Guest_imported
New member
- Jan 1, 1970
- 0
I have a newly-set-up ASA5505 that (thankfully!!) replaced our old Linksys with DD-WRT. Loving the stability and the fact it can actually handle the load from our 25 workstations without crashing.
However, I've noticed that pings from outside to the outside interface as well as pings from the inside to an outside IP seem to have a good bit more latency now, even when the network connection (6m/6m) is virtually idle.
Even pinging the router our ISP has put on our side of the DSL connection (for connection monitoring/PPPoE authentication) results in far-higher-than-expected latency.
Our setup is this:
[Internal Network] -- [ASA5505] -- [ISP-provided Cisco 891] -- [G.SHDSL connection] -- [Internet]
When I had the Linksys installed (and it wasn't overloaded), I could ping that Cisco 891 and get response times of 1-2ms. The first router on the far side of the DSL connection was consistently 8-10ms. Pings to seattle.voip.ms, our long-distance provider, were almost perfectly consistently 37ms. (Pretty good latency from Alaska, which is why I chose them!)
Now, after installing the ASA, even with virtually 0 network load, pinging the Cisco 891 results in pings anywhere from 20 to 80ms (average of 40). That's over a 100mbps link and about three feet of Ethernet cable. Pings to the first hop on the other side of the DSL connection range anywhere from 10ms (?!) to 700ms (average of 180). Pings to seattle.voip.ms are 80 to 1350ms (average 570).
Pings to the ASA's inside interface are sub-1ms, so it's nothing on the inside network.
The reading that I've been doing online (i.e indicates the ASA should add negligible latency, but that seems like it's not the case. I don't have (as far as I know, unless I've screwed the config up!) a super-complicated firewall ruleset, and the ASA's CPU and memory usage is sitting constant (regardless of load) at 10% and 212 (out of 512MB), respectively. I can't think of any reason why so much latency would be added unless I've inadvertently set up some weirdness in the config that's delaying packets.
Also, I'll take this opportunity to mention that I found the thread at very helpful (which is how I found this forum--holy cow, a technical forum with people who are friendly and helpful?!). That's actually what caused me to check the ping--the voice quality still seemed to experience some drop-outs even when the connection was nearly idle.
I know it's a separate topic, but given the ASA's limited QoS capabilities as outlined in that thread, I may need a better solution. I have a couple of Cisco 1841s sitting on a shelf upstairs (got secondhand from a downsizing nonprofit). Would that be a useful/workable option? I assume I'd sit it inline between the ASA (which would perform NAT and firewall) and the ISP-provided Cisco 891, and it would do QoS by the DSCP markings (which the ASA doesn't change). Or would it be better to have the 1841 (assuming it can) do NAT and let the ASA focus solely on firewall protection? In any case, I just thought I'd bring this up in case it dovetails with the issue I'm having with the ASA and ping times.
I've also attached a (hopefully fully!) sanitized config to this post as well as a sample of the ping times to various points below. (I've done them as ping -f below, but I get similar--actually worse--results even without flooding.)
Thanks in advance!
--- [firewall inside interface] ping statistics ---
18954 packets transmitted, 18953 received, 0% packet loss, time 8838ms
rtt min/avg/max/mdev = 0.157/0.458/2.448/0.262 ms, ipg/ewma 0.466/0.451 ms
--- [Cisco 891, this side of the DSL connection] ping statistics ---
490 packets transmitted, 487 received, 0% packet loss, time 7121ms
rtt min/avg/max/mdev = 8.141/23.216/145.276/15.646 ms, pipe 10, ipg/ewma 14.563/24.758 ms
--- [ISP first hop] ping statistics ---
647 packets transmitted, 645 received, 0% packet loss, time 9796ms
rtt min/avg/max/mdev = 8.044/49.733/186.344/33.161 ms, pipe 11, ipg/ewma 15.165/30.324 ms
--- seattle.voip.ms ping statistics ---
760 packets transmitted, 752 received, 1% packet loss, time 11445ms
rtt min/avg/max/mdev = 50.130/87.995/204.962/31.396 ms, pipe 15, ipg/ewma 15.079/78.277 ms
However, I've noticed that pings from outside to the outside interface as well as pings from the inside to an outside IP seem to have a good bit more latency now, even when the network connection (6m/6m) is virtually idle.
