BUG in 9.4.1 CSCub40805

[ugabichipaopao]

Hello dear friends

A have the same BUG on  ASA 5525x imag 9.4.1 

CSCub40805 - all the same. Can somebody open a ticket on cisco service, I have not permition to open service request. 

BUG link: https://tools.cisco.com/bugsearch/bug/CSCub40805/?referring_site=bugquickviewclick

Regards

Max

[yammari01]

HI,

I have this bug for the second time now (during the past 6 months) on the same equipement, the first time on an ASA 5515 version 9.4.1, then all again after upgrading it to 9.4.2.

FYI: In case your firewall is in a cluster, don't try without preparation a failover & a restart as it will crash one of the ASA. You will need to manually restart the faultly operationnal device to recover a fully connectivity

A case has been open :)

Regard

[skele9802274]

Hi,

Was this case ever resolved?  I have the same issue on ASA running 9.4(1).

Regards

Matt

[agulle]

Looks like nothing happens on Cisco side.

The Bug CSCub 40805 talks about only three affected releases. Obviously other releases are also affected.  I have a customer who ran in this problem 4 times in the past 12 month.  We went through several upgrades in this time period.  Now we are running 9.3(3) 7 on this box and it recently happened again.

I also would be very interested how the case of yammari ended.

Regards

Andreas

[infrastructurepp]

I had my second instance of this issue about three weeks ago. They suggested I try a newer version of ios, but they couldn't give me a number that was confirmed to be free from this bug. I'm currently running 9.4(2)11 on all of my firewalls, but the only ones that have had this problem were in an active/standby configuration. The first time it happened I was able to reload the standby and fail over to it to reload the primary; however, the second time the standby wouldn't resync with the primary so I had to reload them both at the same time. This caused about a 5 minute outage and I lost several recent changes. I'm not sure why the bug hasn't been updated to show 9.4.2 as an affected release because I've opened two separate support cases and they have attributed my issue to this bug both times. I don't really want to roll back to 9.2(1) which is the latest known fixed release so I have started reloading both firewalls every other week to keep the problem from happening again. Hopefully they will come up with a known good release soon.

[crescentwire]

I'm also seeing this bug on a non-active/standby configuration (single 5512-X running 9.4(2)11). The bug behavior shows up here:

ASA# wr me
Building configuration...
Cryptochecksum: blah blah blah blah blah 

%Error opening disk0:/.private/startup-config (Too many open files)
Error executing command
[FAILED]
ASA# 

But what is especially concerning is the behavior when I try to view the startup-config:

ASA# sh startup-config 
No Configuration

Cisco indicates that the workaround is to reload the firewall, but how can I do that if I'm not even sure my startup-config is intact? Even a simple power failure for this firewall could render it totally unusable (i.e. returned to factory defaults).

So yes, very concerning. I hope there is a solution Cisco can provide soon.

[antti.oksa]

I have now seen this a few times. Last was three weeks ago with a 5515-X with 9.5(2)2. Soft reboot (reload) fixed it again. After the reload I upgraded to 9.6(1)5. Hope to get rid of this annoying issue soon. 

[crescentwire]

Just as a follow-up to anyone who has the same issue as I did ... we ended up losing power to this affected ASA a few days ago. I was sure that it was completely unreachable and even reverted to factory defaults after not seeing it come back online. But suddenly, it was reachable again: turns out the ASA did use its last "known" startup configuration, present from a time before this bug's symptoms were triggered.

So, it turns out that even though "sh startup-config" returns no results, at least in my case, it did actually reload successfully. I would still not attempt this without local access and a console session, however.

[srue]

Add 9.4.2(11) to the affected releases. 

[nicholas.allard]

Cisco Adaptive Security Appliance Software Version 9.5(2)5
Device Manager Version 7.5(2)153

Compiled on Tue 23-Feb-16 00:10 PST by builders
System image file is "disk0:/asa952-5-smp-k8.bin"
Config file at boot was "startup-config"

 up 89 days 23 hours
failover cluster up 2 years 106 days

Hardware: ASA5545, 12288 MB RAM, CPU Lynnfield 2660 MHz, 1 CPU (8 cores)
ASA: 5175 MB RAM, 1 CPU (1 core)
BIOS Flash MX25L6445E @ 0xffbb0000, 8192KB

# wr mem
Building configuration...
Cryptochecksum: f14cdfec 221d6ee5 f0c3f1d5 fcf9f2b0

%Error opening disk0:/.private/startup-config (Too many open files)
[OK]

# show console-output:

Message #181 : ipmi_open: ERROR - failed LINA IO Open

[mmakulski]

same issue on active side of failover pair with Version 9.4(2)11

Hardware: ASA5515, 8192 MB RAM, CPU Clarkdale 3058 MHz, 1 CPU (4 cores)
ASA: 4096 MB RAM, 1 CPU (1 core)