up vote 0 down vote favorite
share [g+] share [fb]

(Cross posted from Super User per suggestion there)

At the office, I have inherited a network that I am still trying to fully comprehend. I have a problem today with a new connection between:

  • A port on a Cisco Catalyst 3750 [WS-C3750G-48TS-S running C3750-IPSERVICESK9-M version 12.2(53)SE1]
  • A port on a Cisco ASA 5505 [ASA Software version 8.3(2)]

The 3750 is home to a Vlan that has a few ports assigned to it.

interface Vlan3
 description Internal network (172.18.160.0/24)
 ip address 172.18.160.1 255.255.255.0

I have a host (outside of my control) that needs to be in this VLAN (i.e it must have an address 172.18.160.something/24) that also needs to access the Internet.

To accomplish this, I ran a link from the Catalyst (Gi1/0/13) to the ASA (Ethernet 0/5). I configured the Catalyst port like so:

interface GigabitEthernet1/0/13
 description To ASA, 172.18.160.69
 switchport access vlan 3
 switchport mode access
 speed 100
 duplex full

I configured the ASA like so:

interface Vlan1
 nameif inside
 security-level 100
 ip address 172.18.160.69 255.255.255.0

interface Ethernet0/5
 speed 100
 duplex full

Then I plugged the host into Ethernet 0/4 on the ASA and instructed its owner to make its default gateway 172.18.160.69. I made a NAT rule in the ASA and set up some rules, and it's able to access the Internet without issue.

However, I noticed that the Catalyst reports a ton of packets being dropped toward the ASA.

Catalyst3750#show interfaces GigabitEthernet 1/0/13 | include counters|drops
  Last clearing of "show interface" counters 00:28:13
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 136909347

This is a huge number of drops, since there's not much traffic on this VLAN at all.

I tried these things:

  • Make sure speed and duplex agree on both sides (100 Mbps / Full)
  • Set no cdp enable on the Catalyst Gi10/13
  • Set no keepalive on the Catalyst Gi10/13
  • Checked for excessive CPU usage on both
  • Checked for excessive traffic on both

Am I missing something? Any help would be appreciated.

link|improve this question
What do the counters and traffic rates look like? – Shane Madden Jul 27 '11 at 23:31
The ASA is the busiest in the VLAN- it's 134kbps in/502kbps out (from the Catalyst's perspective). The others are less than 5 kbps. None of the others have any drops recorded. – Bo102010 Jul 28 '11 at 0:13
Are the drops increasing? Those could be from a while back... – Kyle Brandt♦ Jul 28 '11 at 1:17
Yes, note above that I'd cleared counters 28 minutes before the snapshot. Clearing again shows another increase. – Bo102010 Jul 28 '11 at 12:13
There is something I dont quite understand.. why is the host (assuming a PC) connected to Eth0/4 on the ASA instead of into the 3750? – pauska Jul 28 '11 at 13:00
show 1 more comment
feedback

1 Answer

up vote 0 down vote

Consider checking the physical media and any possible interconnects for damage.

link|improve this answer
An excellent suggestion. I'll feel very sheepish if this fixes it. – Bo102010 Jul 28 '11 at 13:01
Nah... It happens. – user48838 Jul 28 '11 at 13:02
No luck from changing to a known good cable, unfortunately. – Bo102010 Jul 29 '11 at 23:13
You might have to consider looking closer at the hardware interfaces. Maybe by changing up the pairing with other equipment/interfaces for testing. – user48838 Jul 30 '11 at 1:03
OK, so it wasn't that. One of the hosts in the VLAN was sending some multicasts. How the math of the 136909347 packets / 28 minutes works out given the traffic levels I saw, I have no idea. But shutting up that host seems to have solved the problem – Bo102010 Jul 31 '11 at 6:18
show 1 more comment
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.