Even pinging the router our ISP has put on our side of the DSL connection (for connection monitoring/PPPoE authentication) results in far-higher-than-expected latency.
Our setup is this:
[Internal Network] -- [ASA5505] -- [ISP-provided Cisco 891] -- [G.SHDSL connection] -- [Internet]
When I had the Linksys installed (and it wasn't overloaded), I could ping that Cisco 891 and get response times of 1-2ms. The first router on the far side of the DSL connection was consistently 8-10ms. Pings to seattle.voip.ms, our long-distance provider, were almost perfectly consistently 37ms. (Pretty good latency from Alaska, which is why I chose them!)
Now, after installing the ASA, even with virtually 0 network load, pinging the Cisco 891 results in pings anywhere from 20 to 80ms (average of 40). That's over a 100mbps link and about three feet of Ethernet cable. Pings to the first hop on the other side of the DSL connection range anywhere from 10ms (?!) to 700ms (average of 180). Pings to seattle.voip.ms are 80 to 1350ms (average 570).
Pings to the ASA's inside interface are sub-1ms, so it's nothing on the inside network.
The reading that I've been doing online (i.e indicates the ASA should add negligible latency, but that seems like it's not the case. I don't have (as far as I know, unless I've screwed the config up!) a super-complicated firewall ruleset, and the ASA's CPU and memory usage is sitting constant (regardless of load) at 10% and 212 (out of 512MB), respectively. I can't think of any reason why so much latency would be added unless I've inadvertently set up some weirdness in the config that's delaying packets.
Also, I'll take this opportunity to mention that I found the thread at very helpful (which is how I found this forum--holy cow, a technical forum with people who are friendly and helpful?!). That's actually what caused me to check the ping--the voice quality still seemed to experience some drop-outs even when the connection was nearly idle.
I know it's a separate topic, but given the ASA's limited QoS capabilities as outlined in that thread, I may need a better solution. I have a couple of Cisco 1841s sitting on a shelf upstairs (got secondhand from a downsizing nonprofit). Would that be a useful/workable option? I assume I'd sit it inline between the ASA (which would perform NAT and firewall) and the ISP-provided Cisco 891, and it would do QoS by the DSCP markings (which the ASA doesn't change). Or would it be better to have the 1841 (assuming it can) do NAT and let the ASA focus solely on firewall protection? In any case, I just thought I'd bring this up in case it dovetails with the issue I'm having with the ASA and ping times.
I've also attached a (hopefully fully!) sanitized config to this post as well as a sample of the ping times to various points below. (I've done them as ping -f below, but I get similar--actually worse--results even without flooding.)
Thanks in advance!
--- [firewall inside interface] ping statistics ---
18954 packets transmitted, 18953 received, 0% packet loss, time 8838ms
rtt min/avg/max/mdev = 0.157/0.458/2.448/0.262 ms, ipg/ewma 0.466/0.451 ms
--- [Cisco 891, this side of the DSL connection] ping statistics ---
490 packets transmitted, 487 received, 0% packet loss, time 7121ms
rtt min/avg/max/mdev = 8.141/23.216/145.276/15.646 ms, pipe 10, ipg/ewma 14.563/24.758 ms
--- [ISP first hop] ping statistics ---
647 packets transmitted, 645 received, 0% packet loss, time 9796ms
rtt min/avg/max/mdev = 8.044/49.733/186.344/33.161 ms, pipe 11, ipg/ewma 15.165/30.324 ms
--- seattle.voip.ms ping statistics ---
760 packets transmitted, 752 received, 1% packet loss, time 11445ms
rtt min/avg/max/mdev = 50.130/87.995/204.962/31.396 ms, pipe 15, ipg/ewma 15.079/78.277 ms
