Routing – How to Connect a US Server to a Tier 1 ISP

There are a number of possibilities here, not limited to, but including:

1. The CPE's CPU is maxing out. (CPE=Customer Premesis Device)

   Check the specifications for the router you are using to make sure it can support the level of traffic you're trying to push. Try and graph the CPE's CPU if you are unsure.

2. Bufferbloat in your ISP

   If your ISP has configured traffic shaping for DSL tails (to avoid tail dropping packets) - they may have configured their buffer size too large. A good way to tell is by maxing out your connection in the downstream (download) direction. If your latency goes up by 200ms or more, this is probably a problem with your ISP's shaping configuration for DSL tails, and you should complain. They should reduce their buffer depth.

   I'd suggest >50ms of buffer is harmful.

3. The upstream of your xDSL is being maxed out.

   Remember on most DSL technologies, bandwidth is asymmetric. Thus it takes a much smaller amount of traffic to congest the upstream (upload) on most DSL technologies than the downstream. Make sure you aren't congesting upstream.

4. Remember tools that graph links are usually averaging samples.

   Tools like rrdtool (and cacti and NMIS and...) are usually showing you a 5-minute sample average of your links. This makes them poor for identifying situations where a user congests a link for 10 seconds or so. That'll just appear as a small bump on a 5-minute-sampled graph. Look for tools which can give you a 'high water mark' of the link as well as a rolling average.

If the ASA can ping the internet then routing on the firewall is fine.

Although I did noticed I can't see a NAT statement to nat your traffic from your inside to the outside address

Apply the NAT under your object.

object network obj_any
nat (inside,outside) dynamic interface

If this doesn't resolve your issue please post the output from the following command


packet-tracer input inside tcp 192.168.1.100 323 8.8.8.8 80 detailed