(Cross posted from Super User per suggestion there)

At the office, I have inherited a network that I am still trying to fully comprehend. I have a problem today with a new connection between:

  • A port on a Cisco Catalyst 3750 [WS-C3750G-48TS-S running C3750-IPSERVICESK9-M version 12.2(53)SE1]
  • A port on a Cisco ASA 5505 [ASA Software version 8.3(2)]

The 3750 is home to a Vlan that has a few ports assigned to it.

interface Vlan3
 description Internal network (
 ip address

I have a host (outside of my control) that needs to be in this VLAN (i.e it must have an address 172.18.160.something/24) that also needs to access the Internet.

To accomplish this, I ran a link from the Catalyst (Gi1/0/13) to the ASA (Ethernet 0/5). I configured the Catalyst port like so:

interface GigabitEthernet1/0/13
 description To ASA,
 switchport access vlan 3
 switchport mode access
 speed 100
 duplex full

I configured the ASA like so:

interface Vlan1
 nameif inside
 security-level 100
 ip address

interface Ethernet0/5
 speed 100
 duplex full

Then I plugged the host into Ethernet 0/4 on the ASA and instructed its owner to make its default gateway I made a NAT rule in the ASA and set up some rules, and it's able to access the Internet without issue.

However, I noticed that the Catalyst reports a ton of packets being dropped toward the ASA.

Catalyst3750#show interfaces GigabitEthernet 1/0/13 | include counters|drops
  Last clearing of "show interface" counters 00:28:13
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 136909347

This is a huge number of drops, since there's not much traffic on this VLAN at all.

I tried these things:

  • Make sure speed and duplex agree on both sides (100 Mbps / Full)
  • Set no cdp enable on the Catalyst Gi10/13
  • Set no keepalive on the Catalyst Gi10/13
  • Checked for excessive CPU usage on both
  • Checked for excessive traffic on both

Am I missing something? Any help would be appreciated.

  • What do the counters and traffic rates look like? – Shane Madden Jul 27 '11 at 23:31
  • The ASA is the busiest in the VLAN- it's 134kbps in/502kbps out (from the Catalyst's perspective). The others are less than 5 kbps. None of the others have any drops recorded. – bbayles Jul 28 '11 at 0:13
  • Are the drops increasing? Those could be from a while back... – Kyle Brandt Jul 28 '11 at 1:17
  • Yes, note above that I'd cleared counters 28 minutes before the snapshot. Clearing again shows another increase. – bbayles Jul 28 '11 at 12:13
  • 1
    There is something I dont quite understand.. why is the host (assuming a PC) connected to Eth0/4 on the ASA instead of into the 3750? – pauska Jul 28 '11 at 13:00

Consider checking the physical media and any possible interconnects for damage.

  • An excellent suggestion. I'll feel very sheepish if this fixes it. – bbayles Jul 28 '11 at 13:01
  • Nah... It happens. – user48838 Jul 28 '11 at 13:02
  • No luck from changing to a known good cable, unfortunately. – bbayles Jul 29 '11 at 23:13
  • You might have to consider looking closer at the hardware interfaces. Maybe by changing up the pairing with other equipment/interfaces for testing. – user48838 Jul 30 '11 at 1:03
  • OK, so it wasn't that. One of the hosts in the VLAN was sending some multicasts. How the math of the 136909347 packets / 28 minutes works out given the traffic levels I saw, I have no idea. But shutting up that host seems to have solved the problem – bbayles Jul 31 '11 at 6:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.