Hi, I've recently taken over working on one of our clients from the previous tech and have been tasked with providing a post incident review - involving determining the root cause of an outage involving a Cisco ASA firewall. Firewall is 2 x ASA5545X's running as a active/passive pair. The version is 9.2(2)4 Turns out there's currently no support contract on the ASA so unable to log a case with TAC at this stage. The firewall sits in a data centre and is responsible for connectivity to the company MLPS and also to the core L3 switch, acting as a leg into an internal DMZ (server VLAN) and also through to another pair of 5512's which are sitting on the perimeter of the DC out to the public Internet. Just before taking over, the previous tech attempted to patch an interface on the active ASA to a port on a WAN provider's router (not the same as the existing MPLS provider). Note that all tagging, etc. is handled on MPLS router kit. BGP is used across the WAN and is configured on the ASA5545 pari for routing across the existing MPLS. The interface that was patched in has not been included in any peering config and, therefore, should not have received or advertised any routing to the device connected to this port. When the patching was done and the interface was changed from shut to no shut, suddenly access to the internal DMZ was lost (server VLAN). There may have been a complete loss of access to everything, including Internet. Unfortunately I wasn't working on it at the time and have no historical logs or specific symptoms provided or available to me. The BGP setup on the ASA5545's includes "redistribute static" - but not "redistribute connected". There are no other routing protocols configured on the firewall. The port that was patched into and enabled was set to a security level of 0, had an IP address configured that does not exist anywhere else on the network, and while the tech had created an access-list for it, he hadn't actually applied the access list to the interface (access-group command). The MPLS interfaces also have a security level of 0 While the DMZ and Internet (patches into the 5512 internet firewall pair) interfaces have security level of 100. There are access-lists applied to the two MPLS interfaces but none on the INTERNET & DMZ interfaces. There is no "same-security-traffic" commands applied to the firewall at all (inter or intra). The default route to the internet is via static route. The DMZ route is also static to the switch. I can't see any reason why simply patching in this interface and enabling it would've caused this outage. My only thoughts are that it may have something to do with the security level of the interface...even then I am doubtful. Hoping someone on here might have some idea if that's a possible cause or other possible causes. ... View more