topic Additional troubleshooting in Network Security

ASA 5505 Drops Internet - TimeWarner Cable

Timothy Garay — Tue, 12 Mar 2019 08:24:32 GMT

I have done a bunch of researching and I have tried some troubleshooting when the problem occurs but I'm just coming up empty-handed. This is really frustrating my family and myself.

We have TimeWarner cable. From the Motorola cable modem I go right to interface 0/1 on my Cisco ASA 5505 (9.1(6)) with ASDM 7.4(3). That is setup as the outside interface with DHCP and gets assigned my public IP address (which does not change often).

I have unlimited license to internal hosts. I have hard coded 0/2 to full duplex 100MBps.

From the ASA I go to a gigabit switch and from there to the rest of the computers in the house. I work from home so have VPN access to work and see right away when Internet connection drops.

About once per day (no specific time of day), I lose Internet connectivity from internal devices. I can still ping the ASA (it is up) and login to it. I cannot ping any public DNS or IP addresses.

Easiest fix is just to reboot or reload the ASA. When it comes back up the problem is fixed.

Lately, I've been trying to troubleshoot and hopefully fix the problem altogether. Today it happened again and I was in a position to do some troubleshooting. Cable modem shows connection with no issues. ASA is up. I login to ASDM of ASA. Nothing looks like issue in log messages. I Putty to ASA. Do show arp, clear arp. Do show conn count and clear conn. Do clear xlate. These are all things I found in other posts. From ASA I can ping all internal hosts. I can ping the cable modem (192.168.0.1). I cannot ping any public DNS or IP addresses. I cannot ping my public IP address (whatever it is at the time). ASA doesn't really show anything is wrong - I just can't get out. I do a shut then a no shut on 0/1 (outside interface) and Internet starts flowing again. When Internet is working, I am able to ping my public IP address from the ASA.

Things I am looking for: suggestions of things to check, look at or do next time this happens for troubleshooting.

Doing a real time log view, I don't see the firewall blocking anything like perhaps it has shut things down.

I am a novice at Cisco. Am familiar with the CLI basically but no whiz kid at commands for troubleshooting.

I have attached my running config if anyone would like to review it.

Thank you!

-TimG

One more thing to add...

Timothy Garay — Mon, 17 Oct 2016 23:51:44 GMT

One more thing to add...

According to my wife and kids, it goes down during the night as well after I'm in bed.

Last night apparently it went down and they could not access the Internet for an hour or so before it came back.

That really confuses me. If nobody logs in to the ASA or power cycles the equipment, what causes it to come back by itself when it's broken?

-TimG

Additional troubleshooting

Timothy Garay — Mon, 24 Oct 2016 14:26:54 GMT

Additional troubleshooting information that I have obtained during down times:

1.) I plugged my laptop directly into the Cable Modem and when the 5505 was not passing traffic, my laptop was still able to access the Internet. It does not appear to be an issue with the actual Internet connection from the ISP or the cable modem. Internet is still working, it is the 5505 that is not passing traffic out.

2.) I swapped out the 5505 with an old router. I have not had this issue occur since. I'm only doing this temporarily as a test since the throughput of the old router is only about 1/3 that of the 5505. I just want to make sure that I prove where the issue lies.

3.) Saturday morning the 5505 was not passing traffic. I collected some debug logs (attached). The traffic actually started flowing again on its own (without doing a reload or shut/no shut on the outside interface). A short while later it dropped again and I did a reload to get it back. Maybe someone can look at the debug log and see anything?

I'm having this exact same

steve.w.kesler — Sun, 30 Oct 2016 21:33:02 GMT

I'm having this exact same issue. Seems like something is going on with the DHCP renewal on the ASA 5505. I have Time Warner also. Everything has been working fine until ~2 weeks ago. I can plug into the Ubee modem and still got out to the Internet. On the ASA 5505 I can ping all other internal hosts with no issue just as you stated above. Rebooting the ASA and cable modem fixes the problem. Happens regularly ever ~10 hours.

I have reconnected the ASA

Timothy Garay — Thu, 03 Nov 2016 23:19:14 GMT

I have reconnected the ASA 5505. It went a couple of days without incident and now it is back to several times a day.

