ASA 5505 Lock ups

Largnchargn07 · 07-16-2007, 02:53 PM

I recently installed a ASA5505 Firewall on my customer premise and got everything working except for this annoying problem the ASA locking up and having to be system reloaded to bring it back online. I have checked the configuration with Cisco Techs via TAC request and with local so-called Security experts. I did things like clear arp, clear xlate, clear local-hosts. Change the ACLs, set up static routes. But nothing seems to work. Meanwhile my poor user is left without internet access and email. I need help to figure out what is causing the lock ups. I also disable logging as well.

Ericunicast · 07-16-2007, 06:03 PM

Does it lock up once it is connected to the LAN?
What type of services are configured?

Largnchargn07 · 07-17-2007, 07:02 AM

The ASA is configured with a inside network (192.168.100.0/24) to a outside network (168.39.64.0) with no DMZ activated. Servers are located off a switch on the inside network. Outside network is attached to a router and then to the internetwork. The ASA seems to just lock up even when there is only one user online or as many as 17. A system reload usually brings it back online. Logging has been disabled, all unused ports have been placed back to Vlan 1 by default. Vlan 3 for the DMZ has been shutdown. Have contacted Cisco experts but none are up to the challenge.

Ericunicast · 07-17-2007, 07:05 AM

That sounds more like a hardware/software issue than one that can just be fixed by a quick talk to Cisco engineers.

My suggestion would be to monitor the traffic with a sniffer and watch to see when the ASA locks up.

What type of rulesets do you have in place?
Are you using the default configuration?
How was the ASA configured?
Are you missing any fixup protocols?

This could be a number of things, but mainly, lets start with the rulesets...

07-16-2007, 02:53 PM	#1 (permalink)
Largnchargn07 Registered User Join Date: Jul 2007 Posts: 2 OS: XP, Vista Basic Premium	ASA 5505 Lock ups I recently installed a ASA5505 Firewall on my customer premise and got everything working except for this annoying problem the ASA locking up and having to be system reloaded to bring it back online. I have checked the configuration with Cisco Techs via TAC request and with local so-called Security experts. I did things like clear arp, clear xlate, clear local-hosts. Change the ACLs, set up static routes. But nothing seems to work. Meanwhile my poor user is left without internet access and email. I need help to figure out what is causing the lock ups. I also disable logging as well.

07-16-2007, 06:03 PM	#2 (permalink)
Ericunicast Registered User Join Date: Aug 2006 Posts: 99 OS: win2000	Re: ASA 5505 Lock ups Does it lock up once it is connected to the LAN? What type of services are configured?

07-17-2007, 07:02 AM	#3 (permalink)
Largnchargn07 Registered User Join Date: Jul 2007 Posts: 2 OS: XP, Vista Basic Premium	Re: ASA 5505 Lock ups The ASA is configured with a inside network (192.168.100.0/24) to a outside network (168.39.64.0) with no DMZ activated. Servers are located off a switch on the inside network. Outside network is attached to a router and then to the internetwork. The ASA seems to just lock up even when there is only one user online or as many as 17. A system reload usually brings it back online. Logging has been disabled, all unused ports have been placed back to Vlan 1 by default. Vlan 3 for the DMZ has been shutdown. Have contacted Cisco experts but none are up to the challenge.

07-17-2007, 07:05 AM	#4 (permalink)
Ericunicast Registered User Join Date: Aug 2006 Posts: 99 OS: win2000	Re: ASA 5505 Lock ups That sounds more like a hardware/software issue than one that can just be fixed by a quick talk to Cisco engineers. My suggestion would be to monitor the traffic with a sniffer and watch to see when the ASA locks up. What type of rulesets do you have in place? Are you using the default configuration? How was the ASA configured? Are you missing any fixup protocols? This could be a number of things, but mainly, lets start with the rulesets...