ASA 5506-x loosing its rules

[daddum61]

Installed 2 5506-x on 2 separate networks but identical config

they work ok for approx 3 days and then stop passing anything,

i am unable to access the devices and when rebooted they seem fine except the firewall rules have gone, all other config is ok

there is also no crash info

any ideas ?

they are internal firewalls on an old network that uses public ip addresses as it is not connected to the internet

thanks

[Marius Gunnerud]

What software version are you running on the ASA5506 ?  Are these in a HA pair? Also, are you using the Firepower module in the ASAs at all? 

Have you tried issuing a clear conn to see if there are stale connections that is causing this issue? Have your checked memory usage to see if there is a possible memory leak?

As for the configuration going missing, When you say firewall rules, I assume you mean the access lists?  Do all ACLs that are configured dissapear or just some of the newer added entries?

What is the confreg value configured on your ASA (should be 0x1)?  Can be seen in show version.

[daddum61]

These are stand alone firewalls, not part of a HA pair and i am not using firepower at all.

when they go wrong and i try to remotely connect to them, dome times i have to get someone to locally reboot them before i can access them.

It seems strange that the firewalls are on separate LAN's but typically they get the same problem within a few hours of each other.

it is the access list that goes and the guys locally have just been restoring from a backup to get the firewall working again and then it's ok for around 3 days.

i will check the confreg value and see what it is.

the only thing that is a little non-standard is that for the outside interface i have created a BVI and placed 4 of the switchports in the BVI. then 2 of these ports are connected (via media converters) to the end of a fibre ring that runs around 4 remote sites, the traffic is pretty light but the ring is running HiPER Ring for redundancy, however the ring is not yet complete.

I was going to try clear the BVI and put the 4 outside ports in an Etherchannel to see if that made any difference,.

[daddum61]

checked mem today, no leakage

and conf reg is 0x1

i did disable firepower as it was not disabled

[Marius Gunnerud]

I am assuming you are saving the configuration after the rules have been added? You might want to upgrade your firewalls as this sounds like it is a bug.  If upgrading doesn't solve the issue I suggest opening a TAC case.