topic Cisco ASA Suddenly Resrtart in Network Security

Cisco ASA Suddenly Resrtart

danielbusisa1410 — Wed, 22 Jul 2020 02:23:03 GMT

Hi All,

I have situation that my ASA is restart every day and i don't know what happen on it,

can you give me a light on this ? or maybe i can help with information in my ASA

Thank you very much

Re: Cisco ASA Suddenly Resrtart

Sheraz.Salim — Wed, 22 Jul 2020 07:07:47 GMT

consider doing a software upgrade to stable release. seem like you hitting a bug which cause the firewall to reload. Thread Name: Unicorn Proxy Thread this is a common bug.

upgrade it to 9.8.4 is stable and gold star here

ASDM image upgrade here

also consider upgrading the Rommon software here

i also noted you running in HA pair in order for you to upgrade the HA pair here

please do not forget to rate.

Re: Cisco ASA Suddenly Resrtart

danielbusisa1410 — Wed, 22 Jul 2020 09:38:09 GMT

Hi Sheraz,

Thank you for your reply,

I have one question out of topic, i already setup webvpn clientless ssl vpn in my ASA and when i close the browser the connection on ssl vpn still exist. can you help me what i must to do? what settings i can do?

Thank you so much

Re: Cisco ASA Suddenly Resrtart

Sheraz.Salim — Wed, 22 Jul 2020 09:47:16 GMT

it take some time to clear the cache entries in firewall table to get it clear. if you want to do it manually you can issue a command

vpn-sessiondb logoff webvpn

Re: Cisco ASA Suddenly Resrtart

Marius Gunnerud — Wed, 22 Jul 2020 12:29:56 GMT

You could adjust the idle timeout setting in the group policy assigned to the clientless ssl vpn connection profile. By default this is set to 30 minutes.

Re: Cisco ASA Suddenly Resrtart

danielbusisa1410 — Wed, 22 Jul 2020 17:39:12 GMT

Hi Sheraz,

Is it possible if do it automatically? when user off and close the browser, the tunnel vpn will go offline

Can you give me a documentation or some refference to do it

Thank you very much

Re: Cisco ASA Suddenly Resrtart

danielbusisa1410 — Wed, 22 Jul 2020 17:41:23 GMT

Hi Marius,

you mean make the idle timeout is fast then the default, for example i make the idle timeout 5 minutes and the tunnel will down ?

Thank you

Re: Cisco ASA Suddenly Resrtart

Sheraz.Salim — Wed, 22 Jul 2020 18:38:05 GMT

vpn-idle-timeout 30 = the amount of time the vpn connection is idle ie. if no activity seen/noted on the tunnel, before it is disconnected.

vpn-session-timeout 900 = the amount of time the VPN tunnel is allowed to stay up regardless of whether there is activity or not.

Both times are in minutes. So setting vpn-session-timeout to none as on the other device means the session time is unlimited.

you can have a look the command is "show run all group-policy"

group-policy DfltGrpPolicy internal
group-policy DfltGrpPolicy attributes
 banner none
 wins-server none
 dns-server none
 dhcp-network-scope none
 vpn-access-hours none
 vpn-simultaneous-logins 3
 vpn-idle-timeout 30
 vpn-idle-timeout alert-interval 1
 vpn-session-timeout none
 vpn-session-timeout alert-interval 1
!
group-policy GroupPolicy_Preston_Profile internal
group-policy GroupPolicy_Preston_Profile attributes
wins-server value 192.168.100.72
dns-server value 192.168.100.72
vpn-idle-timeout 1
vpn-tunnel-protocol ssl-client ssl-clientless
split-tunnel-policy tunnelspecified
split-tunnel-network-list value INTERNAL
default-domain value cdyz5.ddns.net
no vpn-simultaneous-login-delete-no-delay
anyconnect-custom DeferredUpdateAllowed value def-allowed
anyconnect-custom DeferredUpdateDismissTimeout value def-timeout
webvpn
anyconnect ssl dtls enable
anyconnect dtls compression lzs
anyconnect profiles value Preston_Profile_client_profile type user

Re: Cisco ASA Suddenly Resrtart

danielbusisa1410 — Wed, 22 Jul 2020 19:14:01 GMT

Hi Sheraz,

Thank you for your reply , i will try it and i will inform you later.

Re: Cisco ASA Suddenly Resrtart

Marius Gunnerud — Fri, 24 Jul 2020 19:13:18 GMT

Yes change the value to something you desire that is less than the default and the tunnel will be torn down. Just keep in mind that if the user leaves their PC for lunch, the ssl vpn is most likely no longer active and you might end up getting a lot of requests to change that behavior.