Download speeds VERY slow, upload speeds OK, ASA 5510

aubreyekstrom · ‎08-15-2013

I just started a new job on Monday. We have a small network behind an ASA 5510 firewall, that was working just fine last week (I am told by everyone, including my IT co-workers), but suddenly on my first day downloads got VERY slow, while Uploads remain normal speeds (no one is blaming me, but since I know networking and Cisco better than anyone, they are ALL looking to me). By slow I mean 4-12 Mbps, when we are paying for a 100Mbps async connection. Upload speeds are OK in the 45-80Mbps range. My IT co-workers say they have run speed tests in the past from their desktops and got over 100Mbps both down and up.

The company works with film and TV, and so needs fast upload and download to deal with latge video files on a regular basis.

Troubleshooting so far:

When I plug directly into the ISPs router, both downloads and uploads are blazing fast at well over the 100Mbps bandwidth we pay for.

Transfering large files (4-8GB) between desktops and servers, also very fast.

Checked switches, spanning tree is running on all switches. No errors on ports.

When I plug directly into ASA after reconfiguring one of the empty ports... almost as slow as from the desktop (got as slow as 5Mbps, but also got as "fast" as 24Mbps).

Was not sure what to make of some captures I did, but nothing jumped out at me (could use some help with what to setup for a capture and how read the results better. Lot's of Acks).

So far it seems to have been narrowed down to the ASA.

Here are some other out puts:

fxfw1# sh ver

Cisco Adaptive Security Appliance Software Version 8.0(3)

Device Manager Version 6.0(3)

Compiled on Tue 06-Nov-07 22:59 by builders

System image file is "disk0:/asa803-k8.bin"

Config file at boot was "startup-config"

fxfw1 up 19 hours 45 mins

Hardware: ASA5510, 256 MB RAM, CPU Pentium 4 Celeron 1600 MHz

Internal ATA Compact Flash, 256MB

BIOS Flash M50FW080 @ 0xffe00000, 1024KB

Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)

Boot microcode : CN1000-MC-BOOT-2.00

SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.01

IPSec microcode : CNlite-MC-IPSECm-MAIN-2.04

____________________________________________________________________________________________

fxfw1# sh run

: Saved

:

ASA Version 8.0(3)

!

hostname fxfw1

domain-name XXXXXX.com

enable password FPeRsbfFLkU9y6iZ encrypted

names

name 192.168.50.0 POOL50

name XXX.XXX.XXX.115 webserv-Ext

name 192.168.5.25 webserver-int

dns-guard

!

interface Ethernet0/0

nameif outside

security-level 0

ip address webserv-Ext 255.255.255.248

ospf cost 10

!

interface Ethernet0/1

nameif DMZ

security-level 50

ip address 192.168.10.1 255.255.255.0

ospf cost 10

!

interface Ethernet0/2

nameif inside

security-level 100

ip address 192.168.5.1 255.255.252.0

ospf cost 10

!

interface Ethernet0/3

nameif Clear

security-level 0

ip address dhcp setroute

ospf cost 10

!

interface Management0/0

nameif management

security-level 100

ip address 10.0.1.1 255.255.255.0

ospf cost 10

management-only

!

passwd 2KFQnbNIdI.2KYOU encrypted

regex urllist1 ".*\.([Ee][Xx][Ee]) HTTP/1.[01]"

regex antispyware-loadadv.exe_bad_ip "204.152.184.139"

regex applicationheader "application/.*"

regex contenttype "Content-Type"

boot system disk0:/asa803-k8.bin

boot system disk0:/asa712-k8.bin

ftp mode passive

clock timezone EST -5

clock summer-time EDT recurring

dns domain-lookup outside

dns domain-lookup inside

dns domain-lookup Clear

dns server-group DefaultDNS

name-server 192.168.5.12

name-server 192.168.5.111

domain-name XXXXXX.com

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object-group icmp-type all_icmp

