ASA5510 High Drop Packet Count on the Inside Interface

[pootboy69]

We have been experiencing some issues with occasional dropped connections to VPN clients. In investgating, we used the mtr utility to trace from inside out LAN to an external host. The first-hop packet loss (from the host to the ASA) seemed excessive, sometimes reaching 50%. The only thing between the host and the ASA is a gigabit switch. A ping flood from the same host to the same destinations show a 0% packet loss.

Looking at the inside interface, using the ASDM Interface Grapher for Drop Packet Count shows a nearly consistent 510-512 Kpackets lost.

What can cause thie? Can this be mitigated by reconfiguring the Interface from Auto/Auto to 1000/Full? Where do I begin finding the source of this packet drop, and is it real or some artifact of the ASA firmware?

[sean_evershed · Accepted solution]

I read somewhere that Cisco recommends that the connection between the switch and firewall should be  set to auto / auto.

Find below a troubleshooting guide for interface errors on the ASA:

https://supportforums.cisco.com/docs/DOC-12439

Ther inside switch is healthy with no errors?

Find below a troubleshooting guide for VPN problems. Check to see if there are any error logs on the client when their connection drops.

If the problem can be replicated check for error logs on the ASA as well.

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml

Please remember to rate helpful posts.

[pootboy69]

Thank you for your response!

I've investigated this, using many of the tools you suggested, and have come to the conclusion that it has to be the "mtr" utility that is the culprit. I get consistent relies to the inside interface and to the ASA default gateway of less than 1ms. The ASDM reports that cumulative packet loss over the last two days is less that 10. There have been no errors on the ASA inside interface reported since last Friday.

Regards,

Wolf

[sean_evershed]

Thanks Wolf for the feedback and for the rating.

Cheers

Sean