04-27-2011 08:41 AM - edited 03-10-2019 05:20 AM
I recently upgraded from a 20 Mb metro ethernet circuit to a 100 Mb connection. My ASA 5510 is seriously throttling my upload speed. I have narrowed it down to the IPS module. If I stop sending traffic to the IPS, I get upload speeds between 50-85 Mbps. If I start sending it through again, my upload speeds are between 3-7 Mbps. In both cases, my download speeds range between 70-92 Mbps, so it's really only affecting my upload speeds. Is there anything I can do to my IPS traffic, so I can still use my modules, and still take advantage of the huge upload speeds we pay for?
Here is some info from my ASA:
I am matching all traffic:
access-list traffic_for_ips extended permit ip any any
Here are my policy and class settings:
class-map inspection_default
match default-inspection-traffic
class-map botnet-DNS
match port udp eq domain
class-map ips_class_map
match access-list traffic_for_ips
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect dns preset_dns_map
class ips_class_map
ips inline fail-open
policy-map botnet-policy
class botnet-DNS
inspect dns dynamic-filter-snoop
!
service-policy global_policy global
service-policy botnet-policy interface Outside
If anyone has any ideas, I would love to hear them. Thanks.
Solved! Go to Solution.
05-10-2011 11:29 AM
Hi Jake,
So it seems you opened a TAC case for this and it was the TAC engineer who provided you the bug id and the workaround.
This is the correct and recommended way in troubleshooting this issue.
Access to the service account gives you access to the bash shell.
A word of caution : Making changes with the service account is something I would NOT recommend, unless TAC is assisting/recommeding with instructions. Serious issues in sensor behavior can happen if incorrect configuration is attempted from service account.
Sid Chandrachud
Cisco TAC - Security Team
05-10-2011 11:49 AM
A word of caution : Making changes with the service account is something I would NOT recommend, unless TAC is assisting/recommeding with instructions. Serious issues in sensor behavior can happen if incorrect configuration is attempted from service account.
Thanks. It WAS the Cisco TAC engineer that suggested making the change with the service account. And it seems to have fixed the problem. Thank you for the cautionary note.
05-13-2011 11:53 AM
Date Created: 13-MAY-2011 06:49 PM Created By: Chaudhary, Aastha(AACHAUDH,265429) Customer was experiencing slow upload speeds(3-7 MBPS) on IPS module in ASA 5510. Download speeds range between 70-92 Mbps
Used the workaround for bug id CSCsv69844 i.e. set the Regex Depth Setting to 800000(Please note that this workaround should only be used with TAC's recommendation and approval.)
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide