topic Re: ASA CLOSE_WAIT for ASDM Solution not working in Network Security

ASA CLOSE_WAIT for ASDM Solution not working

AminK — Tue, 10 Dec 2024 08:17:47 GMT

I have two ASA 5545 in a cluster. the software version is 9.14(2)15. I can't access my firewall with ASDM due to having maximum http sessions. When I run #debug menu npshim -w, I see 5 https connections with CLOSE_WAIT state. There is no session in #show asdm session. so I can't disconnect them there.

Now according to this guide:https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-asdm/222646-troubleshoot-asdm-launch-problems.html

there is a workaround for this bug that says run #debug menu pdm 3, but my problem is this command is not available in my ASA cli. Other workaround is to reload the appliance but I can't do that because it is a crucial part of my production network.

I highly appreciate any help.

Thanks.

Re: ASA CLOSE_WAIT for ASDM Solution not working

MHM Cisco World — Tue, 10 Dec 2024 08:29:29 GMT

I think tcp keepalive is solved your issue.

MHM

Re: ASA CLOSE_WAIT for ASDM Solution not working

AminK — Tue, 10 Dec 2024 09:46:22 GMT

Can you explain more please? if you mean #http server idle-timout and #http server session-timeout, I already configured those at 1 minute but still no luck. If you mean #timeout tcp or half-closed, I think default values are far less than my problem duration. I have this problem for 2 days now.

Re: ASA CLOSE_WAIT for ASDM Solution not working

MHM Cisco World — Wed, 11 Dec 2024 06:22:58 GMT

sorry I check, in IOS we use service tcp keepalive in ASA there is no such as this option.

anyway

ciscoasa(config)# http server idle-timeout 10 <<- this only work for idle session, if session is not idle this command not work
ciscoasa(config)# http server session-timeout 120 <<- this terminate the session after specific time you can config timeout as you want.

Re: ASA CLOSE_WAIT for ASDM Solution not working

AminK — Wed, 11 Dec 2024 15:37:16 GMT

These options do not work either. Sessions was stuck in close_wait state and nothing worked. So I reloaded the device in maintenance window. I think there is only these two options. Either (#debug menu pdm 3) works for you, or you have to reload ASA to access ASDM again. I applied your suggestions to hopefully avoid this problem in future.

Thank you for your help.

Re: ASA CLOSE_WAIT for ASDM Solution not working

MHM Cisco World — Wed, 11 Dec 2024 16:42:47 GMT

you are so welcome

MHM