ASA and FTD Might Fail To Pass Traffic After 213 Days Of Uptime

[John]

Hi Team,

An ASA, after reaching an uptime of roughly 213 days will fail to process ARP packets leading to a condition where all traffic stops passing through the affected device. 

What woul be the best recommendation to resolve this issue?

[Marvin Rhoads · Accepted solution]

The BugID for this issue indicates that it is resolved with the interim releases that Cisco published around 3 April. Upgrading to one of those releases will resolve the bug.

Please refer to the details at the link below for "known fixed releases":

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd78303/?referring_site=bugquickviewredir

[John]

Hi Marvin,

It's confucius me a lot. Base on the link you've provided.

Conditions:
This is seen when the ASA's uptime reaches 213 days.

This problem affects ASA and FTD versions:

ASA version 9.1 releases 9.1(7)8 and higher
ASA version 9.2 releases 9.2(4)15 and higher
ASA version 9.4 releases 9.4(3)5 and higher including 9.4(4)
ASA version 9.5 releases 9.5(3) and higher

But the known fixed releases was 9.5(3.8),

It's means 9.5(3.8) was also affected with the bug?

[Marvin Rhoads]

John,

The bug affects the 9.5(3.x) versions before 9.5(3.8). That includes all the earlier interim releases of 9.5(3) - both the base 9.5(3) and interim releases like 9.5(3.2) and 9.5(3.6).

Once 9.5(3.8) is released (it's not up on cisco.com just yet) you will be able to go to the downloads page and see the release notes for 9.5(3.8) which will confirm the bug fix is included in that release.

[John]

Hello Marvin,

Thanks for the information. What you recommend to us?

Cisco Adaptive Security Appliance Software Version 9.5(3)
Device Manager Version 7.5(2)153

ASA5515 up 200 days 21 hours
failover cluster up 1 year 91 days

[Marvin Rhoads]

In your case I would go ahead and upgrade to ASA 9.6(3.1). That release includes the bug fix.

https://software.cisco.com/download/release.html?mdfid=284143128&flowid=31442&softwareid=280775065&release=9.4.4%20Interim&relind=AVAILABLE&rellifecycle=&reltype=latest

[John]

Thank's Marvin