07-18-2023 08:46 AM
Hey guys!
I hope this message finds everyone well.
I have a problem where an ASA 5525 is showing inconsistency in the connections.
at random times VPN Client connections via anyconnect are dropped and the firewall stops responding and forwarding packets to the WAN. The connection only returns after we start a "ping" from the ASA to the outside or outside to the firewall's WAN.
I already created a task to trigger a ping to the google dns through the WAN and a LAN IP through the packet-tracer but it didn't solve the problem.
Does anyone have any idea what it could be or if it could be a version bug? The firmware we are using is Cisco Adaptive Security Appliance Software Version 9.13(1)
07-18-2023 09:00 AM
can you share the log message
07-18-2023 10:08 AM
Hi,
This is also a problem, no error codes or logs appear.
The WAN interface simply stops responding to packets as if it went into standby and only returns after ICMP sessions.
The only error message that appears is when trying to login to anyconnect "Connection attempt has timed out. Please verify internet connectivity"
Despite the error message mentioning a local connection failure, the problem is in the ASA's own WAN interface which simply dies.
07-18-2023 10:19 AM
standby <<- your run ASA HA ?
07-18-2023 10:29 AM
No, it's only 1 firewall.
Sorry if I expressed myself wrong. When I said "standby" I meant that the interface stops delivering packets as if it weren't in production or with the protocol down.
The interface only works again when we send ICMP packets.
07-18-2023 10:35 AM - edited 07-18-2023 10:36 AM
You use PPPoE for WAN ?
07-18-2023 10:41 AM
No.
WAN connection is done via VLAN ID for a VIP.
07-18-2023 11:25 AM
VIP of HSRP,
it seem that ASA drop G-ARP
solution
1- use sla monitor always there is ping
2- use static arp VIP-Vmac
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide