Weird ASA issue

[Rick Twells]

Hi,

Wondering if anyone else has seen the following issue... We has 2 5520 ASA's running 8.4(3) HA in routied mode with 2 contexts and randomly after weeks and weeks of running perfectly it decied to stop dealing with new connections from new hosts.  exisiting hosts seemed to be unaffected if we killed those connections the working hosts stopped and were unable to reestablish connecvity.

Some of the things we tried (and failed) to fix the issue:

clear arp

clear xlate

i checked routing end to end and found no issue, no-one was on the asa at the time or changed any infrastructure inbetween.  i did want to clear the connections but was told to give it the old IT favorite (reboot) before.

Ive googled and searched here but cant find anything to match what we experienced. 

The logs from the time pretty much said deny to everything but with a rule base of any any on every interface. config is attached if it helps

Thanks

Rick

[Julio Carvajal]

Hello Rick,

Interesting.... Have you rebooted it already?

Regards,

Julio

[Rick Twells]

Hi Julio,

Unfortunatly yes i have and it did resolve the issue for us.

Thanks

Rick

[Julio Carvajal]

Hello Rick,

Yes, I have one similar issue like that long time ago ( different version, not multiple context) where all the packets where all the packets where getting denied by a mystic ACL ( non existent ). Customer rebooted the ASA during the investigation and that solved.

It looks like the some of the processes of the ASA got stuck  ( in this case the ACL filtering mechanism)

Regards,

Julio

[Rick Twells]

was it a bug or just one of those "solar flare" kind of explanations

[Julio Carvajal]

Hello Rick,

As they rebooted the device, we could not investigated.

But we let the case open for 2 more weeks on that case so it looks like  "solar flare" is the desicion.

Regards,