icmp-object alternate-address

icmp-object conversion-error

icmp-object echo

icmp-object echo-reply

icmp-object information-reply

icmp-object information-request

icmp-object mask-reply

icmp-object mask-request

icmp-object mobile-redirect

icmp-object parameter-problem

icmp-object redirect

icmp-object router-advertisement

icmp-object router-solicitation

icmp-object source-quench

icmp-object time-exceeded

icmp-object timestamp-reply

icmp-object timestamp-request

icmp-object traceroute

icmp-object unreachable

object-group service 4D tcp

port-object eq 19813

object-group service 4d

service-object tcp eq 19813

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

object-group service fasp udp

description Aspera fasp port

port-object eq 33001

object-group service RDP tcp

description Remote Desktop Port

port-object eq 3389

object-group service asterisk

service-object tcp-udp eq sip

service-object udp range 10000 20000

service-object udp eq 2727

service-object udp eq 4569

service-object udp eq 5036

service-object tcp-udp eq 5090

object-group service IPkall udp

port-object eq 4569

object-group service UltimaGame tcp

port-object eq 2593

object-group service DM_INLINE_SERVICE_1

service-object tcp-udp eq www

service-object tcp eq https

object-group service SQLServer tcp

port-object eq 1433

port-object eq 1434

port-object eq 1954

object-group service SQLServerBrowser udp

port-object eq 1434

object-group service FLEXLM tcp

port-object range 27000 27009

port-object eq 1087

object-group service WingFTPAdmin tcp

port-object eq 5466

object-group service ReelSmartLic tcp

port-object eq 9412

access-list outside_access_in extended permit tcp any host webserv-Ext eq www

access-list outside_access_in extended permit icmp any host webserv-Ext object-group all_icmp inactive

access-list inside_nat0_outbound extended permit ip 192.168.4.0 255.255.252.0 192.168.76.0 255.255.255.0 log

access-list inside_nat0_outbound extended permit ip 192.168.4.0 255.255.252.0 POOL50 255.255.255.0

access-list outside_1_cryptomap extended permit ip 192.168.4.0 255.255.252.0 192.168.76.0 255.255.255.0

access-list Local_LAN_Access standard permit 192.168.4.0 255.255.252.0

access-list CSC extended permit tcp any any eq www inactive

access-list CSC extended permit tcp any any eq ftp inactive

access-list CSC extended permit tcp any any eq smtp

access-list CSC extended permit tcp any any eq pop3

access-list gravityipsec2_splitTunnelAcl standard permit any

access-list inside_mpc extended permit object-group DM_INLINE_SERVICE_1 192.168.4.0 255.255.252.0 any

access-list Clear_access_in extended permit icmp any any

access-list inside_mpc_1 extended permit object-group TCPUDP any any eq www

pager lines 24

logging enable

logging buffer-size 8192

logging buffered debugging

logging asdm notifications

logging from-address fxfw1@XXXXXX.com

logging recipient-address techs@XXXXXX.com level errors

mtu outside 1500

mtu DMZ 1500

mtu inside 1500

mtu Clear 1500

mtu management 1500

ip local pool VPNPool 192.168.7.200-192.168.7.210 mask 255.255.252.0

ip local pool Pool50 192.168.50.100-192.168.50.110 mask 255.255.255.0

ip verify reverse-path interface DMZ

icmp unreachable rate-limit 1 burst-size 1

icmp permit any outside

icmp permit any inside

asdm image disk0:/asdm-603.bin

asdm history enable

arp timeout 14400

nat-control

global (outside) 200 interface

global (DMZ) 200 192.168.10.50-192.168.10.60

global (inside) 200 interface

global (Clear) 200 interface

nat (outside) 200 192.168.4.0 255.255.252.0

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 200 192.168.4.0 255.255.252.0

nat (Clear) 200 192.168.4.0 255.255.252.0

static (inside,outside) tcp interface www webserver-int www netmask 255.255.255.255

access-group outside_access_in in interface outside

access-group Clear_access_in in interface Clear

route outside 0.0.0.0 0.0.0.0 XXX.XXX.XXX.113 1

route Clear 0.0.0.0 0.0.0.0 192.168.15.5 2

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy

webvpn

url-list none

aaa-server intLDAP protocol ldap

aaa-server intLDAP host 192.168.5.112

timeout 5

ldap-scope onelevel

server-type auto-detect

aaa authentication ssh console LOCAL

aaa local authentication attempts max-fail 5

http server enable

http 192.168.7.167 255.255.255.255 inside

http 192.168.7.230 255.255.255.255 inside

http 192.168.7.154 255.255.255.255 inside

http 192.168.5.181 255.255.255.255 inside

http 10.0.1.0 255.255.255.0 management

http 192.168.5.187 255.255.255.255 inside

http 192.168.5.163 255.255.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 1 match address outside_1_cryptomap

crypto map outside_map 1 set peer XXX.XXX.XXX.162

crypto map outside_map 1 set transform-set ESP-AES-128-SHA

crypto map outside_map 1 set security-association lifetime seconds 2147482800

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map inside_map interface inside

crypto ca trustpoint ASDM_TrustPoint0

enrollment terminal

crl configure

crypto ca trustpoint ASDM_TrustPoint1

enrollment self

fqdn fxfw1

subject-name CN=fxfw1.XXXXXX.com

keypair sslvpnkeypair

no client-types

crl configure

crypto ca certificate chain ASDM_TrustPoint1

certificate 31

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

quit

crypto isakmp identity address

crypto isakmp enable outside

crypto isakmp enable inside

crypto isakmp policy 10

authentication pre-share

encryption aes

hash sha

group 1

lifetime none

crypto isakmp policy 30

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp ipsec-over-tcp port 10000

client-update enable

no vpn-addr-assign aaa

no vpn-addr-assign dhcp

vpn-addr-assign local reuse-delay 5

telnet 192.168.5.163 255.255.255.255 inside

telnet 192.168.5.83 255.255.255.255 inside

telnet 192.168.5.181 255.255.255.255 inside

telnet timeout 5

ssh 192.168.5.163 255.255.255.255 inside

ssh 192.168.5.83 255.255.255.255 inside

ssh 192.168.7.167 255.255.255.255 inside

ssh 192.168.7.230 255.255.255.255 inside

ssh timeout 5

console timeout 0

management-access management

dhcp-client client-id interface Clear

dhcpd dns 192.168.5.12 192.168.5.111

dhcpd domain XXXXXX.com

!

threat-detection basic-threat

threat-detection statistics host

threat-detection statistics port

threat-detection statistics protocol

no threat-detection statistics access-list

ssl trust-point ASDM_TrustPoint1 outside

webvpn

enable outside

enable inside

svc image disk0:/anyconnect-win-2.1.0148-k9.pkg 1 regex "Windows NT"

