Htydjtk

I have noticed on Cisco ASA 5585 (SSP-20) interface error counter going up specially overrun but so far we haven't seen any production impact or issue, error rate is low so its not noticable but would like to track it down what could be the issue.

asa/pri/act# show int detail | b Internal-Data0/1

Interface Internal-Data0/1 "", is up, line protocol is up

  Hardware is i82599_xaui rev01, BW 10000 Mbps, DLY 10 usec

    (Full-duplex), (10000 Mbps)

    Input flow control is on, output flow control is off

    MAC address 0000.0001.0002, MTU not set

    IP address unassigned

    1647603170965 packets input, 997527140937135 bytes, 0 no buffer

    Received 864639959 broadcasts, 0 runts, 0 giants

    16931212 input errors, 0 CRC, 0 frame, 16931212 overrun, 0 ignored, 0 abort

    0 pause input, 0 resume input

    0 L2 decode drops, 0 demux drops

    1384367635589 packets output, 843565440564127 bytes, 111 underruns

    0 pause output, 0 resume output

    0 output errors, 0 collisions, 1 interface resets

    0 late collisions, 0 deferred

    0 output decode drops

    0 input reset drops, 0 output reset drops

    Queue Stats:

      RX[00]: 422029984108 packets, 255396173038299 bytes, 15836342 overrun

              Blocks free curr/low: 511/112

      RX[01]: 407016123288 packets, 245899431598039 bytes, 269316 overrun

              Blocks free curr/low: 511/168

      RX[02]: 413500421902 packets, 253352037908193 bytes, 566063 overrun

              Blocks free curr/low: 511/264

      RX[03]: 405056641781 packets, 242879498449889 bytes, 259491 overrun

                  Blocks free curr/low: 511/189

      TX[00]: 330190721654 packets, 199847247773742 bytes, 0 underruns

              Blocks free curr/low: 508/121

      TX[01]: 338943972803 packets, 207641035134472 bytes, 0 underruns

              Blocks free curr/low: 511/116

      TX[02]: 351032018606 packets, 213654237791772 bytes, 0 underruns

              Blocks free curr/low: 510/250

      TX[03]: 334102657656 packets, 196810495181007 bytes, 0 underruns

              Blocks free curr/low: 510/90

      TX[04]: 0 packets, 0 bytes, 0 underruns

              Blocks free curr/low: 511/511

              Used by GigabitEthernet0/5

      TX[05]: 4 packets, 528 bytes, 0 underruns

              Blocks free curr/low: 511/509

              Used by TenGigabitEthernet0/9

      TX[06]: 4 packets, 528 bytes, 0 underruns

              Blocks free curr/low: 511/510

              Used by TenGigabitEthernet0/8

      TX[07]: 30112705950 packets, 25621895258706 bytes, 111 underruns

              Blocks free curr/low: 511/0

              Used by GigabitEthernet0/6

      TX[08]: 21 packets, 1180 bytes, 0 underruns

              Blocks free curr/low: 511/510

              Used by GigabitEthernet0/7

  Topology Information:

    This interface, a SSP Embedded NIC Port, is connected

    with Internal-Data0/3, a SSP Switch Uplink Port.

  Control Point Interface States:

    Interface number is 3

    Interface config status is active

    Interface state is active

I did basic troubleshooting like cpu-hog etc but not seeing any massive hog etc.

currently max conn count is ~40k around and 400mbps traffic rate with 75kpps rate.

Interface error rate graph

From Cisco tech note:

The ASA interface error counter "overrun" tracks the number of times
that a packet was received on the network interface, but there was no
available space in the interface FIFO queue to store the packet. Thus,
the packet was dropped. The value of this counter can be seen with the
show interface command.

Looks like you might have hit the limit of what your current setup with SSP20 is capable off. We've recently had the same issues, where according to the Cisco datasheet and online specifications, it shouldn't have hit the limit.

Cisco TAC on the other had advised us, that with the setup we had, the limit was 2 Gbit/s with full inspection, application control (AVC) and url/malware filtering. We could've upgraded our firewalls to SSP60, but comparing prices and service with the new Next Generation Firewalls, that would economically be a bad idea.

It ended up with us upgrading to NGFW 4120, which can do 10 Gbit/s full inspection with url and malware filtering.

The ASA5585X is a really great all round firewall, but it's old and that reflects a lot on the hardware it's based on.

I have been unable to find the document Cisco TAC sent us online, so i've uploaded the version they sent us to my own page, you can download it below. Here's a screen shot:

Another screenshot from Cisco Live 2015 and the material i have:

Download: http://mooo.dk/Cisco_ASA_Datasheet_2015.pdf

Here are a few screenshots from Cisco TAC troubleshooting and finding out what the problem was:

Interface peaking at 2 Gbit/s

Interface error counter and show interface outside