Interface Internal-Data0/0 "", is up, line protocol is up
2749335943 input errors, 0 CRC, 0 frame, 2749335943 overrun, 0 ignored, 0 abort
^^^^^^^^^^^^^^^^^^
0 output errors, 0 collisions, 0 interface resets
You show overruns on the InternalData interfaces, so you are dropping traffic through the ASA. With that many drops, it's not hard to imagine that this is contributing to problem. Overruns happen when the internal Rx FIFO queues overflow (normally because of some problem with load).
EDIT to respond to a question in the comments:
I don't understand why the firewall is overloaded, it is not close to using 10Gbps. Can you explain why we are seeing overruns even when the CPU and bandwidth are low? The CPU is about 5% and the bandwidth either direction never goes much higher than 1.4Gbps.
I have seen this happen over and over when a link is seeing traffic microbursts, which exceed either the bandwidth, connection-per-second, or packet-per-second horsepower of the device. So many people quote 1 or 5 minute statistics as if the traffic is relatively constant across that timeframe.
I would take a look at your firewall by running these commands every two or three seconds (run term pager 0
to avoid paging issues)...
show clock
show traffic detail | i ^[a-zA-Z]|overrun|packets dropped
show asp drop
Now graph out how much traffic you're seeing every few seconds vs drops; if you see massive spikes in policy drops or overruns when your traffic spikes, then you're closer to finding the culprit.
Don't forget that you can sniff directly on the ASA with this if you need help identifying what's killing the ASA... you have to be quick to catch this sometimes.
capture FOO circular-buffer buffer <buffer-size> interface <intf-name>
Netflow on your upstream switches could help as well.
Couple of things I see off-hand that need to be addressed. Your routing table doesn't include the 192.168.11.x network, thus your router doesn't know where to send the data, unless you omitted it from the text. It should be automatically included as a "connected" 'C' route as your others are. Part of the problem may lie in the fact that you are using port 1/1/24 in switchport mode, instead of routed mode.
From the text you included, it looks like your voice network is the default static route for all of your traffic.
I imagine you can ping the 192.168.11.1 interface? Can you ping the 192.168.11.2 interface?
Here's a quick fix to try...
config t# int gi1/1/24
config t-if# no ip address
config t# int vlan 11
config t-if# ip address 192.168.11.1 255.255.255.0
config t-if# int gi1/1/24
config t-if# switchport mode acce
config t-if# switchport acc vlan 11
Verify the 192.168.11.0/24 network is in the routing table and rerun the ip default gateway command if needed. Check for connectivity.
You can also try changing int gi1/1/24 into a routed port with the "no switchport" command. That should also solve your problem.
Best Answer
The Quick Start manual suggests perhaps its performing a self-check or waiting to acquire an IP address.