ASA locks down traffic

Unanswered Question
Nov 23rd, 2009
User Badges:

ASA 5520, with 7.2(1) image


The ASA Acts as a VPN termination point for another office, connects to a similar ASA. There is an inside interface, and outside interface, and a third interface never really used. Four days ago had a configuration change, config attached below, since then it stops passing and accepting ANY traffic every 3 hours and 10 minutes. I.e. it was just passing traffic and responding to pings, then boom! - lockdown. It pings itself, responds to console, shows me logs and acts like everything is fine. Yet it does not ping anything else, does not accept or pass any traffic on the two interfaces it uses. Interfaces are physically and line up, shutting them down and bringing up again does not help. Clearing connections and etc. does not help either. Memory usage shows used memory 14%, cpu 9%, xlate 0. If you reboot it, it reloads and starts working normal for exactly 3 hours and 10 minutes.
One of most puzzling things for me is that there is an arp mapping in the configuration for a certain address, and after ASA locks down this mapping is the only one remaining in the ARP table and that address is reachable from the ASA, i.e. it responds to pings. All other addresses are not being resolved and can't reach them. ASA is connected to a switch that services a bunch of other devices and all of them keep working when this happens. The switch also does not display any errors or port downs for where the ASA sits.
I'm lost in guessing the possible causes.

Does anyone have any suggestions?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Farrukh Haroon Tue, 11/24/2009 - 00:17
User Badges:
  • Red, 2250 points or more

Hello


This is most probably an ARP issue, why have you put this command?


sysopt noproxyarp VideoConf_Net


Also you never mentioned what changes you made in the configuration after which this problem started to appear.


Also after 3 hours and 10 minutes, which devices are unreachable from the ASA? Any particular interface or ALL interfaces are affected?


E.g. is  10.17.8.1 255 reachable?


Why have you changed the AD of your default route?


route MO_LAN 0.0.0.0 0.0.0.0 10.17.8.1 255


Initially I thought u are getting a default route via OSPF, but there is no OSPF in you config! except the cost set on one interface (with no effect)


Regards


Farrukh

n_parshina Sun, 11/29/2009 - 19:34
User Badges:

Hi

The issue was resolved by completely removing and rebuilding configurations on both sides. The previous configurations were left over by another network engineer and some parts of them were not used (like ACLs and crypto maps not assigned to anything), including those lines that you had questions about. The initial configuration change was a cleanup - getting rid of those ACLS and cryptos. Our guess is that some of those leftover parts in the configuration, particularly a PKI configuration I chose not to include in the show run output uploaded, caused the problem. By the way - yes, it would make all interfaces unreachable, not just one.

In any case, cleaning it up resolved the issue.

Farrukh Haroon Mon, 11/30/2009 - 08:44
User Badges:
  • Red, 2250 points or more

I'm glad your issue was resolved


Regards


Farrukh

Actions

This Discussion

Related Content