Re: I have reconnected the ASA

squareoneit — Mon, 11 Sep 2017 16:14:56 GMT

i'm having a similar issue with my ASA 5506. Did you ever figure out what was causing the loss of internet?

Thanks,

Kevin

Re: I have reconnected the ASA

jumora1 — Mon, 11 Sep 2017 17:24:00 GMT

Based on defects found on that 9.1.6 version I would suggest to upgrade the unit but we could also check resources and send logs to a logging server.

If you wish for me to check your device just send me an email to juanmh8419@gmail.com

Re: ASA 5505 Drops Internet - TimeWarner Cable

jumora1 — Mon, 11 Sep 2017 18:40:08 GMT

Can you get me a show tech so I can see some block, memory and interface statistics?

I would suggest to check interim release notes, the first defect mentions :

https://www.cisco.com/web/software/280775065/123352/ASA-916-Interim-Release-Notes.html

https://www.cisco.com/web/software/280775065/131523/ASA-917-Interim-Release-Notes.html

Re: ASA 5505 Drops Internet - TimeWarner Cable

jumora1 — Mon, 11 Sep 2017 18:42:16 GMT

Can you get me a show tech so I can see some block, memory and interface statistics?

I would suggest to check interim release notes.

Re: ASA 5505 Drops Internet - TimeWarner Cable

squareoneit — Mon, 11 Sep 2017 20:49:52 GMT

Here is the show tech. i did omit the config.

Thanks,

Kevin

Re: ASA 5505 Drops Internet - TimeWarner Cable

jumora1 — Tue, 12 Sep 2017 11:42:17 GMT

I checked your device and I saw nothing in particular.

When it fails I would suggest checking the arp table of the ASA and the client when it is and is not working.

There is also a field notice with 5506 which indicate that they could stop working after 18 months so I would check the next link

https://www.cisco.com/c/en/us/support/docs/field-notices/642/fn64228.html

Re: ASA 5505 Drops Internet - TimeWarner Cable

squareoneit — Tue, 12 Sep 2017 13:43:14 GMT

Thanks for the heads up on the field notice. I checked and this unit isn't affected by that. The next time it loses internet I'll check ARP. I had been reading about that could be a possible cause.

Thanks,
Kevin

Re: ASA 5505 Drops Internet - TimeWarner Cable

jumora1 — Thu, 14 Sep 2017 12:15:15 GMT

any feedback

Re: ASA 5505 Drops Internet - TimeWarner Cable

jumora1 — Thu, 14 Sep 2017 12:20:40 GMT

Also run a clear asp drop and do a show asp drop when you see the failure.

I would also suggest to try to run a nslookup on the PC or try to use an IP on the browser to see if you can reach out via IP.

Re: ASA 5505 Drops Internet - TimeWarner Cable

wickedlfe — Mon, 10 Aug 2020 05:57:32 GMT

I'm having this exact same issue with my 5506-X. It's been working fine for close to 3 years and all of a sudden 3 weeks ago the internet connection symptom started. Did you ever find a solution?

Re: ASA 5505 Drops Internet - TimeWarner Cable

Michael Jackson — Thu, 01 Oct 2020 12:30:03 GMT

I am having a very similar issue on a new ASA 5506-X.

Spectrum Business modem, 5 static IP addresses, using 3 of them.

We find that randomly, every few days, the traffic seems to stop flowing on the primary IP which is the dynamic NAT address. The symptoms are that we can no longer browse the internet, and the remote VPN stops. Conversely, the static NAT addresses, one for email server, and one for a DVR system, continue to work. And I can actually remote into the email server to do troubleshooting. The email server still has access, so it appears that only IP affected is the primary IP using dynamic NAT.

Basically rebooting the ASA was what I first did to get it working again, later I found if I "clear arp" on the router, everything starts working again. I have many ASA 5506,5508 routers on Spectrum Business and this is the only one that has issues. I took it up with Spectrum, but of course they do their little remote process into the modem and "everything's fine"..... no help. Even if it IS an issue on the Spectrum side, I just want to patch it if I can, if there is some way to periodically issue a "clear arp" command on the ASA, that would be enough for me.

Any solutions?