ASA 5505 keeps "going down"

philm · ‎10-07-2009

I have a Cisco ASA 5505 for my internet gateway.

I do not have VPN setup.

Several times a day, the ASA 5505 "goes down", and users cannot get on the internet. After a short while, the router begins working again, almost as though it did a "reset" or something. Is there some log or some way to see what is causing the router to stop like that? I found the "firewall" monitor in the ASDM, and it shows spikes in the "syn attack" graph, but I have checked the computers that show in the "under attack" list and those computers don't have a virus or malware (from what I can tell)

What I would like to do, is make sure all "VPN" related stuff is removed from the config if possible to ensure that I am not being attacked that way.

philm · ‎10-07-2009

Also, is it possible to display the MAC address in the "ASDM Syslog Messages" screen?

binhkdinh · ‎10-07-2009

Do you see the source IP & protocol/port of the attack on ASDM? If not, I think you should set up a syslog server to see where the "sync attack" is coming from. Then block the source and protocol/port on your ACL.

nsn-amagruder · ‎10-07-2009

I had a bad power supply / brick a few weeks ago. TAC had to send a replacement. Do a show version and see the uptime. If it is rebooting, check the power source and get an RMA if you have smartnet. If not, try purchasing a new power brick.

philm · ‎10-09-2009

Yesterday, it showed up time 19 hrs 40 mins.

Today, it shows 17hrs 53 mins uptime

I have not manually rebooted it. However, the internet has "gone down" on all traffic that passes through that router twice already this morning. So, it looks like I have two problems.

.

1. The router resets itself.

2. Traffic will not go through in or out at seemingly random times throughout the day. If the users just wait about 3 minutes, it comes back. When one user loses internet, it seems they all do.

nsn-amagruder · ‎10-09-2009

Is it connected to a UPS and have you tried another power outlet?

If so, it is is a bad PS or bad power brick. Do you have smartnet maintenance? Open a case with TAC and get it RMA'd.

philm · ‎10-12-2009

Yes, I have it connected to a battery backup. I also tried another power source.

It has quit a couple times today. When it did, I ran in and unplugged the inside network cable and plugged it back in real quick (because it was blinking really fast). As soon as I did that, internet works again.

When I did sh ver this morning, it had been up for 2 days and 19 hours. But now I see it has been hard reset because it says it is only up for 3 hours 59 min

Cisco arranged an RMA for me, still waiting on the new hardware to arrive.