Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Cisco ASA 5505 - Keeps dropping internet connection


We are having some issues with our Cisco ASA 5505 unit, it intermittently drops the outside interface connection. Internally the network appears to be working correctly with no issues. Even though the outside interface indicates it is 'up' access to the internet is lost from our LAN. This seems to be ocourring more and more often! This is happening for all users on the network too. Reloading the ASA seems to correct the problem temporally but this isn't really an option during peak periods in the day as this would obviously hinder work being carried out by employees.

Any ideas?

Any help would be greatly appreciated!!



Running Config Below:


ASA Version 8.2(1)


hostname ******************

domain-name *************************

enable password ************************* encrypted

passwd **************************** encrypted




interface Vlan1

nameif inside

security-level 100

ip address


interface Vlan2

nameif outside

security-level 0

ip address *****************


interface Ethernet0/0

switchport access vlan 2


interface Ethernet0/1


interface Ethernet0/2


interface Ethernet0/3


interface Ethernet0/4


interface Ethernet0/5


interface Ethernet0/6


interface Ethernet0/7


ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server *****************

domain-name **********************

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list outside_access_in extended permit tcp any any eq smtp

access-list outside_access_in extended permit tcp any any eq 3389

access-list outside_access_in extended permit tcp any any eq https

access-list outside_access_in extended permit tcp any any

access-list outside_access_in extended permit tcp any any eq 3839

pager lines 24

logging enable

logging asdm warnings

mtu inside 1500

mtu outside 1500

failover timeout -1

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-621.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1

static (inside,outside) tcp interface smtp smtp netmask

static (inside,outside) tcp interface https https netmask

static (inside,outside) tcp interface 3839 3839 netmask

static (inside,outside) tcp interface 3389 3389 netmask

static (inside,inside) netmask norandomseq nailed

static (inside,inside) netmask norandomseq nailed

access-group outside_access_in in interface outside

route outside *************** 1

route inside 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http inside

http inside

http inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

sysopt noproxyarp inside

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash md5

group 1

lifetime 86400

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd auto_config outside


threat-detection basic-threat

threat-detection statistics port

threat-detection statistics protocol

threat-detection statistics access-list

no threat-detection statistics tcp-intercept


username ************ password *********************** encrypted privilege 15


class-map inspection_default

match default-inspection-traffic



policy-map type inspect dns preset_dns_map


  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp


service-policy global_policy global

New Member

Cisco ASA 5505 - Keeps dropping internet connection


What happens when you assign eth0 as internal interface and eth1 as outside if?

Also configure logging (/debugging) to see if there are hardware issues or something else.

And it seems you have a range of public addresses. What happens when you connect a device, e.g. a laptop directly on the internet access device and send continue ping to an internet host.

When you loose internet connectivity, is the laptop still pinging to that host?

Hopefully this helps you,

Kind regards,

Ralph Willemsen

Arnhem, Netherlands

Cisco ASA 5505 - Keeps dropping internet connection

Can you provide:

Sh interface ethernet 0/0



Julio Carvajal
Senior Network Security and Core Specialist
New Member

Cisco ASA 5505 - Keeps dropping internet connection

Also check the interface duplex settings. If it is set to auto, force it to full. I faced similar issue with my ASA and found the duplex issue.

New Member

Cisco ASA 5505 - Keeps dropping internet connection

Hi John,

How many inside users/hosts have you got ?

Because, Inside concurrent Hosts are limited depending of your SA licences and options.

You can check that limit insing the following command "sho ver |  inc Inside Hosts"

If I remenber well, the control is based on nat translation rules, in order to verify if it's your root cause issue, you can try to do a "clear xlate" the next time problem occurs in order to clear the translation table of the ASA.


New Member

Re: Cisco ASA 5505 - Keeps dropping internet connection

Hi John

Ive had a similar problem. The issue turned out to be what Vincent states above but clear conn worked rather than clear xlate.

do a show ver and see what licence you have and how many inside hosts are supported.

enable logging. not sure what level but I have enabled buffer logging level info and can see Deny traffic from x.x.x.x to x.x.x.x host limit of 10 exceeded.

You might need the 25 user licence

CreatePlease to create content