Problem with authentication on ASR1002-X

[Alex Pashko]

We observe a periodic authentication problem on our 2 ASR1002-X.

It is impossible to get to the device either under local accounts or through tacacs, only reboot helps.

The software on the two ASRs is the same Cisco IOS Software [Fuji], ASR1000 Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 16.9.4, RELEASE SOFTWARE (fc2)

Please tell me what could be wrong and how to fix it?

[Mohammed al Baqari]

Hi,

Configure logging to external server and change the level to debugging.

Then read the logs when it happens. You might be having suck remote
sessions which hits the max limit.

Also, ensure vty timeout is configured.

**** please remember to rate useful posts

[Alex Pashko]

what debug will be helpfull to troubleshoot this issue?

[Alex Pashko]

There is no possibility to send logs to an external syslog.

We have not many tsp sessions on the router, almost all of them are in the ESTAB state.

N2040-M10-ASR#show tcp brief 
Load for five secs: 20%/4%; one minute: 23%; five minutes: 26%
Time source is NTP, 11:50:44.214 Moscow Tue Jul 12 2022

TCB       Local Address               Foreign Address             (state)
7F707FD2B638  172.17.253.12.179          172.17.253.1.23468          ESTAB
7F70783F7F58  172.17.253.12.646          172.17.253.30.39427         ESTAB
7F707FD33A58  172.17.253.12.22722        172.17.253.1.646            ESTAB
7F70C6480CE0  172.17.253.12.30861        172.17.253.3.646            ESTAB
7F707DD09258  172.17.253.12.179          172.17.253.30.19210         ESTAB
7F71051E7888  10.4.15.37.37806           10.4.15.38.179              ESTAB
7F70EF8E6278  172.17.255.210.47658       10.6.141.40.49              FINWAIT1
7F70787347E8  172.17.255.210.22          10.6.167.156.61068          ESTAB
7F71228E92F8  195.43.90.6.36664          195.43.91.19.179            ESTAB
7F712700A590  195.210.187.166.39712      195.210.187.165.179         ESTAB
7F705D281D58  81.211.26.66.179           81.211.26.65.19342          ESTAB

Does it make sense to configure TCP keep alive  in this case?

[MHM Cisco World]

use TCP keep alive under VTY, this clear session when no response from one end.

[Aref Alsouqi]

This behaviour to me would suggest a software bug that is causing this issue. I would ensure to install the latest recommended release for that platform, alternatively, I would raise a TAC for further investigation.

[thomas · Accepted solution]

You have not provided any configuration information, logs, or error messages to troubleshoot.

Please create a TAC case so they can troubleshoot with the required information.

See How to Ask The Community for Help for future requests with troubleshooting.