cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
638
Views
0
Helpful
1
Replies

Cisco ASA IPS module crashes randomly

secureIT
Enthusiast
Enthusiast

Hi All,

I have an ASA 55xx firewall where ASA-SSM-20 is installed and running with version 7.1(10)E4, device has a valid license as well.
The IPS module is getting rebooted automatically once in 2-3 days, and below are the logs captured during the problem.
Can someone assist in finding the cause and fix for this issue.


signature version:-
==============
Signature Update    S912.0            2016-03-04

From the logs, i got only errSystemError - Card Manager error -1 as a suspected log.

28Mar2016 18:43:28.470 0.612 mainApp[1019] Cid/E errSystemError AppManager::AppManager - Application path does not exist: /usr/cids/idsRoot/bin/switchApp
Begin syslogReader
28Mar2016 18:43:28.612 0.142 mainApp[1019] Cid/E errSystemError MainAppCfg::readRecoveryHostFile - error trying to restore network settings
28Mar2016 18:43:28.638 0.026 mainApp[1019] IdsEventStore/W errWarning -- Event store open archive for input failed [IdsEventStore::Data::Data()]
28Mar2016 18:43:28.638 0.000 mainApp[1019] IdsEventStore/W errWarning -- Event store set to default size [IdsEventStore::Data::Data()]
28Mar2016 18:43:28.643 0.005 mainApp[1019] IdsEventStore/W errWarning Event store circular buffer may be in an invalid state, recovering ... [IdsEventStore::init()]
28Mar2016 18:43:52.373 0.000 logApp[1203] Cid/W Disabled status event logging for status category: controlTransaction
28Mar2016 18:43:53.560 1.187 interface[1205] Cid/W errWarning Inline data bypass has started due to reason unknown.
28Mar2016 18:43:56.494 2.934 sensorApp[1235] sensorApp/W The AIC (application-policy) engine will soon be deprecated and is off by default. The application-policy-enforcement-http signatures won't be built
28Mar2016 18:43:56.539 0.045 collaborationApp[1237] Cid/W Warning - DNS or HTTP proxy is required for global correlation inspection and reputation filtering but no DNS or proxy servers are defined.
Add an HTTP proxy server or DNS server in the 'host' service configuration.
28Mar2016 18:44:05.482 8.943 cidwebserver[1212] tls/W errTransport WebSession::sessionTask TLS connection exception: handshake incomplete.
Messages, like this one, in the category - TLS connection failure - were logged 1 times in the last 0 seconds.
28Mar2016 18:44:35.857 1.452 sensorApp[1235] Cid/W AnalysisEngine reconfiguration complete.
28Mar2016 18:44:35.859 0.002 mainApp[1019] Cid/E errSystemError - Card Manager error -1: cmgr_send_version_msg [F1ControlPlane::checkCmgrResult]
28Mar2016 18:44:35.878 0.019 interface[1205] Cid/W errWarning Inline data bypass has stopped.

1 Reply 1

Marvin Rhoads
VIP Community Legend VIP Community Legend
VIP Community Legend

It could very well be a hardware issue.

Since you have a current IPS subscription service, you must also have TAC support on the hardware as that's a prerequisite on the older type of IPS. So I'd recommend going straight to a TAC case.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers