Zabbix is pinging devices via asa 5505 with 33% loss

[dijix1990]

We placed our devices behind our asa 5505 and after it I noticed that zabbix is pinging every devices behind the asa with loss where is the problem? Asa can't skip icmp without loss?

[Flavio Miranda]

Hi

 Try to enable icmp inspection,  if not yet.

[dijix1990]

I didn't have it, but it didn't help

policy-map global_policy
class netflow-export-class
class inspection_default
inspect icmp

icmp permit any interface_switch

maybe the asa is dropping 1 out of 3 packets from zabbix because of the policy rate in default mode? there is very simple config for 100 devices, just permit icmp from zabbix to devices and permit snmp from zabbix to devices.
On the asa about 3000 conn

[Kasun Bandara]

@dijix1990 hi, check firewall logs and make sure its dropped by firewall. if not this can be different issue like asymmetric routing, 

[dijix1990]

Hi, I have already watched and there was nothing. There are no drops at all.

1. Zabbix has ip 172.18.200.200 and is pinging devices which were placed in network 172.18.210./24 every 15 seconds

2. asa has ip 172.18.200.1 (vlan 100) and 172.18.210.1 (vlan200)

3.Zabbix can reach net 172.18.210.0/24 via 172.18.200.1

4. devices have default gateway as 172.18.210.1

When I move gw 172.18.200.1 and 172.18.210.1 to isr819 ping check becames perfect, I tested it for a day, there were no drops.

So it isn't asymmetric routing too

[Kasun Bandara]

@dijix1990 hi, in that case we can suspect ASA. are you with latest recommended OS for ASA?

[dijix1990]

Yes. I installed this software asa924-33-k8.bin

[Kasun Bandara]

@dijix1990 can you try enable debugging and share the output for specific flow?

[dijix1990]

To be honest no, but I will try today

[dijix1990]

Just start debug icmp trace?

[dijix1990]

hm it happens every 15 minutes