Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

At the office, I have inherited a network that I am still trying to fully comprehend. I have a problem today with a new connection between:

  • A port on a Cisco Catalyst 3750 [WS-C3750G-48TS-S running C3750-IPSERVICESK9-M version 12.2(53)SE1]
  • A port on a Cisco ASA 5505 [ASA Software version 8.3(2)]

The 3750 is home to a Vlan that has a few ports assigned to it.

interface Vlan3
 description Internal network (
 ip address

I have a host (outside of my control) that needs to be in this VLAN (i.e it must have an address 172.18.160.something/24) that also needs to access the Internet.

To accomplish this, I ran a link from the Catalyst (Gi1/0/13) to the ASA (Ethernet 0/5). I configured the Catalyst port like so:

interface GigabitEthernet1/0/13
 description To ASA,
 switchport access vlan 3
 switchport mode access
 speed 100
 duplex full

I configured the ASA like so:

interface Vlan1
 nameif inside
 security-level 100
 ip address

interface Ethernet0/5
 speed 100
 duplex full

Then I plugged the host into Ethernet 0/4 on the ASA and instructed its owner to make its default gateway I made a NAT rule in the ASA and set up some rules, and it's able to access the Internet without issue.

However, I noticed that the Catalyst reports a ton of packets being dropped toward the ASA.

Catalyst3750#show interfaces GigabitEthernet 1/0/13 | include counters|drops
  Last clearing of "show interface" counters 00:28:13
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 136909347

This is a huge number of drops, since there's not much traffic on this VLAN at all.

I tried these things:

  • Make sure speed and duplex agree on both sides (100 Mbps / Full)
  • Set no cdp enable on the Catalyst Gi10/13
  • Set no keepalive on the Catalyst Gi10/13
  • Checked for excessive CPU usage on both
  • Checked for excessive traffic on both

Am I missing something? Any help would be appreciated.

share|improve this question
This might be better off on Serverfault. It is much higher end gear than most people on this site are accustomed to. – MaQleod Jul 27 '11 at 5:54
Thanks, I will do that. – bbayles Jul 27 '11 at 14:20
don't double post, but if you don't get the answers you need here, flag it for an OP to move you. – MaQleod Jul 27 '11 at 17:14

I can try that, but I don't think that really solves the problem of packets dropping toward the ASA?

It may. It will eliminate 0/4 which could potentially have an issue. Even though you are seeing the drops outbound on the 3750, there could be some signalling issue there. My suggestions is to try a new cable (and plug the host into the 3750 like Harris suggested).

Also, please note that there is a bug that shows the incorrect number of output drops...not sure if it affects your version.

share|improve this answer

Why have you put the host directly on ASA port 0/4? Try connecting the host on the Catalyst switch since this has already a connection with ASA in Vlan3.

share|improve this answer
I can try that, but I don't think that really solves the problem of packets dropping toward the ASA? – bbayles Jul 27 '11 at 14:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.