topic Re: Clearing ARP on firewall restores connection in Network Security

Clearing ARP on firewall restores connection

Suresh Varghese — Fri, 21 Feb 2020 15:39:13 GMT

Hello

I currently have an ASA5505 running Version 9.1(6)

The outside interface of the firewall is connected to ADSL router which in turn is connected to the internet

Every now and then...the connection drops and i am not able to ping the ADSL modem IP which is the gateway (default route) on the ASA

When i do a clear ARP on the ASA...it starts working

I assume that this is not the ASA acting up but is an issue with the next hop device but how can i resolve this.

I would appreciate if anyone can shed some light in helping me sort this matter out.

many thanks in advance.

Sureshv

Re: Clearing ARP on firewall restores connection

Florin Barhala — Thu, 19 Apr 2018 12:53:25 GMT

Let's tshoot this together.
First of all we have to find out the ARP entry that's causing trouble.

Can you post:
show run route
show nameif
show arp | i outside

Re: Clearing ARP on firewall restores connection

Marius Gunnerud — Thu, 19 Apr 2018 20:48:54 GMT

How often does this issue happen?

There is a bug related to proxy-arp that can cause this type of behavior. Have a look

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuy28710/?rfs=iqvred

Re: Clearing ARP on firewall restores connection

Suresh Varghese — Sun, 22 Apr 2018 04:37:20 GMT

Hello Florin,

Sorry for the delayed response, please find attached the output that you had requested for

regards

Re: Clearing ARP on firewall restores connection

Suresh Varghese — Sun, 22 Apr 2018 04:40:56 GMT

Hi Marius

The issue happens randomly....like whenever it feels like, no specific time of period.

As for the bug, we suspected the same and upgraded the firmware from version 8 to 9.1.6

Based on the table provided in the link by you, does it mean i have to upgrade to a more higher version.

regards

Re: Clearing ARP on firewall restores connection

Marius Gunnerud — Mon, 23 Apr 2018 06:18:06 GMT

You could also set up a capture on the ASA inside and outside interfaces when this is happening to see if traffic is actually being sent out the outside interface. Also, before clearing the ARP table, check to make sure that the MAC to IP address mappings are correct for the default route.

Re: Clearing ARP on firewall restores connection

Florin Barhala — Mon, 23 Apr 2018 08:20:05 GMT

What I am interested in as next step: next time you have this issue does the ARP entry looks the same as before :

outside 192.168.253.1 58ef.6809.a192 18

and of course after you clear ARP do you get same mac address?