ASA 5508-X FirePOWER performance issue

[Daniel Leonard]

Hi all,

At customer site we've a HA set of 2x ASA5508-X with Firepower. The ASA has releases 9.8.3 (16) and FirePOWER 6.2.3.7 (51).The internet connection is a 100/100 Mbit connection.

When we activate the SFR module (in service policy rules), the download speed drops significantly from 100Mbit to approx 40Mbit. The upload speed does not seem to have any problems with this and has achieved the right speed. We test this through speedtest.net.

According to the datasheet, this ASA in combination with firepower should be able to easily achieve the 100/100 Mbit. 

The firepower configuration is simple and arranged on IPS.

Anyone have an idea?

Kind Regards

Daniel

[Mohammed al Baqari]

I am not sure what features are enabled on your FP but mainly check if File
Policy is used, IPS Signatures (you should use recommendation instead of
turning on all signatures), and SSL interception.

These are the main factors that drop the performance.