OSPF behavior after upgrading ASA5512

PiEich — Tue, 12 Mar 2019 07:52:30 GMT

Hi guys,

I have this weird OSPF behavior and I don't get it...

I'm running version 9.1(4) on ASA5512, this is the output for some of the routes:

FW1DC1# sh ver
Cisco Adaptive Security Appliance Software Version 9.1(4)

FW1DC1# sh route | inc 192.168.30.0
O E2 192.168.30.0 255.255.255.248 [110/1] via 192.168.30.162, 0:01:40, TASA

FW1DC1# sh route | inc 192.168.30.8
O E2 192.168.30.8 255.255.255.248 [110/1] via 192.168.30.162, 0:02:20, TASA

FW1DC1# sh route | inc 192.168.30.16
O E2 192.168.30.16 255.255.255.248 [110/40] via 192.168.30.170, 0:02:23, L3

FW1DC1# sh route | inc 192.168.30.24
O E2 192.168.30.24 255.255.255.248 [110/40] via 192.168.30.170, 0:03:17, L3

FW1DC1# sh route | inc 192.168.30.32
O E2 192.168.30.32 255.255.255.248 [110/1] via 192.168.30.162, 0:03:29, TASA

FW1DC1# sh route | inc 192.168.30.40
O E2 192.168.30.40 255.255.255.248 [110/1] via 192.168.30.162, 0:03:42, TASA

FW1DC1# sh route | inc 192.168.30.48
O E2 192.168.30.48 255.255.255.248 [110/1] via 192.168.30.162, 0:03:44, TASA

I do the upgrade with ASDM to 9.2(1). The same output:

FW1DC1# sh ver
Cisco Adaptive Security Appliance Software Version 9.2(1)

FW1DC1# sh route | inc 192.168.30.0
O E2     192.168.30.0 255.255.255.248

FW1DC1# sh route | inc 192.168.30.8
O E2     192.168.30.8 255.255.255.248

FW1DC1# sh route | inc 192.168.30.16
O E2     192.168.30.16 255.255.255.248

FW1DC1# sh route | inc 192.168.30.24
O E2     192.168.30.24 255.255.255.248

FW1DC1# sh route | inc 192.168.30.32
O E2     192.168.30.32 255.255.255.248

FW1DC1# sh route | inc 192.168.30.40
O E2     192.168.30.40 255.255.255.248

FW1DC1# sh route | inc 192.168.30.48
O E2     192.168.30.48 255.255.255.248

So after I do the upgrade, I cannot reach any of those routes and I don't know why.

But after I downgrade to 9.1(4), it works again.

Any thoughts???

Thank you!

PS: I do the downgrade with ASDM, when the FW comes up again, the boot system still shows as 9.2(1)

downgrade /noconfirm disk0:/asa914-smp-k8.bin disk0:/oldconfig_2016jun12_0222.cfg

FW1DC1# sh run | inc asa
boot system disk0:/asa921-smp-k8.bin

When it doesn't work, what

Philip D'Ath — Sun, 12 Jun 2016 04:46:47 GMT

When it doesn't work, what appears in the firewall logs?

I'm going to guess a NAT issue, but that is just a guess.

Hi Philip,

PiEich — Mon, 13 Jun 2016 12:38:59 GMT

Hi Philip,

I would need to do the upgrade and downgrade again to get the logs but I haven't seen anything in particular.

But if it was a NAT issue, wouldn't it be happening on the current version as well?

Thank you!

The NAT engine in the ASA was

Philip D'Ath — Mon, 13 Jun 2016 20:18:51 GMT

The NAT engine in the ASA was replaced at some version I can no longer recall. I'm guessing you might be on either side of that boundary, and NAT might need some minor tweaking after the upgrade.

You'll see issues in the log if this is the case.

Ah, that's right but it was

PiEich — Tue, 14 Jun 2016 00:36:55 GMT

Ah, that's right but it was prior to 9.1(4), I think it was 8.3 or so...

Thank you!

topic Hi Philip, in Network Security

OSPF behavior after upgrading ASA5512

When it doesn't work, what

Hi Philip,

The NAT engine in the ASA was

Ah, that's right but it was