Security for a day

When calls come in about the Internet being slow, I normally take them with a pinch of salt. This time, a new Cisco ASA had been deployed to a site, so I was more inclined to investigate.

The complaints centred around http downloads being much slower before the ASA was deployed; In the case of FTP downloads, they were dropping out completely.

The rules and configuration were fine and the traffic throughput was at steady 10mb a second on the ASA. I had a flash back to my old CCNA training, so ran through the basic checks.

The simple show interface command to display information on each interface immediately displayed a problem. The internal interface had a massive amount of input errors and CRC’s

Ciscoasa# show interface

—-Snip—–

173687355 packets input, 58611585574 bytes, 0 no buffer

Received 892529 broadcasts, 0 runts, 0 giants

3301144 input errors, 3301144 CRC, 0 frame, 0 overrun, 0 ignored, 0

—-Snip—–

Now that’s a problem.

Both interfaces on the ASA had been set to speed 100, duplex full. A quick check on the switch connected to the internal ASA interface showed it was set to auto negotiate. By flipping the ASA’s interface to auto negotiate, the errors stopped dead.

Checked back with the users and the downloads were back to the normal 250kb/sec.

Sometimes, users can be useful for troubleshooting ….