Thank You, meantime I have logs from syslog while all was down and could not ping 8.8.8.8. 

Do you have a static IP or dynamic? STATIC

Do interfaces show unusual errors or drops? Attached syslog. 

I have feeling its either DoS, or some sort of attack. I will try to get answers on all. Thank You. 

I have noticed its happening every time we access NWEA site for testing. All is ok during the days we don't use that site at all. 

I found NWEA has some references to DoS on twitter.

https://mobile.twitter.com/NWEA?lang=fil

From the post it sounds like they were attacked in some way so its possible you had/have systems in your network contributing. You mentioned testing as well, maybe a faulty or misconfigured system?

but is that possible their problems affecting our network service? I don't want to believe it is possible at all. 

What I have done was placing a switch between a router and firewall, mirrored ports and took TCPDUMP. I have a file but another problem is analyzing that file.

The DNS blockout happens at same times, I wonder if there is limit on ASA 5510 for client connection or sessions. 

I was able to get tcpdump from the time when I had to reboot ASA again. Looks like right before WAN port "die" there was a lot of https traffic but I don't think I deal with DoS since network was utilized in 48%.

I start taking tcpdump files out of internal network just before they reach ASA and behind both in and out. But this is really drives me crazy since the problem is being since 3 weeks. 

What I have noticed based on tcp dump is a lot https traffic is generated from my side to 23.4.1.138  and 173.194.192.95, but the first one kicks before ASA WAN port dies.

Looks like this is akamai technologies. The question is how that affects and how to stop the traffic?

At the time of issue did you try pinging internet from the ASA?

Check if the interface is UP or not.

Check ARP entries on ASA and also check if upstream device is passing traffic at the time of issue.

Thanks,

R.Seth

Yes, at that time WAN port on ASA looks like is UP - BUT I can't ping anything externally.

Normally, I can ping any ip out of ASA. together with ISP we sat manually speed and duplex on both ASA and router.

ASA > ROUTER (ISP)> switch (ISP)

However, If I unplug the WAN data cable from the router and plug it to the a laptop with my static info I can open any websites without issue. 

Hi,

You have mentioned that you can span traffic.

So at the time of issue do you see traffic leaving ASA when :

>> You try to ping public IP from ASA.

>> You try to ping public IP from a host behind ASA.

>> In any of the above cases do you see reply coming back.

It might be possible that there is some issue with upstream device.

And as you have mentioned that when you plug your laptop you do not see the issue. So did you test the connectivity with your laptop directly connected for a week? If not then probably the issue might take some time to occur.

Also try speed and duplex with auto if possible.

Thanks,

R.Seth

well, I cannot use the laptop connected to my WAN link since this is a production environment. Also, for troubleshooting my time is limited since I have 700 people waiting to be online. :( I will be looking for traffic insight of network but I don't think this matters since I see bandwidth utilization for both U/D = 50% 

why nobody says to use:

show local-host connection tcp 1000 | inc TCP flow count ?????

I think I hit a jock pot and narrowed it down to my problems. So one external IP is not enough to all ports an connections. I may expend that

Make sense?  

To check if your PAT pool is getting exhausted then you can use command show nat pool and then make a decision to add more IP address for NAT.

Thanks,

R.Seth