wzhang,
Thanks for the reply. I've taken a look at that and began a ~900MB download. I see about 6 log entries of dropped packets from the time the download starts until the time it stalls. Again, turning the ip inspect rule off results in faster downloads that don't stall.
My access lists include a static entry with a:
permit tcp any any established
and the ip inspect rule that is inspecting the following protocols:
ip inspect log drop-pkt
ip inspect max-incomplete high 20000000
ip inspect max-incomplete low 20000000
ip inspect one-minute high 10000000
ip inspect one-minute low 10000000
ip inspect udp idle-time 1800
ip inspect dns-timeout 7
ip inspect tcp idle-time 14400
ip inspect tcp max-incomplete host 100000 block-time 0
ip inspect name Firewall http
ip inspect name Firewall https
ip inspect name Firewall esmtp
ip inspect name Firewall dns
ip inspect name Firewall tcp
ip inspect name Firewall udp
ip inspect name Firewall isakmp
ip inspect name Firewall ntp
ip inspect name Firewall icmp
I typically get close to 1MB/s downloads with the ip inspect rule turned off. When I turn it on, my downloads typically start at around 800KB/s and will drop to almost nothing within a minute or so. If I cancel/resume the download it will begin fast again and then stall. I can continue to do this until the download completes, but it is frustrating.
I saw another post with someone having the same problem and they found that using CBAC with Windows 7 causes this, but did not say how to fix this or any more info. Can't find any more info supporting this. All PC's are Windows 7/Server 2008. IIRC, my server 2k3 machines download fine but I'd have to verify.
