CSCux45179 - SSL sessions stop processing -"Unable to create session directory" error

[patoberli]

Just hit the bug CSCux45179 today after I upgraded yesterday to 9.1.7 because of the high critical IPSEC vulnerability. As this is my VPN gateway, this is a bit problematic :(

Since I rebooted the ASA it works again, but I wonder for how long. The last uptime was only ~30 hours.

This here is just as a warning for you. If anybody finds a workaround, I would happily test it out.

[Kanes Ramasamy]

Hi Guys,

Just wanted to update,

Last week i updates 6 of my firewalls to version 9.2(4.5) and we had encountered a lot failures due to the proxy arp issues and then there were some missing routes/configuration on the firewall after an upgrade from version 9.1(4). The finally we decided to downgrade the firewall back to the older version and when downgraded the EIGRP did not work. After a couple of hours t-shoot with TAC, we realize the "no auto-summary' command was missing, we fixed it after adding that back in.

Note: Upgrading to 9.2(4.5) will make the no auto-summary command hidden and it will only appear if you do the show run all router eigrp, hence downgrading the firewall again caused the command to go missing. 

Apart from that anyone having issues after upgrading to version 9.1(6.11)?

Please share you thoughts.

Thanks and Regards,

Kanes.R

[rynocmu79]

We've been running 9.1.6.11 (downgraded from 9.7.1) for about 5 days now without any issues.  Let's hope it stays that way :)

Regards,

Ryan

[Kanes Ramasamy]

Hi Ryan,

Thanks for the update. 

Regards,

Kanes.R

[francisgibbons]

I upgraded a cluster of 5550 and they exhibited that bug about 48 hours after upgrade.  What I noticed is that from the time I read the SA to the time I did the upgrade Cisco had changed the fixed version to 9.1(6.11) versus 9.1(7) so we got caught out.  Reviewing the SA later we can see that it had been updated.

[stpehen gagliardi]

This is still an issue, there is no point update.  You must downgrade to 9.1.6(11).