ASR1000 - IOS XE Reload reason "localsoft"

[bruno.faudeux]

Hello,

Last week i saw on one of my ASR1000 a strange behaviour. It reboot (reason: localsoft) after a strange set of commands load from memory by user:console.

Here is an extract of the ASR logs:

*Jul 16 13:17:52.307: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:access-list 199 permit icmp host 10.10.10.10 host 20.20.20.20

*Jul 16 13:17:52.308: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:crypto map NiStTeSt1 10 ipsec-manual

*Jul 16 13:17:52.308: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:match address 199

*Jul 16 13:17:52.309: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:set peer 20.20.20.20

*Jul 16 13:17:52.309: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:exit

*Jul 16 13:17:52.312: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:no access-list 199

*Jul 16 13:17:52.337: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:no crypto map NiStTeSt1

*Jul 16 13:17:52.636: %SYS-5-RESTART: System restarted –

Radius authentication is enabled on this router (even for console port).

It’s not the first time our router display this kind of logs. Last time (a few weeks ago) it made a “watchdod”.

Does someone have an idea of what could generate this behaviour and how to fix it?

Thank you for your help.

[yaqoobkk]

Dear Team any solution please, today i got auto restart and seen the reason after reload is:

System image file is "bootflash:/asr1001x-universalk9.16.06.04.SPA.bin"
Last reload reason: LocalSoft

Any update please

[Leo Laohoo]

If the router is on 16.6.4, is HTTP/HTTPS enabled?

[yaqoobkk]

Dear Leo i have checked and cofirmed that both are not enabled :

no ip http server
no ip http secure-server

[Leo Laohoo]

Post the complete output to the following commands: 

sh version
sh log on uptime
dir crashinfo:
dir bootflash:/tracelogs/*.logs

[yaqoobkk]

sh version:

Cisco IOS XE Software, Version 16.06.04
Cisco IOS Software [Everest], ASR1000 Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 16.6.4, RELEASE SOFTWARE (fc3)Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2018 by Cisco Systems, Inc.
Compiled Sun 08-Jul-18 04:32 by mcpre

Cisco IOS-XE software, Copyright (c) 2005-2018 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.

ROM: IOS-XE ROMMON

ASR1000 uptime is 1 week, 1 day, 16 hours, 17 minutes
Uptime for this control processor is 1 week, 1 day, 16 hours, 18 minutes
System returned to ROM by reload at 05:00:08 AST Sat Jun 3 2023
System restarted at 16:21:23 AST Fri Dec 8 2023
System image file is "bootflash:/asr1001x-universalk9.16.06.04.SPA.bin"
Last reload reason: LocalSoft

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

License Type: Permanent
License Level: adventerprise
Next reload license Level: adventerprise

cisco ASR1001-X (1NG) processor (revision 1NG) with 3862176K/6147K bytes of memory.
Processor board ID FXS2449Q2DR
6 Gigabit Ethernet interfaces
2 Ten Gigabit Ethernet interfaces
32768K bytes of non-volatile configuration memory.
8388608K bytes of physical memory.
6553599K bytes of eUSB flash at bootflash:.
0K bytes of WebUI ODM Files at webui:.

Configuration register is 0x2102

sh log on uptime...... no output.

dir crashinfo==== %Error opening bootflash:/crashinfo (No such file or directory)

dir bootflash:/tracelogs/*.logs===== Directory of bootflash:/tracelogs/*.logs

No such file

6605541376 bytes total (5542268928 bytes free)

Further feel free to discuss please.

Thanks

[yaqoobkk]

dir flash:

Directory of bootflash:/    (restart happen on 8 Dec-2023)

11 -rw- 710590372 Apr 26 2021 19:05:00 +03:00 asr1001x-universalk9.16.06.04.SPA.bin
196609 drwx 4096 Dec 8 2023 16:20:23 +03:00 .installer
319489 drwx 4096 Apr 26 2021 19:14:43 +03:00 core
131073 drwx 4096 Jun 3 2023 05:03:21 +03:00 .prst_sync
401409 drwx 4096 Apr 26 2021 19:13:24 +03:00 .rollback_timer
12 -rw- 0 Apr 26 2021 19:13:36 +03:00 tracelogs.8XP
139265 drwx 40960 Dec 17 2023 08:47:14 +03:00 tracelogs
49153 drwx 4096 Apr 26 2021 19:13:42 +03:00 virtual-instance
262145 drwx 4096 Dec 8 2023 16:21:35 +03:00 crypto
13 -rw- 30 Dec 8 2023 16:21:39 +03:00 throughput_monitor_params
14 -rw- 34 Jul 1 2021 11:17:24 +03:00 pnp-tech-time
15 -rw- 48577 Jul 1 2021 11:17:34 +03:00 pnp-tech-discovery-summary
16 drwx 4096 Jul 4 2021 08:26:00 +03:00 lost+found

6605541376 bytes total (5542236160 bytes free)