Firewall – Cisco ASA 5550 rebooted itself, logs cleared

ciscocisco-asafirewall

we had Cisco ASA5550 in Active/standby mode which worked without any issue for over 1 year. Recently, we started having issue where the VPN tunnels would drop to sites and have internet outages.
We disabled failover and took Standby ASA out of the network.
While the network is operating on one ASA, it rebooted itself without any reason. I am unable find the reason behind logs were erased on reboot. i can confirm there wasn't a power issue as nothing else power cycled.
ASA version: 9.1(5)

Is there any known bug fix? what could case ASA reboot itself?

Thanking you in advance.

Best Answer

You may want to look at -
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa

2015-July-08 UPDATE: Cisco PSIRT is aware of disruption to some Cisco customers with Cisco ASA devices affected by CVE-2014-3383, the Cisco ASA VPN Denial of Service Vulnerability that was disclosed in this Security Advisory. Traffic causing the disruption was isolated to a specific source IPv4 address. Cisco has engaged the provider and owner of that device and determined that the traffic was sent with no malicious intent. Cisco strongly recommends that customers upgrade to a fixed Cisco ASA software release to remediate this issue.

Related Solutions

Cisco – Failover ASA configuration using a Cisco 3750 switch as the router

I've been writing up a (very) long answer, but I suddenly realized that it would eat away your entire allocated subnet in routing networks.

May I ask why you're not doing this?:

Colo <----> ASA <----> 3750 <--(L2 link)--> Office

Even if you have to connect the ASA via the 3750 because of fibre conversion - it doesnt matter. This is a line-speed switch, the latency is nearly impossible to notice.

Edit: Why do you want the 3750 as a router? You only have one network.

Firewall – cisco asa reloading

Ok I'm not going to pretend I have de facto answer, but have you considered...

Are you using a dedicated interface for failover such as the Management port, as other traffic may delay 'hello' packets triggering a failover condition?

Have you tried adjusting the hold-down timer like so :

hostname(config)# failover polltime interface [msec] time [holdtime time]

Maybe extending the timer may yield different results, if it does you know the code/memory isn't solely resposible for the reload.

You could also try the command:

show failover history

To try and establish why the failover occurred. However it does look like the interface or link is going down, from your output, so I'm unsure this is a memory issue, although code is a distinct possibility.

Best Answer

Related Solutions

Cisco – Failover ASA configuration using a Cisco 3750 switch as the router

Firewall – cisco asa reloading

Related Topic