ASA CPU Peaks

[maratkinson]

Two questions really.

Q1. What is a safe peak for a cluster (Active/Standby) pair of ASA 5520's?

During different times of the day, I can see major peaks that push the ASA cluster into the high 80's and low 90% utilization.

Q2. To combat these peaks, I've tried lowering the logging, turning off Inspections and even clustering rules so the list of ACL's is shorter for the ASA to run through for each lookup. None of these have made a measurable impact to CPU peaks. Any idea's what else I can do to save CPU time?

Thanks!

[smalkeric]

If you noticed the CPU utlization is high, follow these steps in order to troubleshoot:

Verify that the connection count in show xlate count is low.

Verify that the memory block is normal.

Issue the show memory detail command, and verify that the memory used by the PIX is normal utilization.

Verify that the counts in show processes cpu-hog and show processes memory are normal.

Any host present inside or outside the security appliance can generate the malicious or mass traffic that can be a broadcast/multicast traffic and cause the high CPU utilization. In order to resolve this issue, configure an access list to deny the traffic between the hosts (end to end) and check the usage.

Check the duplex and speed settings in PIX interfaces. The mismatch setting with the remote infterfaces can increase the CPU utilization.

[JORGE RODRIGUEZ]

In addition ..

Go through this check list

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a008009491c.shtml