HELP! ASA keeps going down

[ndinc]

I have upgraded both ASDM and the firmware to 6.02 and 8.02 and the ASA will go down after many hours of being up. A power cycle brings it back up.

But after last night I upgraded the ASDM to setup some monitoring and it came down this morning and I am now heading on site as a power recycle didn’t bring it backup. I am extremely concerned about as I have purchased four more slated for production use and I must get this resolved.

I have included my config to see if anyone finds anything out of the ordinary or any security issues etc...

Any suggestions would be greatly appreciated.


login as: pix
pix@208.X.X.66's password:
Type help or '?' for a list of available commands.
ciscoasa> en
Password: *******
ciscoasa# sh run
: Saved
:
ASA Version 8.0(2)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password encrypted
passwd encrypted
names
dns-guard
!
interface Vlan1
nameif inside
security-level 100
ip address 10.1.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 208.X.X.66 255.255.255.240
!
interface Vlan3
no forward interface Vlan1
nameif dmz
security-level 50
no ip address
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
domain-name default.domain.invalid
same-security-traffic permit inter-interface
access-list outside_access_in extended permit tcp host 208.X.X.16 host 208.X.X.67 eq 5900
access-list outside_access_in extended permit tcp host 208.X.X.16 host 208.X.X.68 eq 5900
access-list outside_access_in extended permit tcp any host 208.X.X.69 eq pcanywhere-data
access-list outside_access_in extended permit tcp any host 208.X.X.69 eq 5632
access-list outside_access_in extended permit tcp any host 208.X.X.67 eq 3389
access-list outside_access_in extended permit gre any host 208.X.X.67
access-list outside_access_in extended permit tcp any host 208.X.X.67 eq pptp
pager lines 24
logging enable
logging buffered informational
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp 208.X.X.67 5900 10.1.1.7 5900 netmask 255.255.255.255
static (inside,outside) tcp 208.X.X.68 5900 10.1.1.6 5900 netmask 255.255.255.255
static (inside,outside) tcp 208.X.X.69 5632 10.1.1.75 5632 netmask 255.255.255.255
static (inside,outside) tcp 208.X.X.69 pcanywhere-data 10.1.1.75 pcanywhere-data netmask 255.255.255.255
static (inside,outside) tcp 208.X.X.67 3389 10.1.1.7 3389 netmask 255.255.255.255
static (inside,outside) tcp 208.X.X.67 pptp 10.1.1.7 pptp netmask 255.255.255.255
access-group outside_access_in in interface outside
route inside 10.1.2.0 255.255.255.0 10.1.1.1 1
route outside 0.0.0.0 0.0.0.0 208.X.X.66 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 10.1.1.0 255.255.255.0 inside
http 208.X.X.16 255.255.255.255 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
client-update enable
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 208.X.X.16 255.255.255.255 outside
ssh timeout 30
ssh version 2
console timeout 0
management-access inside
dhcpd dns 68.X.X.30 68.X.X.30
dhcpd auto_config outside
!
dhcpd dns 68.X.X.30 68.X.X.30 interface inside
!

ntp server 152.2.21.1 source outside
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect pptp
!
service-policy global_policy global
smtp-server 208.X.X.100
prompt hostname context
Cryptochecksum:5c4aaeb3f5c94c29ad1942979dc773f3
: end
ciscoasa#



Thanks for your help

 

[Supergrrover]

were there any problems before the upgrade? how long as it in service? check the caveats for that release. I haven't had any problems with any of mine. if that doesn't show anything, call cisco and are if they will replace it.

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[ndinc]

Same problem with 7.2 it just stops running and no ping to gateway..!!??

I had to replace the production one wiht a non Cisco today...

I really bummed about it as I was just starting to dig the ASDM for monitoring (not for configuration, I prefer the CLI).

I guess I will re burn it and call Cisco.



Thanks for your help

 

[desperado618]

Have you tried creating a capture to see if the packets are reaching? I presume nothing in the logs

http://www.NetLeets.com

IT Security news and information
In plain English

 

[ndinc]

we traced to the T1 router..

Thanks for the reply.

Thanks for your help