07-09-2012 05:37 AM
For the past month or so I'm seeing this error in our Cisco ASA firewall syslog "
%ASA-1-332004: Web Cache Cisco_Ironport/web-cache lost" This error was first seen June 22 and since then I've seen this error about once every week or week and a half. I did a google search and I'm not getting a hits to what this error is and how to resolve it. Ironport still functions fine and web filtering is working as usual. Any ideas?
Thanks!
07-09-2012 10:48 PM
I assume that it could be related to the lost or flapping WCCP service in the ASA.
You could check the status of the WCCP service in the ASA and keep track of the time the WCCP service has been running. I think the command is
show wccp web-cache
thanks,
Donny
07-18-2012 10:27 PM
Hi Joe,
If this is an issue with WCCP you may also start a rolling packet capture on the WSA filtering for udp port 2048 a.k.a WCCP. When the issue happens again you will just log into the GUI of the WSA and stop the capture. Download it to your desktop and use wireshark to review the Here I ams' from the ASA and the I see yous' from the WSA. In order to set up a filtered packet capture log into the GUI of the WSA -> Support and Help -> Packet capture -> Edit Settings - See image below. Please make sure to submit and commit your changes.
Once you have the capture configured as shown above please go ahead and start the capture.
Sincerely,
Erik Kaiser
WSA Cisco Forums Moderator
07-31-2012 09:11 AM
Thanks guys for the tips. I had to relocate the appliance to a different rack and thus power off and back on. I'll see if I continue to get the alerts from the ASA.
Joe
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: