topic Re: Connection inconsistency on cisco ASA 5k in Endpoint Security

Connection inconsistency on cisco ASA 5k

BrendonFranca — Tue, 18 Jul 2023 15:46:37 GMT

Hey guys!
I hope this message finds everyone well.

I have a problem where an ASA 5525 is showing inconsistency in the connections.
at random times VPN Client connections via anyconnect are dropped and the firewall stops responding and forwarding packets to the WAN. The connection only returns after we start a "ping" from the ASA to the outside or outside to the firewall's WAN.
I already created a task to trigger a ping to the google dns through the WAN and a LAN IP through the packet-tracer but it didn't solve the problem.
Does anyone have any idea what it could be or if it could be a version bug? The firmware we are using is Cisco Adaptive Security Appliance Software Version 9.13(1)

Re: Connection inconsistency on cisco ASA 5k

MHM Cisco World — Tue, 18 Jul 2023 16:00:26 GMT

can you share the log message

Re: Connection inconsistency on cisco ASA 5k

BrendonFranca — Tue, 18 Jul 2023 17:08:42 GMT

Hi,

This is also a problem, no error codes or logs appear.
The WAN interface simply stops responding to packets as if it went into standby and only returns after ICMP sessions.
The only error message that appears is when trying to login to anyconnect "Connection attempt has timed out. Please verify internet connectivity"
Despite the error message mentioning a local connection failure, the problem is in the ASA's own WAN interface which simply dies.

Re: Connection inconsistency on cisco ASA 5k

MHM Cisco World — Tue, 18 Jul 2023 17:19:59 GMT

standby <<- your run ASA HA ?

Re: Connection inconsistency on cisco ASA 5k

BrendonFranca — Tue, 18 Jul 2023 17:29:35 GMT

No, it's only 1 firewall.
Sorry if I expressed myself wrong. When I said "standby" I meant that the interface stops delivering packets as if it weren't in production or with the protocol down.
The interface only works again when we send ICMP packets.

Re: Connection inconsistency on cisco ASA 5k

MHM Cisco World — Tue, 18 Jul 2023 17:36:05 GMT

You use PPPoE for WAN ?

Re: Connection inconsistency on cisco ASA 5k

BrendonFranca — Tue, 18 Jul 2023 17:41:03 GMT

No.
WAN connection is done via VLAN ID for a VIP.

Re: Connection inconsistency on cisco ASA 5k

MHM Cisco World — Tue, 18 Jul 2023 18:25:27 GMT

VIP of HSRP,
it seem that ASA drop G-ARP
solution
1- use sla monitor always there is ping
2- use static arp VIP-Vmac