svc image disk0:/anyconnect-linux-2.1.0148-k9.pkg 2

svc image disk0:/anyconnect-macosx-i386-2.1.0148-k9.pkg 3

svc image disk0:/anyconnect-macosx-powerpc-2.1.0148-k9.pkg 4

svc enable

tunnel-group-list enable

group-policy sslanywherepolicy internal

group-policy sslanywherepolicy attributes

vpn-tunnel-protocol svc

address-pools value VPNPool

group-policy DfltGrpPolicy attributes

dns-server value 192.168.5.12

vpn-tunnel-protocol IPSec svc

split-tunnel-policy tunnelspecified

split-tunnel-network-list value Local_LAN_Access

default-domain value XXXXXX.com

group-policy XXXXXXnewipsec internal

group-policy XXXXXXnewipsec attributes

dns-server value 192.168.5.12 192.168.5.111

vpn-tunnel-protocol IPSec svc

split-tunnel-policy tunnelall

split-tunnel-network-list value Local_LAN_Access

default-domain value XXXXXX.com

group-policy anywheregroup2 internal

group-policy anywheregroup2 attributes

dns-server value 192.168.5.12 192.168.5.111

vpn-tunnel-protocol IPSec svc

default-domain value XXXXXX.com

service-type remote-access

tunnel-group DefaultL2LGroup ipsec-attributes

pre-shared-key *

peer-id-validate nocheck

isakmp keepalive threshold infinite

tunnel-group DefaultRAGroup webvpn-attributes

group-alias defaultRA disable

tunnel-group 64.246.81.162 type ipsec-l2l

tunnel-group 64.246.81.162 ipsec-attributes

pre-shared-key *

peer-id-validate nocheck

isakmp keepalive threshold infinite

tunnel-group anywheregroup2 type remote-access

tunnel-group anywheregroup2 general-attributes

address-pool Pool50

default-group-policy anywheregroup2

tunnel-group anywheregroup2 webvpn-attributes

group-alias anywheregroup2 enable

tunnel-group anywheregroup2 ipsec-attributes

pre-shared-key *

tunnel-group XXXXXXnewipsec type remote-access

tunnel-group XXXXXXnewipsec general-attributes

address-pool Pool50

default-group-policy XXXXXXnewipsec

tunnel-group XXXXXXnewipsec webvpn-attributes

group-alias XXXXXXSSL disable

tunnel-group XXXXXXnewipsec ipsec-attributes

pre-shared-key *

!

class-map CSC_CLASS

match access-list CSC

class-map type regex match-any DomainBlockList

match regex antispyware-loadadv.exe_bad_ip

class-map type inspect http match-all BlockDomainsClass

match request header host regex class DomainBlockList

class-map inside-class

match access-list inside_mpc

class-map type regex match-any URLBlockList

match regex urllist1

class-map inspection_default

match default-inspection-traffic

class-map type inspect http match-all AppHeaderClass

match request header regex contenttype regex applicationheader

class-map httptraffic

match access-list inside_mpc_1

class-map type inspect http match-all BlockURLsClass

match request uri regex class URLBlockList

!

policy-map type inspect http http_inspection_policy

parameters

protocol-violation action drop-connection

match request method connect

drop-connection log

class AppHeaderClass

drop-connection log

class BlockDomainsClass

reset log

class BlockURLsClass

reset log

policy-map type inspect dns migrated_dns_map_1

parameters

policy-map global_policy

class inspection_default

inspect dns migrated_dns_map_1

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect icmp

inspect pptp

inspect ftp

class CSC_CLASS

csc fail-open

policy-map inside-policy

class inside-class

inspect http

class httptraffic

inspect http http_inspection_policy

!

service-policy global_policy global

service-policy inside-policy interface inside

smtp-server XXX.XXX.XXX.178

prompt hostname context

Cryptochecksum:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

: end

____________________________________________________________________________________________

fxfw1# sh asp drop

Frame drop:

Invalid encapsulation 819

Invalid IP header 4

Flow is denied by configured rule 173180

First TCP packet not SYN 6635

Bad TCP flags 1

TCP data exceeded MSS 35

TCP failed 3 way handshake 380

TCP RST/FIN out of order 2307

TCP SEQ in SYN/SYNACK invalid 14

TCP SYNACK on established conn 11

TCP packet SEQ past window 108

TCP Out-of-0rder packet buffer full 182227

TCP Out-of-Order packet buffer timeout 30264

TCP RST/SYN in window 2

TCP DUP and has been ACKed 870308

TCP packet failed PAWS test 38

Slowpath security checks failed 151

DNS Inspect id not matched 4

FP L2 rule drop 184

Interface is down 574

Dropped pending packets in a closed socket 197

Flow drop:

NAT failed 14256

NAT reverse path failed 24

Inspection failure 16

SSL bad record detected 27

SSL received close alert 2

______________________________________________________________________________________

fxfw1# sh int | inc error