Firepower 1010 reliability

[fbsdkernel]

Hi All,

this is a semi-rant/cry for help.  After being a cisco fan for many years I'm almost at the end of my tether with the Firepower 1010 series that we may have no choice but to just give up and switch brand.  I work in $dayjob where we manage around 90 Cisco Firewalls which are predominently 5500 series.  So when Cisco announced the Firewpower 1010 and that it supported the ASA software we started moving any replacements to that platform as and when. 

A total of ~10 FIrepower 1010's running ASA firmware in and here we are.  Not a single Firepower 1010 is able to manage anymore than 30 days worth of uptime.  They just randomly reboot entirely whenever they feel like it.  All of the units are running a mixture of up to date firmware from 9.16.X to 9.18.X.  The units have console logging on them and there's never a crash or dump reported they just reset and come back with "Last reset cause: PowerOn (0x00000001)".

%ASA-3-710003: TCP access denied by ACL from X.X.X.X/64573 to outside:X.X.X.X/23




*******************************************************************************

Cisco System ROMMON, Version 1.0.11, RELEASE SOFTWARE

Copyright (c) 1994-2020  by Cisco Systems, Inc.

Compiled Mon 10/12/2020 21:50:47.51 by builder

*******************************************************************************



Current image running: Boot ROM1

Last reset cause: PowerOn (0x00000001)

DIMM0 : Present


Platform FPR-1010 with 8192 MBytes of main memory

• Yes they are up to date.
• All the firewalls are located in different racks or different buildings.
• Firewalls are connected up to exactly the same power strips that 5506's etc are happy with.
• Yes we have contacted Cisco Support about at least 2 of the units.  In one instance Cisco replaced the hardware completely but that didn't help either.
• No, coredumps aren't created.
• We run ASA firmware as at the time VPN's weren't supported to my knowledge (particularly AnyConnect).

We can't be the only ones suffering with this..... can we?

[Marvin Rhoads]

Since the 1010 uses an external AC power supply, have these been replaced when RMAing a unit?

I only have a couple of customers using 1010s (with FTD code) and they haven't reported this experience. Nor have my customers with 1120s and 1140s.

[fbsdkernel]

It's something that has crossed my mind on this.  I've heard the other models (1120s etc) are much more stable and those have built in power supplies.  One of the supplies has been replaced but it's probably worth revisiting. It's really odd which has thrown me to be honest.  As I write this, another completely separate FPR1010 has rebooted:-

  	

USB Log for Device Port 15 (15_Port-15_1.log)





*******************************************************************************

Cisco System ROMMON, Version 1.0.11, RELEASE SOFTWARE

Copyright (c) 1994-2020  by Cisco Systems, Inc.

Compiled Mon 10/12/2020 21:50:47.51 by builder

*******************************************************************************



Current image running: Boot ROM1

Last reset cause: PowerOn (0x00000001)

DIMM0 : Present


Platform FPR-1010 with 8192 MBytes of main memory

BIOS has been successfully locked !!

MAC Address: bc:4a:56:e9:05:00


Use BREAK or ESC to interrupt boot.

[Marius Gunnerud]

I have seen similar issues with some FTD devices.  In our case it was due to a memory leak in the SNMP process which caused a traceback and reload.  No crash dump was created with the reloads.  Not saying that this is the issue you are facing, but might be an idea to look into it if you have SNMP polling / traps enabled.

[fbsdkernel]

All of our FPR's have SNMP enabled and polled regularly so we can monitor them so it's certainly a possibility.  I'm tempted to disable SNMP on one of them to see how it fairs, so thanks for the suggestion.

I do wonder if some users just haven't really realised their FPR1010's restarting if they aren't really monitoring them.

[kerstin-534]

We have similar problems with the Firepower 1010. They do not reboot themselves, but if we reboot them they don't come up, even if the internal linux /var/log/messages isn't filled up as they usually do. We also consider to switch brand to get rid of this.

[Marius Gunnerud]

Please create a new post for this issue so we can help you better and so it will be easier to find if someone else is having the same issue.