can happen if incorrect configuration is attempted from service account.

Sid Chandrachud

Cisco TAC - Security Team

[Jake Pratt]

A word of caution :  Making changes with the service account is something I would NOT recommend, unless TAC is assisting/recommeding with instructions. Serious issues in sensor behavior can happen if incorrect configuration is attempted from service account.

Thanks.  It WAS the Cisco TAC engineer that suggested making the change with the service account.  And it seems to have fixed the problem.  Thank you for the cautionary note.

[Aastha Chaudhary · Accepted solution]

Date Created: 13-MAY-2011 06:49 PM Created By: Chaudhary, Aastha(AACHAUDH,265429) Customer was experiencing slow upload speeds(3-7 MBPS) on IPS module in ASA 5510. Download speeds range between 70-92 Mbps

Used the workaround for bug id CSCsv69844 i.e. set the Regex Depth Setting to 800000(Please note that this workaround should only be used with TAC's recommendation and approval.)