4

I have noticed on Cisco ASA 5585 (SSP-20) interface error counter going up specially overrun but so far we haven't seen any production impact or issue, error rate is low so its not noticable but would like to track it down what could be the issue.

asa/pri/act# show int detail | b Internal-Data0/1
Interface Internal-Data0/1 "", is up, line protocol is up
  Hardware is i82599_xaui rev01, BW 10000 Mbps, DLY 10 usec
    (Full-duplex), (10000 Mbps)
    Input flow control is on, output flow control is off
    MAC address 0000.0001.0002, MTU not set
    IP address unassigned
    1647603170965 packets input, 997527140937135 bytes, 0 no buffer
    Received 864639959 broadcasts, 0 runts, 0 giants
    16931212 input errors, 0 CRC, 0 frame, 16931212 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops, 0 demux drops
    1384367635589 packets output, 843565440564127 bytes, 111 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 1 interface resets
    0 late collisions, 0 deferred
    0 output decode drops
    0 input reset drops, 0 output reset drops
    Queue Stats:
      RX[00]: 422029984108 packets, 255396173038299 bytes, 15836342 overrun
              Blocks free curr/low: 511/112
      RX[01]: 407016123288 packets, 245899431598039 bytes, 269316 overrun
              Blocks free curr/low: 511/168
      RX[02]: 413500421902 packets, 253352037908193 bytes, 566063 overrun
              Blocks free curr/low: 511/264
      RX[03]: 405056641781 packets, 242879498449889 bytes, 259491 overrun
                  Blocks free curr/low: 511/189
      TX[00]: 330190721654 packets, 199847247773742 bytes, 0 underruns
              Blocks free curr/low: 508/121
      TX[01]: 338943972803 packets, 207641035134472 bytes, 0 underruns
              Blocks free curr/low: 511/116
      TX[02]: 351032018606 packets, 213654237791772 bytes, 0 underruns
              Blocks free curr/low: 510/250
      TX[03]: 334102657656 packets, 196810495181007 bytes, 0 underruns
              Blocks free curr/low: 510/90
      TX[04]: 0 packets, 0 bytes, 0 underruns
              Blocks free curr/low: 511/511
              Used by GigabitEthernet0/5
      TX[05]: 4 packets, 528 bytes, 0 underruns
              Blocks free curr/low: 511/509
              Used by TenGigabitEthernet0/9
      TX[06]: 4 packets, 528 bytes, 0 underruns
              Blocks free curr/low: 511/510
              Used by TenGigabitEthernet0/8
      TX[07]: 30112705950 packets, 25621895258706 bytes, 111 underruns
              Blocks free curr/low: 511/0
              Used by GigabitEthernet0/6
      TX[08]: 21 packets, 1180 bytes, 0 underruns
              Blocks free curr/low: 511/510
              Used by GigabitEthernet0/7
  Topology Information:
    This interface, a SSP Embedded NIC Port, is connected
    with Internal-Data0/3, a SSP Switch Uplink Port.
  Control Point Interface States:
    Interface number is 3
    Interface config status is active
    Interface state is active

I did basic troubleshooting like cpu-hog etc but not seeing any massive hog etc.

currently max conn count is ~40k around and 400mbps traffic rate with 75kpps rate.

enter image description here

Interface error rate graph

enter image description here

  • Basically, you are running services that take too much time so that the input queue cannot be serviced with the amount of traffic it is receiving, and packets are dropped because the queue is full. The more services you run, the lower the actual throughput. This happens from time-to-time as traffic spikes, and it is only important if it is negatively affecting you, at which point you must upgrade or replace the device. – Ron Maupin Apr 9 at 13:34
  • I have updated my answer with troubleshooting information and graphs you can make yourself to see what is going on. – user36472 Apr 9 at 13:45
5

From Cisco tech note:

The ASA interface error counter "overrun" tracks the number of times that a packet was received on the network interface, but there was no available space in the interface FIFO queue to store the packet. Thus, the packet was dropped. The value of this counter can be seen with the show interface command.

3

Looks like you might have hit the limit of what your current setup with SSP20 is capable off. We've recently had the same issues, where according to the Cisco datasheet and online specifications, it shouldn't have hit the limit.

Cisco TAC on the other had advised us, that with the setup we had, the limit was 2 Gbit/s with full inspection, application control (AVC) and url/malware filtering. We could've upgraded our firewalls to SSP60, but comparing prices and service with the new Next Generation Firewalls, that would economically be a bad idea.

It ended up with us upgrading to NGFW 4120, which can do 10 Gbit/s full inspection with url and malware filtering.

The ASA5585X is a really great all round firewall, but it's old and that reflects a lot on the hardware it's based on.

I have been unable to find the document Cisco TAC sent us online, so i've uploaded the version they sent us to my own page, you can download it below. Here's a screen shot:

enter image description here

Another screenshot from Cisco Live 2015 and the material i have:

enter image description here

Download: http://mooo.dk/Cisco_ASA_Datasheet_2015.pdf

Here are a few screenshots from Cisco TAC troubleshooting and finding out what the problem was:

Interface peaking at 2 Gbit/s enter image description here

Interface error counter and show interface outside enter image description here

enter image description here

  • I'm using this firewall for basic ACL to isolate subnets, I am not using for any IPS/AVC or any kind of other feature. We have 30 users for any connect VPN, so question is how do I find out it reached to Max capacity because I'm not seeing it's even using 2gbps anywhere. Does 2 Gbps cap calculate by all interface bandwidth ? – Satish Apr 9 at 12:13
  • @Satish Sorry, i've edited my answer to assuming this could be the problem. Calculation is per interface or virtual group. – user36472 Apr 9 at 13:32
  • @Satish Your drop rate looks exactly how ours looked like. I would suggest opening a Cisco TAC case. I have added some screenshots from Cisco TAC troubleshooting session. – user36472 Apr 9 at 13:43
  • Thanks for details, tell me one thing in interface graph you posted that is one specific interface graph or aggregated graph of all interface? I really want to find out where i am hitting 2Gbps limit. We don't have TAC support for this specific device. – Satish Apr 9 at 15:56
  • @Satish Says on the picture. Interface Outside. Just above the graph. – user36472 Apr 9 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.