Cisco Support Community
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Help!! Power outage, then ASA no longer passes traffic

I'm really tired, been trying to figure out what went wrong since 1am, it's now 4am. I hadn't changed any configuration for quite some time. Now I have intermittent pings to inside interface. Outside sites are seeing 70% of ICMP packets dropped to the outside interface. When I ping from the ASA to outside IPs, the rate is 4/5 (80%).

I haven't changed any rules or NAT config. I have 3 NAT entries, none of them working, ne mail, no internet, no remote access. The strange thing is that it's not dropping everything, the odd thing makes it through.

System load is minimal.

Please HELP!


Super Bronze

Help!! Power outage, then ASA no longer passes traffic


I'd imagine that there is always the chance that some device has gotten damaged by the sudden power outage.

I am not sure what kind of Internet connection you have but I would suggest trying to get a replacement device and test connections with it.

Naturally it might be the ASA also. Though I have only seen 1 ASA break because of problems with the power. But it was completely dead then.

I would also imagine that provided that all the ASA configurations were saved before the power outage that there should be no problems with the configurations.

I would also look into the state of the physical interfaces and their counters. Possibly also resetting the counters to zero so you can see see clearly any counter incrementing that isnt "supposed" to.

Naturally if you want, you can always share the current configuration (while removing any public IP addresses or sensitive information) and we can look through it but somehow I doubt its a configuration issue.

- Jouni

Community Member

Help!! Power outage, then ASA no longer passes traffic

Thanks for the reply Jouni,

I have Fiber optic LAN coming in from the media changer to a vlan on a switch. I've tried connecting to that VLAN with an external IP, and I can get out fine, bypassing the 5505.

I'm seeing a lot of inbound tcp connection denied from (internal NAT of spam gateway) to (external IPs) flags SYN on interface outside, as well as Deny inbound UDP from (internal DNS) to (ISP's external DNS) due to DNS query.

I'll see if I can post the config. Any other thoughts?

Community Member

Re: Help!! Power outage, then ASA no longer passes traffic

I figured out what the problem was. The clues were in the logs, once I could focus my bloodshot eyes enough to read them. The ports on the switch connecting the ASA outside interface to the fiber access point had lost their VLAN config. The entire switch had lost it's VLAN config, and every port had been reset to VLAN 1.

The switch is a 2950, I'm still trying to figure how it lost only it's VLAN config, yet all other settings remained intact.

Now I see the results of the ASA forced to use the same VLAN for both interfaces, I was just too tired to see it.


Sent from Cisco Technical Support iPad App

CreatePlease to create content