cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2687
Views
15
Helpful
3
Replies

uptime of 213 days considered harmful

James Leinweber
Enthusiast
Enthusiast

Most of the current ASA/Firepower firmwares have a bug where the stop processing ARP packets after 213 days of uptime. Bit me Wednesday, ouch!  The workaround is to schedule a reload before that happens.  No security implications.

Field notice:

    http://www.cisco.com/c/en/us/support/docs/field-notices/642/fn64291.html

Bug:
    https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd78303

-- Jim Leinweber, State Lab of Hygiene

1 Accepted Solution

Accepted Solutions

Marvin Rhoads
VIP Community Legend VIP Community Legend
VIP Community Legend

Yes I saw that as well.

Note that all of the affected versions were released sometime after September 2016. If you are running older code, the bug does not affect you.

Cisco is building interim releases to patch the bug. They are identified on the BugID page. They have not been released just yet as they need to go through final QC and then get deployed to the CDN prior to showing up on the downloads area.

Here is the current list of patched interim releases to watch for (as of ca. midnight 31 March 2016):

9.7(1.4)
9.6(3.1)
9.5(3.8)
9.4(4.5)
9.2(4.20)
9.1(7.16)

View solution in original post

3 Replies 3

Marvin Rhoads
VIP Community Legend VIP Community Legend
VIP Community Legend

Yes I saw that as well.

Note that all of the affected versions were released sometime after September 2016. If you are running older code, the bug does not affect you.

Cisco is building interim releases to patch the bug. They are identified on the BugID page. They have not been released just yet as they need to go through final QC and then get deployed to the CDN prior to showing up on the downloads area.

Here is the current list of patched interim releases to watch for (as of ca. midnight 31 March 2016):

9.7(1.4)
9.6(3.1)
9.5(3.8)
9.4(4.5)
9.2(4.20)
9.1(7.16)

antonkolev
Beginner
Beginner

what was the behavior  at the time of happening ? 

Did you had dhcprelay or dhcp server running on the ASA . Did you had any routeable subnets on the ASA - Are those worked ? Did you have two ASA active /passive 

In my case I had two standalone ASA 5525-X devices, both with dhcprelay but not dhcp server, both in routed mode.  The failure behavior was quite consistent with the Cisco bug report that ARP processing was broken after 213 days uptime, and I was running one of the affected releases.  ping to the on-link LAN firewall address started failing, packets stopped flowing between directly attached subnets, etc.

-- Jim Leinweber

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers