Re: [c-nsp] TAC hits a new record level of aggravation...

2014-02-01 Thread Pavel Skovajsa
Resurrecting this thread, Is any of you having issues uploading file attachments to TAC cases using the http java page? Somehow nobody in our org can upload anything - we have latest Firefox, latest Java from Sun, still after clicking the Submit button in the file upload window nothing happens.

Re: [c-nsp] TAC hits a new record level of aggravation...

2014-02-01 Thread Mike Hale
I was having weird issues but realized that it was because the file was too big. Not that there was an error message to that effect or anything. On Feb 1, 2014 6:59 AM, Pavel Skovajsa pavel.skova...@gmail.com wrote: Resurrecting this thread, Is any of you having issues uploading file

[c-nsp] ASA5520 latency OSPF drops

2014-02-01 Thread Adam Greene
Hi, We are having a problem with high latency and OSPF drops on an ASA5520. The portion of our network in question is connected as follows: Internal Network---3750---2950G---ASA5520---2950G---2921---External World The two 2950G's shown above are actually the same device; we are

Re: [c-nsp] TAC hits a new record level of aggravation...

2014-02-01 Thread Orr, Jeff B.
Yes, I have run into this over and over during this last week. I ended up emailing the files due to the issues. I also had problems with the HTTP upload as well. -jeff On Feb 1, 2014, at 9:54 AM, Pavel Skovajsa pavel.skova...@gmail.com wrote: Resurrecting this thread, Is any of you

Re: [c-nsp] TAC hits a new record level of aggravation...

2014-02-01 Thread Chris Marget
I tried two operating systems and four browsers yesterday. I couldn't upload files that were just a few hundred KB. /chris On Sat, Feb 1, 2014 at 9:54 AM, Pavel Skovajsa pavel.skova...@gmail.comwrote: Resurrecting this thread, Is any of you having issues uploading file attachments to TAC

Re: [c-nsp] ASA5520 latency OSPF drops

2014-02-01 Thread Nick Hilliard
On 01/02/2014 16:27, Adam Greene wrote: Every so often (it started three months ago, about once per month, now it's about once per week, but it's not regular), we're getting very high latency on pings from our Internal Network to the ASA5520, and the OSPF adjacency between the 3750 and the

Re: [c-nsp] TAC hits a new record level of aggravation...

2014-02-01 Thread Jeff Kell
Could we petition for an HTML 1.0, old-school, no-javascript, no Java apps, alternative TAC site? Then look at the usage statistics between the two? :) And bring back ftp.cisco.com :) Jeff On 2/1/2014 12:41 PM, Chris Marget wrote: I tried two operating systems and four browsers yesterday. I

Re: [c-nsp] ASA5520 latency OSPF drops

2014-02-01 Thread Octavio Alvarez
On 02/01/2014 08:27 AM, Adam Greene wrote: Every so often (it started three months ago, about once per month, now it's about once per week, but it's not regular), we're getting very high latency on pings from our Internal Network to the ASA5520, and the OSPF adjacency between the 3750 and the

Re: [c-nsp] TAC hits a new record level of aggravation...

2014-02-01 Thread Octavio Alvarez
On 02/01/2014 09:46 AM, Jeff Kell wrote: Could we petition for an HTML 1.0, old-school, no-javascript, no Java apps, alternative TAC site? Add an explicit no JavaScript to the mix and I sign. :) ___ cisco-nsp mailing list cisco-nsp@puck.nether.net

Re: [c-nsp] ASA5520 latency OSPF drops

2014-02-01 Thread Adam Greene
Nick, thanks. Connection count has not exceeded 31504 in the last 18 months, and the ASA 5520 supports up to 280,000 I believe. Unfortunately, have not yet found the right MIB to monitor CPU utilization, and the issue is sporadic, so it is hard to get cpu stats manually when it is happening. The

Re: [c-nsp] ASA5520 latency OSPF drops

2014-02-01 Thread Adam Greene
Octavio, What about pings from the external world to the ASA? These appear normal, since the ASA5520---2921 OSPF session is not dropping. Also, I'd increase logging verbosity to a Syslog server with an interface connected to each side of the ASA. Good idea. And I'd also be prepared to do a

Re: [c-nsp] ASA5520 latency OSPF drops

2014-02-01 Thread Nick Hilliard
On 01/02/2014 19:33, Adam Greene wrote: Unfortunately, have not yet found the right MIB to monitor CPU utilization, and the issue is sporadic, so it is hard to get cpu stats manually when it is happening. no need. Just monitor the packet count in and out of the box from the switch that it

Re: [c-nsp] ASA5520 latency OSPF drops

2014-02-01 Thread Nick Hilliard
On 01/02/2014 19:39, Adam Greene wrote: We generally have about 40Mbps pumping through the unit. it's the packet count that causes high cpu load, not the bps throughput. Nick ___ cisco-nsp mailing list cisco-nsp@puck.nether.net

Re: [c-nsp] ASA5520 latency OSPF drops

2014-02-01 Thread Alan Buxey
The ASA can be brought to its knees by small packets with not a very large PPS... its the ring buffer system it uses. Which brings to mind the current flavour du jour of ddos, that of NTP amplification. I'd do a span of your 2950G links to eg a Linux box with tcpdump and get a pretty picture

Re: [c-nsp] ASA5520 latency OSPF drops

2014-02-01 Thread Alan Buxey
and because it's wrong to make statements without documentation: http://geant3.archive.geant.net/service/edupert/Resources/Documents/Firewall_Performance_TIP2013.pdf that's a 'highend' 5585x dying with just 1Mpps Alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

Re: [c-nsp] ASA5520 latency OSPF drops

2014-02-01 Thread John Kougoulos
Hi, since you don't lose the OSPF session between 5520 and 2921, I would say that this is not related to ASA CPU, DoS from Internet etc. This would also suggest that 2950G in general works ok. The vlan that connects 3750 to 5520 exists only in 2950G and only these 2 devices are connected? Would

[c-nsp] Packet-level iSCSI debugging

2014-02-01 Thread Mike Hale
Evening all! We've having some ongoing weird iSCSI problems that we're trying to track down. Specifically, we're logging a huge amount of disconnects in our ESX hosts that connect to our EMC Clariion storage arrays. Our VMs are still running well despite this, but the sheer number of errors is

[c-nsp] Transparent WAN Encryption

2014-02-01 Thread Antonio Soares
Hello group, Service Provider WAN links are not secure anymore and I have more and more enterprise customer asking transparent WAN encryption solutions. I came across these two products: EncryptTight: http://www.blackbox.com/Store/Results.aspx/Networking/Security-Optimization/

[c-nsp] Cisco 6503 Sup2T Engine block outbound TCP or UDP Port traffic

2014-02-01 Thread Joseph Hardeman
Hi Everyone, I have a SUP2t engine running IOS s2t54-ADVIPSERVICESK9-M version and I am wondering if there is a way to filter or block TCP or UDP port traffic. I know how to NULL route IP 's but I don't know if there is a way to block or deny traffic based on destination port's also based on IP

Re: [c-nsp] Cisco 6503 Sup2T Engine block outbound TCP or UDP Port traffic

2014-02-01 Thread Dobbins, Roland
On Feb 2, 2014, at 11:28 AM, Joseph Hardeman jwharde...@gmail.com wrote: I know how to NULL route IP 's but I don't know if there is a way to block or deny traffic based on destination port's also based on IP ranges.