ASA 5555x with firepower - 9.14 latest interim
SFR modules and FPMCv at 6.4 latest interim
Suddenly on a Monday morning at 8am, latency through our ASA 5555x firewall spiked from its usual <10ms to over 3000ms and started dropping packets. Voice calls failed. We started getting alerts from systems we monitored, and internet connectivity was slow to nonexistent. This is when most of our users log in, connection rates go up to 100-200/s total connections go from about 8000 to 20000. We had not made any recent changes other than upgrading some anyconnect clients to 5.1 version.
Now, the problem happens every monday at 8am, and calms down by about 9am. And also happens a little less at 8am every work day. It happend on a tuesday at 8am when we were closed on monday, so its certainly correlated to increased internal traffic going out.
To try and resolve we made sure we were on latest fixes (firepower pending), looked for DDOS, shunned some internal IPs tripping threat detection rates, but nothing has worked except bypassing the firepower module entirely. So, we think the issue is thus with the firepower module, or the config, but since nothing changed, we cant find the reason.
Where should I look to try and get more information on whats going on?
