ASA 5545 blocks traffic

[ckolesar]

I have two Cisco ASA 5545 firewalls.  I am having a problem where every month or two the primary ASA fails to where it blocks all outbound traffic.  The fix is to manually fail over to our secondary ASA, which then allows proper traffic flow. I realize that if I were able to do some troubleshooting while it was down, that would be the best solution for me, but b/c it brings all our remote sites down to us as well as outbound traffic- its very time sensitive and I just dont have time to troubleshoot it while its not working.

I have the ASA sending logs to a syslog server, and I have sent those off to Cisco TAC, but they have not had much luck on determining the cause.

My ASAs are mainly acting as a firewall and providing isakmp/ipsec connectivity to our remote sites.

I am not an expert on the ASA's so please bear with me on that.

Both devices are running the following:

Cisco Adaptive Security Appliance Software Version 9.4(4)16
Device Manager Version 7.7(1)150


-------------------[ firepower1 ]-------------------
Model                     : ASA5545 (72) Version 6.0.0 (Build 1005)
UUID                      : ae10699c-c05c-11e5-9090-83918997b897
Rules update version      : 2017-11-09-001-vrt
VDB version               : 264
----------------------------------------------------

Any help is appreciated.

Thanks!

[balaji.bandi]

its hard to say for the few details your provided.

what happens when you Fail-over to standby  - remain standby as primary  ? ( do you see any issue with the secondary  also ?)

[ckolesar]

So that is what i have set now-- i have failed over to secondary and have been running that as the active primary for the time being.

I have not tried staying on the secondary to see if it has the same problem. I always reboot the primary and then make it active.

Are you saying I should stay on the secondary and see if I ever have the problem-- as a troubleshooting step?

[venkat_n7]

can you provide logs, at the time of trouble, like before the trouble starts and after the trouble. best thing we can suggest is by looking logs.

[ckolesar]

Thanks for the response. I have added a log file.  Its includes about 8 mins before the incident and during the incident. I have more logs, but they are for the whole day. I can parse them down a bit, if needed and post more. 

I think I did the manual failover around 9:42am

[venkat_n7]

hi,

i see nothing about failover related in logs. i think it should be os bug issue or hardware problem.