PIX525 sudden High CPU Utilization

[Jayson Cruz]

Hi everyone!

Good day!

Would like to ask for everyones assistance with regards to the problems we are encountering on our PIX525 firewall. Our encountered problem is as follow.

"PIX 525 experience sudden high CPU utilization every time a Vulnerability System Scan (third part app) is conducted. Based on the previous experiences, the high CPU utilization where experience when a host on a particular VLAN (214) is being scanned. Whenever we removed the said VLAN (214) in the network the CPU utilization of PIX 525 comes back to normal and all connectivity were resumed."

The problem just recently appeared, we are conducting vulnerability system scan before and it goes succesfully.

It would be of great help if I can have some assistance from you guys.

Thanks!

Best Regards,

Jayson

[Jayson Cruz]

Hi everyone would like to ask for everyones assistance po. Thank you very much!

[jocamare]

How is the vulnerability scan performed? [what kind of vulnerabilties it looks for, how deep does the analysis go]

What functions does this host perform in your network?

[Jayson Cruz]

Hi jocamare,

Honestly i am not that familiar with regards to the vulnerabil iou y scan. All i know is that it just scan every host in the network to mitigate potential infections like viruses and it also checks what the current host is lackibg with regards to patches. I believe the vulnerabikity scan is made by nCircle product name is ip360. Any commands or perspective that you migh suggest me to check? Thanks you very uch for the supporr as to i dont know how to troubleshoot the network. Again thank you very much!


Sent from Cisco Technical Support Android App

[jocamare]

Place said host back in the network and run the scan, thus triggering the high CPU condition on the ASA.

Once that is done, please share the output of the "show version", "show cpu" "show local details" "show resource usage" commands with us.

Not sure of the version you are running, but try to run this one too "show processes cpu-usage non-zero sorted"

[Jayson Cruz]

Hi jocamare,

A good day to you! Thank you very much! As for the IP of the host unfortunately thats one thing we want to find out. Up to this point we are completely unaware of the ip address of the host (if theres any) causing the pix to go high cpu. But as of the moment i have output of e syslog during the time of the incident. I will share it with you once i have arrived at the office.

Thank you very much for your help

Best regards,
Jayson


Sent from Cisco Technical Support Android App