Cisco ASA 5505 - Keeps dropping internet connection

[john.fensome]

Hi,

We are having some issues with our Cisco ASA 5505 unit, it intermittently drops the outside interface connection. Internally the network appears to be working correctly with no issues. Even though the outside interface indicates it is 'up' access to the internet is lost from our LAN. This seems to be ocourring more and more often! This is happening for all users on the network too. Reloading the ASA seems to correct the problem temporally but this isn't really an option during peak periods in the day as this would obviously hinder work being carried out by employees.

Any ideas?

Any help would be greatly appreciated!!

Thanks,

John

Running Config Below:

---------------------------------

ASA Version 8.2(1)

!

hostname ******************

domain-name *************************

enable password ************************* encrypted

passwd **************************** encrypted

names

dns-guard

!

interface Vlan1

nameif inside

security-level 100

ip address 10.3.0.254 255.255.0.0

!

interface Vlan2

nameif outside

security-level 0

ip address ***************** 255.255.255.248

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server *****************

domain-name **********************

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list outside_access_in extended permit tcp any any eq smtp

access-list outside_access_in extended permit tcp any any eq 3389

access-list outside_access_in extended permit tcp any any eq https

access-list outside_access_in extended permit tcp any any

access-list outside_access_in extended permit tcp any any eq 3839

pager lines 24

logging enable

logging asdm warnings

mtu inside 1500

mtu outside 1500

failover timeout -1

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-621.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) tcp interface smtp 10.3.0.2 smtp netmask 255.255.255.255

static (inside,outside) tcp interface https 10.3.0.2 https netmask 255.255.255.255

static (inside,outside) tcp interface 3839 10.3.0.1 3839 netmask 255.255.255.255

static (inside,outside) tcp interface 3389 10.3.0.1 3389 netmask 255.255.255.255

static (inside,inside) 10.3.0.0 10.3.0.0 netmask 255.255.0.0 norandomseq nailed

static (inside,inside) 172.16.63.0 172.16.63.0 netmask 255.255.255.240 norandomseq nailed

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 *************** 1

route inside 172.16.63.0 255.255.255.240 10.3.0.253 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 10.3.0.0 255.255.0.0 inside

http 10.3.0.0 255.255.255.0 inside

http 10.10.2.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

sysopt noproxyarp inside

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash md5

group 1

lifetime 86400

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd auto_config outside

!

threat-detection basic-threat

threat-detection statistics port

threat-detection statistics protocol

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

username ************ password *********************** encrypted privilege 15

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

!

service-policy global_policy global

[erwee1973]

Hello,

What happens when you assign eth0 as internal interface and eth1 as outside if?

Also configure logging (/debugging) to see if there are hardware issues or something else.

And it seems you have a range of public addresses. What happens when you connect a device, e.g. a laptop directly on the internet access device and send continue ping to an internet host.

When you loose internet connectivity, is the laptop still pinging to that host?

Hopefully this helps you,

Kind regards,

Ralph Willemsen

Arnhem, Netherlands

[Julio Carvajal]

Can you provide:

Sh interface ethernet 0/0

Regards,

Julio

[integreon]

Also check the interface duplex settings. If it is set to auto, force it to full. I faced similar issue with my ASA and found the duplex issue.

[vincent.monnier]

Hi John,

How many inside users/hosts have you got ?

Because, Inside concurrent Hosts are limited depending of your SA licences and options.

You can check that limit insing the following command "sho ver |  inc Inside Hosts"

If I remenber well, the control is based on nat translation rules, in order to verify if it's your root cause issue, you can try to do a "clear xlate" the next time problem occurs in order to clear the translation table of the ASA.

Vincent

[mickyq]

Hi John

Ive had a similar problem. The issue turned out to be what Vincent states above but clear conn worked rather than clear xlate.

do a show ver and see what licence you have and how many inside hosts are supported.

enable logging. not sure what level but I have enabled buffer logging level info and can see Deny traffic from x.x.x.x to x.x.x.x host limit of 10 exceeded.

You might need the 25 user licence