topic Anny Connect connection Failuer (CTM Error) in Network Security

Anny Connect connection Failuer (CTM Error)

vishaw jasrotia — Thu, 26 Mar 2020 10:39:57 GMT

Hi All,

We are using Anyconnect SSL vpn in our setup. But as the number of session are increasing, it starts dropping at the firewall. When we debugged the asp drops it shows

ctm-error.

Attaching the log for reference. Check the connection between 182.64.73.214 > 196.1.111.161 > port 443

CTM returned error: ( as per information available on Cisco )
This counter will increment when the appliance attempts to perform a crypto operation on a packet and the crypto operation fails. This is not a normal condition and could indicate possible software or hardware problems with the appliance.

Please help in debugging the issue.

Thanks

Re: Anny Connect connection Failuer (CTM Error)

Cristian Matei — Thu, 26 Mar 2020 11:32:55 GMT

Hi,

How many such drops do you have, look at "show asp drop". You could also hit some bugs, like this one for example. What software version are you using on the ASA? I would recommend to upgrade to 9.8.4 (latest interim version) or 9.12.3 (latest interim version), reload and see if you still get such messages.

Regards,

Cristian Matei.

Re: Anny Connect connection Failuer (CTM Error)

vishaw jasrotia — Thu, 26 Mar 2020 12:33:17 GMT

Thanks Cristian. Our current version is 9.5

Re: Anny Connect connection Failuer (CTM Error)

vishaw jasrotia — Thu, 26 Mar 2020 14:00:47 GMT

I have generated the DART file. Please check if you can get some information from that.

Re: Anny Connect connection Failuer (CTM Error)

Cristian Matei — Thu, 26 Mar 2020 15:59:59 GMT

Hi,

If the session doesn't get disconnected, there are only some drops on the ASA side, i don't see how DART could be useful. Upgrade and let's see the upcoming behaviour.

Regards,

Cristian Matei.