ASA Monitoring Connection, Disconnected in ASDM

[dguse]

I have a 5520 ASA running 8.2(1) and ASDM 6.2(1). The ASA has been running for 223 days without issue. Today it stopped showing real time status on the Device Dashboard from within ASDM. All of the graphs state "Lost connection to Firewall."

I try to manually reconnect but it will not. I have tried on a couple different computers and cannot get the monitoring connection to work.

It is a very busy firewall and I will have to schedule for a restart (which I was thinking of doing) even though I do not see a memory issue as per snip below. I don't want to restart unless it is the best option.

GW#  sh mem
Free memory:      1816431640 bytes (85%)
Used memory:       331052008 bytes (15%)
-------------     ----------------
Total memory:     2147483648 bytes (100%)

Has anyone seen this before?

Thank you,

Darren

[Federico Coto Fajardo]

Darren,

You can still connect via CLI (telnet/SSH)?

The problem is only via ASDM?

If you can access the CLI, we can check why ASDM is unaccesible....

Federico.

[dguse]

Hi Federico,

I can connect via SSH to the CLI no problem. I can also connect and work in ASDM, I can also run the real-time log viewer. I just do not get any real time statistics like connections per second, CPU Usage, etc.

Thank you for your response,

Darren

[Federico Coto Fajardo]

Darren,

I'm currently logged in an ASA using ASDM and viewing the Real-Time Log Viewer.

What I see is the real-time activity as enabled by the logs, in my case I have:

logging enable
logging buffered debugging
logging asdm informational

Do you mean you don't see specific log messages you we're seeing before?

Federico.

[dguse]

It worked fine until I logged in today. Please see attached jpg

[Federico Coto Fajardo]

I believe that you still have access to the ASDM (you can browse between windows as normal), but you have no HTTPS connection to the ASA.

I mean... the only time I've seen that error is when there's connectivity lost to the ASA (from the PC via HTTPS).

Can you do the following:

Close ASDM, and reopen it again.

Federico.

[dguse]

I have tried and also rebooted the computer and tried again AND tried another computer. Same results.

[Federico Coto Fajardo]

Lost connection to the Firewall is that there was a communication problem with the ASA.

When you recover connectivity, the error goes away and you start seeing the statistics again.

This is the test that I'm doing:

1. ASDM works fine

2. I lost my Internet

3. ASDM still works, but I get your messages on the home screen (Lost connection to the firewall)

4. I reconnect Internet on my PC

5. The error dissapears, and ASDM functions as normal

If you're still having the problem do the following:

Instead of opening ASDM normally, connect via https://x.x.x.x

Just change x.x.x.x to the IP of the ASA and see if it works.

Federico.

[dguse]

I am not loosing connection with the ASA. I can still modify settings on the ASA via the ASDM. But I do not get real time feedback from the ASA which is called the monitoring connection.

I have tried from several different computers, but all do the same thing. Sometimes when you leave the ASDM console up for an extended time, you will loose the Monitoring Connection. Down at the bottom of the screen there is an icon with a 2 computers with a red  X over it. If you click on it a  window will pop up that allows you to click a button marked Reconnect. This will usually bring the Monitoring Connection back up.

As it stands right now, when I initially start up ASDM, the Monitoring Connection is in a Disconnected state and I cannot get it to restart even when I click on the above mentioned "Reconnect" button.

but I can still make changes to the ASA via the ASDM tool, and I can look at the configuration via ASDM. I can also run the real time logger and watch syslog messages fly by.

Darren

[dguse]

Issue was resolved with a restart of the ASA5520. Not sure what caused the issue, but all is well after a restart.

ASA5520 was up and running for 237 days at that time.

[dguse]

Issue has returned after 17 days.

Seems like the issue is getting worse.. Any ideas what is causing ONLY the ASA Monitoring Session not to work. ASDM is working and I am able to connect to the ASA and even modify the config via ASDM. Just no longer getting real time stat's from the device.

Darren

[Ajay Saini]

Hi,

Can you please try following:

--uninstall java and asdm and their corresponding cache and folders from the concerned machine.

--install the java and asdm again and see if it works.

I was working with one of my customers and reinstalling asdm worked for me.

AJ

[mccollins3]

Hello, I see that this particular issue is unresolved.  I also have  the identical issue with a Cisco ASA 5550, version 8.2.1, ASDM version  6.4.7, java version 1.6.0_35 (under OS-X server 10.6.8).  After years of troubleshooting this in a sporadic fashion, the only thing I've seen to fix this ASA state is to reload the ASA.

I've tried connecting with different versions of java  from various clients and operating systems and to no avail, the issue  resurfaces.  I'm nearly certain what is causing this "Lost Connection to  Firewall" failure is if I leave the ADSM client open (and logged in)  for an extended period of time.  I don't know exactly what the amount of  time that the connected ASDM client is idle causes the asdm_handler to  not respond on the ASA.  Although, I have not seen this problem  exhibited if the ASDM-connected client goes idle for 4 hours or less.   Note, that timeframe is an approximation - could be more like 8 hours.   The times it is most memorable is when I revisit the ASDM client the  next day, and I realize I forgot to exit the ASDM app.  So, what I do  now is make the necessary changes to the ASA via the ASDM interface,  then close the ASDM app.  Now, the reason I am responding here now is I forgot to do that yesterday and my ASA is in a similar unwanted state.  I've been tracking this thread for a while now and was hoping to be offered a suggested solution.  But it appears I will be scheduling an ASA reload.

Therefore IMHO, my take on this is the idle ASDM client is neglecting to interact with or send a response to the ASA in a timely manner, and this causes the asdm_handler service or daemon on the ASA to enter this unwanted, unresponsive state where ACLs can be edited and applied, but system resource, traffic status graphs, etc. cannot be viewed.

I'm wondering if anybody has seen this issue with later-version ASA firmware and/or ASDM version?

Thanks kindly,

mc

[dguse]

Hi Michael,

The issue was with version 8.2(1). Upgraded to 8.2(4) and ASDM 6.4(1) and the issue was resolved.

Thanks,

Darren

[MagnusBjurquist]

I'm running ASA 8.6(1)2 and ASDM 6,6(1) from a Windows 2008 R2 Standard Server with java 6.25 and am encountering the same issue. So this problem seems to have resurfaced....