Shape average command crashing my 5505 daily

[Dean Romanelli]

Hi All,

I have a branch ASA 5505 with a VPN tunnel over a T-1 WAN to the data center, which has a centralized internet pipe.

Branch ASA 5505=========VPN TUNNEL===========Data Center ASA 5520=====Internet Pipe

I am trying to roll out hierarchical priority on all of my branch 5505's for VOIP, but applying these configs seems to be intermittently crashing my beta-branch 3 times in a row now (last Friday, this Monday, & today), I have to power cycle the ASA to restore services.  When I leave the QOS configs off, the branch stays up for weeks with no problems.  I am pretty sure what is doing it is the shape average command, since I have to use it to tell the priority when to trigger since the WAN line is only 1.5Mbps, and the physical port of the ASA is 100Mbps. I have another site where the ISP circuit is truly 100Mbps, so I don't have to configure a shaper policy and that site has been up for 4+ months with identical configs as what is shown below minus the shape average part.

Are there any known bugs for the 5505 and shaping the interfaces? Below is my config:

firmware: asa913-k8, base license.

object-group network VOIP
network-object 192.xx.xx.0 255.255.255.0
network-object 192.xx.xx.0 255.255.255.0
network-object 63.xxx.xx.0 255.255.255.0
network-object 8.x.xxx.0 255.255.255.0
network-object 8.xx.x.0 255.255.252.0

object-group service VOIP_Ports tcp-udp
port-object range 5196 5199
port-object range 5060 5061
port-object range 2222 2269
port-object eq 5299
port-object eq 5443

access-list qos_priority extended permit udp 192.168.154.0 255.255.255.0 object-group VOIP object-group VOIP_Ports
access-list qos_priority extended permit tcp 192.168.154.0 255.255.255.0 object-group VOIP object-group VOIP_Ports

class-map QOS-VOICE
 match access-list qos_priority

policy-map QOS-POLICY
 class QOS-VOICE
 priority

policy-map QOS-TRIGGER
 class class-default
  shape average 1528000
 service-policy QOS-POLICY

service-policy QOS-TRIGGER interface outside

[Philip D'Ath]

it should never crash, so it seems obvious you are running a code version with a software defect.  Which code version are you running?

[Dean Romanelli]

Hi,

I am running asa913-k8 with a base license on this particular 5505.

Thanks.

[Philip D'Ath · Accepted solution]

The current "gold star" release is 9.1.6.  I would be tempted to upgrade to the gold star release and see if the issue still happens (I bet it wont).

[Dean Romanelli]

Thanks. This firewall is in the field across the country from me physically. If I do the upgrade remotely, will it retain its previous configuration after the upgrade competes?

[Philip D'Ath]

Yes it will.

[Dean Romanelli]

Thank you.  Do you know where I can procure a copy of that firmware release?

[Philip D'Ath]

You have to have a Cisco maintenance contract, such as a SmartNet.  Then you can download it directly from Cisco.

You can get this from your favourite Cisco reseller.  If you don't have one you can use the Cisco partner locator to find one near you.

https://tools.cisco.com/WWChannels/LOCATR/openBasicSearch.do

[Dean Romanelli]

Ok, thanks very much.