ASA-AWS - ASAv keeps crashing.

[IQNetAdmin]

We have an ASAv configured in AWS.  It keeps crashing periodically and I'm trying to determine the cause.

Version: Cisco Adaptive Security Appliance Software Version 9.6(4)

I've attached the "show crashinfo" output.

Can somebody please assist?

[Sheraz.Salim · Accepted solution]

is this a new deployment? was it working fine and all of sudden you having issue with this ASA. seem you are hitting a bug. consider upgrade to 9.8.4.x

[Pulkit Saxena]

Hi,

9.6.4 has some known issues, so it will be better to run an interim/latest Cisco suggested release in the same train.
However going by the "crashinfo", it seems you are hitting :
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvi16029
We are seeing an increase in number for this issue with increase in remote work users.
For official check, to perform an upgrade if needed, you can open a TAC case.

-
Pulkit

[Sheraz.Salim]

@Pulkit Saxena the crash file showing Thread DATAPATH-1-1573 and the bug you mentioned is webvpn.are they not two different issues?

[Pulkit Saxena]

There is another one in the thread :
Thread Name: Unicorn Proxy Thread
Page fault: Address not mapped
This is points to WebVPN, and in addition i have decoded the traceback which points to the caveat which i have provided.
However as I mentioned, code recommendation or confirmation should come from TAC and not on community discussion.

-
Pulkit

[Sheraz.Salim]

@Pulkit Saxena with all due respect in regards to TAC confirmation on software its depends some end user does not have a support contract etc and they why they come to cisco community seeking advise. i think you last comment was not appropriate.

[IQNetAdmin]

This is not a new instance.  We've been running into this issue for awhile now.  It would crash every couple of months.  It's now crashed 4 times in the last 3 days.

@Sheraz.Salim is correct.  This is an ASAv that is licensed through the AWS Marketplace so we have no access to TAC support besides the community.  See https://aws.amazon.com/marketplace/pp/B00WH2LGM0#pdp-support that describes our support options.

Thinking back on history.... I believe this issue started happening after we enabled the WebVPN, but I can't say that for 100% but if we are hitting the bug that you pointed out, that would make sense.  

I am running into the issue from this post as well about trying to get updates.  Any suggestions on how to get access to an update?

https://community.cisco.com/t5/network-security/asa-aws-unable-to-access-software-updates/td-p/3859953

[Pulkit Saxena]

As i said in one of my earlier posts, this issue is seen a lot recently with increase in number of remote users per device.
In case you have the privilege to perform an upgrade, please go for it, as it will definitely help in not just this issue but many more caveats which are there on base 9.6.4.
You can check cisco ASA release notes for all the bug fixes available in this train's recent release.
https://www.cisco.com/web/software/280775065/141317/ASA-964-Interim-Release-Notes.html

-
Pulkit

[jimholla]

If you can upgrade, for maximum performance please consider 1)uprading to version 9.13.1 and 2)running on a c5 instance. The c5 performance is way better than the c3, c4, and m4.

[IQNetAdmin]

@Pulkit Saxena I would LOVE to upgrade to a more recent version.... but as I said... I'm running into the same issue this poster had. https://community.cisco.com/t5/network-security/asa-aws-unable-to-access-software-updates/td-p/3859953

As I said as well... since this is an AWS ASAv subscription through the AWS Marketplace, the only support is through the community.   

If somebody can point to the correct way to upgrade... I'm all for it.  

[Sheraz.Salim · Accepted solution]

I strongly suggest of upgrade 9.8.4. its a gold start release and we already using in production we have not seen any issue in regards to anyconnect.

here is the link https://software.cisco.com/download/home/286119613/type/280775065/release/9.8.4%20Interim

unless @Pulkit Saxena disagree with this. we are all here to help each other. I have a great respect for Pulkit and for TAC.

hope your issue will resolve and you get the stability.

here and here this document explain how to upgrade the software on ASA

[IQNetAdmin]

When I try to download the suggested release... I get the following:

Service Contract Required

To Download this software, you must have a valid service contract associated to your Cisco.com profile.

If you do not have a service contract you can get one through:

• Your Cisco Account Team if you have a direct purchase agreement with Cisco
• Your Cisco Partner or Reseller

Once you have the service contract you must associate your service contract to your Cisco.com user ID with Profile Manager

How can I download?

[Sheraz.Salim · Accepted solution]

In order to download the software you need a service contract with cisco. unless you ask your cisco local representative. which seem like you do not have a contract with cisco.

[Pulkit Saxena]

@sheraz, So there is a certain level of accountability needed with every answer which we indeed posses. However for certain organisations/companies, upgrade or bug confirmation always comes from TAC.
That is why even though I did provide the answer, still informed the requester to check with TAC if required as per their organisation norms.

I consider this appropriate to let them take the call as needed with complete information provided from our side.

-
Pulkit

[Vin Daniell]

This is not solved. I have the same issue and I am on the latest code from AWS. 9.15(1)15. I have rebuilt in AWS many times to no avail.

There is obviously an issue with ASAv in AWS that is not resolved. Cisco needs to quit defaulting to telling people to upgrade to fix the issue. I am a partner and have a very unhappy client and cannot get support because this is in AWS. This is a bad situation all around and reflects badly on Cisco.