Problem with ASA 5505

eduardodewes — Mon, 11 Mar 2019 21:18:07 GMT

Hello, I have an ASA 5505, firmware 7.2 (4). Configured ACLs, NAT, it's all working, but after a while it seems that running crashes, no longer makes the directions of NATs, the logs until they stop working. To resolve, I have to restart the ASA, and everything will work again. Could it be a firmware problem, someone has had a similar problem?

Problem with ASA 5505

eduardodewes — Mon, 29 Aug 2011 13:37:47 GMT

ASA Version 7.2(4)

hostname ciscoasa

domain-name cvnatural.local

enable password 2KFQnbNIdI.2KYOU encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

name 189.11.**.*** oi234

name 172.16.0.140 local

name 189.11.**.*** oi235 description oi235

dns-guard

interface Vlan1

nameif inside

security-level 0

ip address local 255.255.252.0

interface Vlan2

nameif outside

security-level 0

ip address oi234 255.255.255.248

interface Vlan13

shutdown

nameif inativo

security-level 0

no ip address

interface Vlan23

shutdown

no nameif

security-level 0

no ip address

interface Vlan33

shutdown

no nameif

security-level 0

no ip address

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

switchport access vlan 23

interface Ethernet0/2

switchport access vlan 33

interface Ethernet0/3

interface Ethernet0/4

switchport access vlan 13

interface Ethernet0/5

switchport access vlan 13

interface Ethernet0/6

switchport access vlan 13

interface Ethernet0/7

switchport access vlan 13

banner exec CRV - ACESSO RESTRITO

banner login CRV - ACESSO RESTRITO

banner motd CRV - ACESSO RESTRITO

banner asdm CRV - ACESSO RESTRITO

ftp mode passive

clock timezone BRST -3

clock summer-time BRDT recurring 2 Sun Oct 0:00 3 Sun Feb 0:00

dns server-group DefaultDNS

domain-name cvnatural.local

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

object-group service DM_INLINE_TCP_1 tcp

port-object eq ftp

port-object eq ftp-data

object-group service DM_INLINE_TCP_2 tcp

port-object eq www

port-object eq https

access-list CRV_splitTunnelAcl standard permit any

access-list inside_nat0_outbound extended permit ip any 172.16.0.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.252.0 any

access-list inside_access_in remark DNS

access-list inside_access_in remark SMTP

access-list inside_access_in extended permit udp 172.16.0.0 255.255.252.0 any

access-list inside_access_in extended permit tcp 172.16.0.0 255.255.252.0 any

access-list inside_access_in extended permit ip 172.16.0.0 255.255.252.0 any

access-list inside_access_in extended permit ip interface outside 172.16.0.0 255.255.252.0

access-list inside_access_in extended permit tcp interface outside 172.16.0.0 255.255.252.0

access-list inside_access_in extended permit udp interface outside 172.16.0.0 255.255.252.0

access-list outside_access_in extended permit object-group TCPUDP any any eq www

access-list outside_access_in extended permit tcp any any eq 81

access-list outside_access_in extended permit icmp any any

access-list outside_access_in extended permit tcp any any eq https

access-list outside_access_in extended permit tcp any any eq domain

access-list outside_access_in extended permit ip 172.16.0.0 255.255.252.0 interface outside

access-list outside_access_in extended permit object-group TCPUDP 172.16.0.0 255.255.252.0 interface outside

access-list crv standard permit any

access-list outside_1_cryptomap extended permit ip 172.16.0.0 255.255.252.0 any

pager lines 24

logging enable

logging buffered alerts

logging trap alerts

logging asdm informational

mtu inside 1500

mtu outside 1500

mtu inativo 1500

ip local pool CRV 172.16.3.150-172.16.3.160 mask 255.255.252.0

no failover

monitor-interface inside

monitor-interface outside

monitor-interface inativo

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-524.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 172.16.0.0 255.255.252.0

static (inside,outside) tcp interface www 172.16.0.22 www netmask 255.255.255.255

static (inside,outside) tcp interface sip 172.16.0.102 sip netmask 255.255.255.255

static (inside,outside) tcp oi235 www 172.16.0.4 www netmask 255.255.255.255

access-group inside_access_in in interface inside

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 189.11.**.*** 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

http server enable

http 172.16.0.0 255.255.252.0 inside

http 201.22.57.115 255.255.255.255 outside

http 200.146.84.147 255.255.255.255 outside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

sysopt connection tcpmss 0

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto dynamic-map outside_dyn_map 20 set pfs

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5

crypto map outside_map 1 match address outside_1_cryptomap

crypto map outside_map 1 set pfs group1

crypto map outside_map 1 set peer 187.16.33.130

crypto map outside_map 1 set transform-set ESP-3DES-SHA

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

crypto isakmp enable inside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash md5

group 2

lifetime 86400

crypto isakmp nat-traversal 20

crypto isakmp ipsec-over-tcp port 10000

vpn-sessiondb max-session-limit 25

telnet 172.16.0.0 255.255.252.0 inside

telnet timeout 5

ssh 172.16.0.0 255.255.252.0 inside

ssh timeout 5

console timeout 0

dhcpd auto_config outside

webvpn

port 444

enable inside

group-policy CRV internal

group-policy CRV attributes

dns-server value 172.16.0.253 172.16.0.19

vpn-tunnel-protocol IPSec l2tp-ipsec webvpn

group-lock value CRV

ipsec-udp enable

ipsec-udp-port 10000

split-tunnel-policy excludespecified

split-tunnel-network-list none

nem enable

username luis password QYp.GVVJsgLuHoKE encrypted

username master password Z4lv47kJo.V6M7HB encrypted

tunnel-group DefaultL2LGroup ipsec-attributes

pre-shared-key *

tunnel-group CRV type ipsec-ra

tunnel-group CRV general-attributes

dhcp-server 172.16.0.253

tunnel-group CRV ipsec-attributes

pre-shared-key *

tunnel-group CRV ppp-attributes

authentication pap

authentication ms-chap-v2

authentication eap-proxy

tunnel-group 187.16.33.130 type ipsec-l2l

tunnel-group 187.16.33.130 ipsec-attributes

pre-shared-key *

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

service-policy global_policy global

prompt hostname context

Cryptochecksum:14b4c4e2494f30db95c157d8727f8279

: end

Problem with ASA 5505

varrao — Mon, 29 Aug 2011 18:02:05 GMT

Hi Eduardo,

Whenever the device stops passing traffic, I would suggest you to kindly take captures on the firewall, to check if the request is going through the ASA and if you are able to get any reply back from the ISP device. Because I had a previous experience where in the ISP device was losing the arp entries aftemr every fixed time and the resolution was to create static arp for the ASA on the ISP device.

For taking captures:

https://supportforums.cisco.com/docs/DOC-1222

Thanks,

Varun

topic Problem with ASA 5505 in Network Security

Problem with ASA 5505

Problem with ASA 5505

Problem with ASA 5505