Cisco ASA 5515-X Alarm LED is up and Firewall not wroking

[ibbulbul]

Recently my Cisco ASA 5515-X Alarm LED is up and Firewall not working even console also not working. What is the issue? Is it Hardware issue or another things? I upgraded from 9.12.3 to 9.12.4 but same issue is remaining. Could you anyone please help me to solve the issue.

[balaji.bandi]

if there is no console?  most probable kit gone bad, raise TAC case for RMA

below is LED alarm what mean explain to you :

https://www.cisco.com/c/en/us/td/docs/security/asa/hw/maintenance/5500xguide/5500xhw/asa_overview.html#87733

[ibbulbul]

Show Controller pci is also in attached. Please check.

Primary-FW/act# sh env

Cooling Fans:
-----------------------------------

Chassis Fans:
--------------------------------
Cooling Fan 1: 6656 RPM - OK
Cooling Fan 2: 6656 RPM - OK
Cooling Fan 3: 6656 RPM - OK

Power Supplies:
-----------------------------------

Power Input:
--------------------------------
Single Power Supply Unit (Operational Ok).

Temperature:
-----------------------------------

Processors:
--------------------------------
Processor 1: 38.0 C - OK

Chassis:
--------------------------------
Ambient 1: 28.0 C - OK (Chassis Back Temperature)
Ambient 2: 27.0 C - OK (Chassis Front Temperature)
Ambient 3: 32.0 C - OK (Chassis Back Left Temperature)

Voltage:
-----------------------------------
Channel 1: 1.224 V - OK (CPU Core)
Channel 2: 12.040 V - OK (12V)
Channel 3: 5.068 V - OK (5V)
Channel 4: 3.280 V - OK (3.3V)
Channel 5: 1.504 V - OK (DDR3 1.5V)
Channel 6: 1.048 V - OK (PCH 1.05V)

ALARM CONTACT 1
Status: not asserted
Description: external alarm contact 1
Severity: minor
Trigger: closed

ALARM CONTACT 2
Status: not asserted
Description: external alarm contact 2
Severity: minor
Trigger: closed

Driver Information:
--------------------
Status : RUNNING

Driver Error Statistics:
-------------------------
I2C I/O Errors : 0
GPIO Errors : 0
Ioctl Null Ptr Errors : 0
Poll Errors : 0
Invalid Ioctl Errors : 1
PECI Errors : 0
Unknown Errors : 0

Last 5 Errors:
---------------
1.) Unable to find sensor with entity ID 10 and entity instance 128
Time: 00:43:50 UTC Feb 12 2023

2.) Unable to find sensor with entity ID 10 and entity instance 131
Time: 00:43:50 UTC Feb 12 2023

3.) Unable to find sensor with entity ID 10 and entity instance 132
Time: 00:43:50 UTC Feb 12 2023

4.) Unable to find sensor with entity ID 10 and entity instance 107
Time: 00:43:50 UTC Feb 12 2023

5.) Unable to find sensor with entity ID 10 and entity instance 108
Time: 00:43:50 UTC Feb 12 2023

Primary-FW/act#

[Sheraz.Salim]

most likey issue with damage to certain internal components if you have a TAC support engage TAC Engineer.

logging into your provided logs I found a Bug CSCvk51778

found this too https://quickview.cloudapps.cisco.com/quickview/bug/CSCvk51778

if you have a smart contract engage cisco TAC Engineer to get this issue reslove or they can advise you if this reqire the RMA.

[balaji.bandi]

You have mentioned FW not work the console. where is this output come from?

is this FW part of HA, In this case the failed one you is secondary ?

Invalid Ioctl Errors : 1  - Look at this there are some bug around check below take action (if required)

https://bst.cisco.com/bugsearch/bug/CSCvk51778

[ibbulbul]

You have mentioned FW not work the console. where is this output come from?

Yes. you are right. Need to unplug power cable and plug again. then it runs for a while and then again same issue.

is this FW part of HA, In this case the failed one you is secondary ?

Yes have a HA. But need to fixed this issue.

[Sheraz.Salim]

yes that what I thought you are running from HA pair. I think your best bet is open a case with Cisco TAC.

the good think is least you have no downtime as your other appliance is in production and in services so least you have network firewall resiliencey.

[balaji.bandi]

If the failed on fails after some time - suggest to remove from HA, try to run Standalone, and see if that runs as expected.

if that is still an issue you need to raise a TAC case for replacement.

Note: there is some cross wires in the post, suggest replying inline with what post is relevant not to confuse the people with their reply.

[MHM Cisco World]

the G0/1 and G0/3 of both ASA HA is connect to different L3SW, 
are they form Port-channel ??
if they form port-channel then it not OK because the L3SW must be vPC VSS or stack 
if they not then you have another issue 

let start from SG300, 
the packet send to active HSRP but the active HSRP send packet to standby ASA not active this not right for ASA HA 
the packet send to standby HSRP (it elect as new HSRP active) but it forward to standby ASA not active this not right for ASA HA 
this need to config
1-one VLAN between four two ASA HA and two L3SW 

2- allow this VLAN in trunk between the L3SW 

3-HSRP must use SG300 to exchange the HSRP hello not direct connect. 


in simple words there is huge Loop in your network. and there is huge unknown broadcast and ICMP redirection message. 

this kill your ASA HA 
also you can see some high CPU in L3SW 

[Sheraz.Salim]

If there is a huge network loop (STP) issue for sure the network have gone down time to time (2-4 hours windows) or it might be some connecivity to some vlans are not working at all

Having said that, the original post does not mentioned network loop or downtime the original issue is the one appliance in HA is showing Alarm Alert.

I thinking you just jump very quickly to fix the issue here without having /undertand the ground reality what the OP have describe in this thread.

[MHM Cisco World]

He post two issue, 

Both from my view is solve by breaking loop.

[ibbulbul]

Bro thanks your opinion. But I have kept already unmounted the firewall from yesterday and several times in last week I did it to check the issue. the problem is same. If I run this FW standalone the issue is same as before. So I think it is not related to loop or STP issue.

Ans: No Port Channel are configured.

I have 4 same network in different location for last more than 2 years. But no issue there except this.

[MHM Cisco World]

But you share show fialover status and it show that primary fialed.

You run standalone are you completely remove the other asa from topolgy or only run no fialover active.

[MHM Cisco World]

system support utilization <<- share this also

[ibbulbul]

Does not work this command