topic Thank you for your help. in Network Security

ASA 5505 how to refresh user|connections when I disconnect a device after it reaches user limit

of1980 — Tue, 12 Mar 2019 08:48:02 GMT

I have a problem that when users or connections reach the user license limit, I disconnect one device to let another device connect to Internet. How can I make sure it works. Sometimes it's hard for a new device to connect successfully, or wait for so long time. Is there command to refresh the user or connection to release the occupancy of user?

Thanks a lot.

You can use the "show local

Rahul Govindan — Wed, 18 Jan 2017 20:19:26 GMT

You can use the "show local-host" to see the current hosts and host-limit. You can use the "clear local-host x.x.x.x" to clear a specific host from talking up a license. This clears connections and xlates that the host holds. More on that command here:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/A-H/cmdref1/c3.html#pgfId-2249465

Thank you for your help.

of1980 — Wed, 18 Jan 2017 22:01:07 GMT

Thank you for your help.

"show local-host" give out too much details of connections.

While "show local-host connection | inc licensed" give only the count of host.

Current host count: 10, towards licensed host limit of: 10

I wonder if some commands can test whether the inside ip is on line after I unplug Ethernet cable or shut down a device to release connection.

Or, the command can filter inside ip and clear the connection of it.

You can use "show local-host

Rahul Govindan — Thu, 19 Jan 2017 01:02:23 GMT

You can use "show local-host brief" just to see brief information per host. A host is not going to go away from host table once unplugged from the network. The connections that the ASA has for that host should timeout or be cleared manually. A "clear local-host x.x.x.x" should clear all that for a particular host.

Hi Rauhul,

TCAM — Fri, 31 Mar 2017 14:33:52 GMT

Hi Rauhul,

Is there a way to change the "local-host " timeout timer?

Some of my VPN clients disconnected from network but the local-host connection is still showing up and stayed in the table for around 3 minutes then ASA removed it from the table. I want to speed up the removal process, is there a way to do that?

Thanks