The ASA Acts as a VPN termination point for another office, connects to a similar ASA. There is an inside interface, and outside interface, and a third interface never really used. Four days ago had a configuration change, config attached below, since then it stops passing and accepting ANY traffic every 3 hours and 10 minutes. I.e. it was just passing traffic and responding to pings, then boom! - lockdown. It pings itself, responds to console, shows me logs and acts like everything is fine. Yet it does not ping anything else, does not accept or pass any traffic on the two interfaces it uses. Interfaces are physically and line up, shutting them down and bringing up again does not help. Clearing connections and etc. does not help either. Memory usage shows used memory 14%, cpu 9%, xlate 0. If you reboot it, it reloads and starts working normal for exactly 3 hours and 10 minutes. One of most puzzling things for me is that there is an arp mapping in the configuration for a certain address, and after ASA locks down this mapping is the only one remaining in the ARP table and that address is reachable from the ASA, i.e. it responds to pings. All other addresses are not being resolved and can't reach them. ASA is connected to a switch that services a bunch of other devices and all of them keep working when this happens. The switch also does not display any errors or port downs for where the ASA sits. I'm lost in guessing the possible causes.
The issue was resolved by completely removing and rebuilding configurations on both sides. The previous configurations were left over by another network engineer and some parts of them were not used (like ACLs and crypto maps not assigned to anything), including those lines that you had questions about. The initial configuration change was a cleanup - getting rid of those ACLS and cryptos. Our guess is that some of those leftover parts in the configuration, particularly a PKI configuration I chose not to include in the show run output uploaded, caused the problem. By the way - yes, it would make all interfaces unreachable, not just one.
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :