topic Weird ASA issue in Network Security

Weird ASA issue

Rick Twells — Tue, 12 Mar 2019 00:04:37 GMT

Hi,

Wondering if anyone else has seen the following issue... We has 2 5520 ASA's running 8.4(3) HA in routied mode with 2 contexts and randomly after weeks and weeks of running perfectly it decied to stop dealing with new connections from new hosts. exisiting hosts seemed to be unaffected if we killed those connections the working hosts stopped and were unable to reestablish connecvity.

Some of the things we tried (and failed) to fix the issue:

clear arp

clear xlate

i checked routing end to end and found no issue, no-one was on the asa at the time or changed any infrastructure inbetween. i did want to clear the connections but was told to give it the old IT favorite (reboot) before.

Ive googled and searched here but cant find anything to match what we experienced.

The logs from the time pretty much said deny to everything but with a rule base of any any on every interface. config is attached if it helps

Thanks

Rick

Weird ASA issue

Julio Carvajal — Thu, 04 Oct 2012 22:48:40 GMT

Hello Rick,

Interesting.... Have you rebooted it already?

Regards,

Julio

Weird ASA issue

Rick Twells — Thu, 04 Oct 2012 23:19:02 GMT

Hi Julio,

Unfortunatly yes i have and it did resolve the issue for us.

Thanks

Rick

Weird ASA issue

Julio Carvajal — Thu, 04 Oct 2012 23:56:05 GMT

Hello Rick,

Yes, I have one similar issue like that long time ago ( different version, not multiple context) where all the packets where all the packets where getting denied by a mystic ACL ( non existent ). Customer rebooted the ASA during the investigation and that solved.

It looks like the some of the processes of the ASA got stuck ( in this case the ACL filtering mechanism)

Regards,

Julio

Weird ASA issue

Rick Twells — Fri, 05 Oct 2012 00:00:21 GMT

was it a bug or just one of those "solar flare" kind of explanations

Weird ASA issue

Julio Carvajal — Fri, 05 Oct 2012 00:11:40 GMT

Hello Rick,

As they rebooted the device, we could not investigated.

But we let the case open for 2 more weeks on that case so it looks like "solar flare" is the desicion.

Regards,