Cisco ASA inside interface CRC errors + input errors incrementing

[LovejitSingh130013]

Hello @balaji.bandi  @Rob Ingram    @Marvin Rhoads  @Mohammed al Baqari  @Richard Burts  @Aref Alsouqi   @Richard Burts  @Joseph W. Doherty  @Giuseppe Larosa 

I got Cisco ASA 5525 with Firepower services and got FMV VM to manage the Firepower services.  

I got 200 Mbps download and Upload and its a dedicated Circuited from Rogers.  

The issue is that I am not getting more than 50 Mbps Upload speed while getting 100% (upto 200 Mbps) download.  ISP said its something with our Firewall.

I worked Cisco TAC and we checked CPU usage for ASA and firepower which looks great and stable.

I checked Outside interface and did not see any errors etc. but when I checked internal inside interface i see CRC/input errors continuously incrementing. 

I checked same thing on switchport connected to it and there are no errors on it. 

I also checked that Duplex and speed settings are same and on Auto. and MTU is 1500. 

I changed the cable but it did not make any difference.

Can you guys advice what else should i do to find the root cause for these errors on inside interface?

Also what else can contribute in delaying upload speed on ASA?

Thanks 

[Rob Ingram]

@LovejitSingh130013 

How many CRC errors, a few or a lot?

What firepower features do you have enabled? Some features can impact performance quite dramatically.

TAC would be best placed to help you troubleshoot this, how did you leave it with them?

[LovejitSingh130013]

@Rob Ingram  

We got IPS+Malware+URL Filtering enabled.

Thanks,

[balaji.bandi]

first steps to confirm is you getting real bandwidth or not. Connect any device bypass FP and check are you really getting the mentioned bandwidth from ISP or not.

Then  coming back to FP, if you have IPS, you may see some performance issue, this required may have some tuning based on the deployment.

[Rob Ingram]

@LovejitSingh130013 

Re-run your tests without those features enabled and see if performance improves. Then go from there, adjust policies if required.

[cmarva]

can you port a "sho interface" for the inside interface?