topic Re: Cisco ASA Firewall Issue 5508 in Network Security

Cisco ASA Firewall Issue 5508

Hamidsattarrana — Mon, 08 Jul 2024 16:09:53 GMT

Hello Everyone,

We have a strange issue after 2 or 4 months, we are not able to reach the firewall and all the servers/systems connected with the firewall are not reachable.

Then we have to hard reboot the firewall and after reboot it start working fine.

Firewall Model and Version: ASA 5508

ASA Version: 9.9(2)

Can anyone please tell me what could be the issue?

Thanks in advance

Re: Cisco ASA Firewall Issue 5508

MHM Cisco World — Mon, 08 Jul 2024 17:16:47 GMT

You reboot so the asa dont keep info about issue byt if ypu have syslog message we can briefly know what issue was.

You and use can not know now anything of previous issue

MHM

Re: Cisco ASA Firewall Issue 5508

Marvin Rhoads — Mon, 08 Jul 2024 17:28:15 GMT

You're running a very old image (~4 years) that is not even offered for download any more. It could be affected by many different bugs. I would start by upgrading to a more recent image. Something like 9.16.4-62 would be much better.

https://software.cisco.com/download/home/286285773/type/280775065/release/9.16.4%20Interim

Re: Cisco ASA Firewall Issue 5508

Hamidsattarrana — Sun, 14 Jul 2024 06:45:31 GMT

Hello Marvin,

Thanks for your suggestion, I will check.

Re: Cisco ASA Firewall Issue 5508

Hamidsattarrana — Sun, 14 Jul 2024 06:46:41 GMT

Hello Sir,

Can you please help me find the recent logs before doing force reboot?

Thanks

Re: Cisco ASA Firewall Issue 5508

Marius Gunnerud — Mon, 15 Jul 2024 08:36:58 GMT

Are you able to console into the firewall?

Syslog messages should be sent to your syslog server. If you do not have a syslog server then "show logging" from the CLI but this is limited to how large buffer you have configured.

As @Marvin Rhoads has mentioned, the first thing you should be doing is upgrading the ASA to a newer version as you might be hitting a bug.

If you are still having problems after upgrading, create a "show tech" file while the issue is happening (also create one when the issue is not present). I would then suggest opening a TAC case and provide the two show tech files. If opening a TAC case is not an option for you, remove any public IPs, usernames and passwords from the show tech files and then post them here and we can try to help you out.

Re: Cisco ASA Firewall Issue 5508

Marius Gunnerud — Mon, 15 Jul 2024 08:42:32 GMT

Things you could try when the issue is happening are the following. Try each in turn and see if the issue is resolved after each command, that way we will know what is causing the issue.

clear conn
clear xlate

Other things to check is if a failover has occured, and if the switch is seeing the correct MAC address for the Firewall. Also check ARP tables on your L3 devices and make sure that IP to MAC mappings are correct.