Hi all,
I have an ASA 5510 that sits between our DMZ and our internal network. I've tried replacing it with a 5515 with disastrous results.
I'm working on replacing our organization's older ASAs with 5515s. I've replaced six 5510s and 5512s by saving the running configuration, fixing up the interface names, pasting the modified configuration to the new 5515 and powering them up. However, this last ASA is giving me fits. When I put the 5515 in place, access to some hosts is blocked, and these hosts are random. For example, Host A might not be available until the ASA is rebooted. Afterwards, it is, but other hosts are unreachable. Another reboot results in, again, different hosts being unreachable.
I thought that perhaps something was wrong with the 5515 I was using, so I grabbed my spare 5515 and used it. This resulted in the same type of symptoms. Configuring the 5515 from scratch, line by line to rule out cut/paste errors, didn't resolve the symptoms.
If I replaced the current 5510 with a different 5510, there were no problems - everything worked as expected.
Flushing the ARP cache (and verifying the routes) on our internal core switch had no impact. In fact, the ARP cache on the switch looked like it correctly updated with the new MAC.
Unfortunately, when this happened I didn't have a lot of time to document the exact behaviours or perform firewall/switch debug/diagnosis. I'm looking for assistance and suggestions about what exactly might be happening and how to resolve it. The next time I attempt to upgrade this, I can try to grab some logs (etc).
Thanks,
Greg
