PIX stops responding once or twice a day?

[pankajchawla]

Hello Everyone,

I have a PIX 515 with Version (6.1.4) which seems to hang once or twice a day. I have tried my best but there is nothing that looks like suspecious. When it happens i cant ping the PIX nor accross the PIX but when i reboot it comes back to normal again.
I am connecting two private networks with no nat enabled and it will be on failover once this issue is resolved.
Here is the config

:
PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 state security20
nameif ethernet3 eth3 security10
nameif ethernet4 intf4 security20
nameif ethernet5 intf5 security25
enable password 0O2M1peQxbMbQtQO encrypted
passwd 0O2M1peQxbMbQtQO encrypted
hostname BOBL-DR-PIX1
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list OUT permit icmp any any
access-list OUT permit ip 10.160.0.0 255.255.0.0 any
access-list INSIDE permit icmp any any
access-list INSIDE permit ip 10.169.4.0 255.255.255.0 any
pager lines 24
logging console notifications
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
interface ethernet3 auto shutdown
interface ethernet4 auto shutdown
interface ethernet5 auto shutdown
mtu outside 1500
mtu inside 1500
mtu state 1500
mtu eth3 1500
mtu intf4 1500
mtu intf5 1500
ip address outside 10.169.9.2 255.255.255.128
ip address inside 10.169.4.1 255.255.255.0
ip address state 10.1.1.1 255.255.255.252
ip address eth3 127.0.0.1 255.255.255.255
ip address intf4 127.0.0.1 255.255.255.255
ip address intf5 127.0.0.1 255.255.255.255
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
failover replication http
failover ip address outside 10.169.9.3
failover ip address inside 10.169.4.2
failover ip address state 10.1.1.2
failover ip address eth3 0.0.0.0
failover ip address intf4 0.0.0.0
failover ip address intf5 0.0.0.0
failover link state
pdm history enable
arp timeout 14400
static (inside,outside) 10.169.4.0 10.169.4.0 netmask 255.255.255.0 0 0
access-group OUT in interface outside
access-group INSIDE in interface inside
route outside 0.0.0.0 0.0.0.0 10.169.9.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet 10.169.4.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
terminal width 80
Cryptochecksum:e24d1cf358d4f4c9b0cb0156d4ec33b0


Any help on this will be appreciated.

Thanks
Pankaj

 

[boymarty24]

Can you console your way in to the pix when it hangs? Can you ping from the pix? Whats the status of the interfaces when the pix hangs ( sh in )


I would start with upgrading the pix to 6.35. Ofc you need to upgrade to the same version on the other pix.

And i cant really see what your accesslist inside do. The pix already allows every traffic from higher to lower interface.

If the problem persists setup a syslog server ( free software from kiwi syslog )

 

[pankajchawla]

Can you console your way in to the pix when it hangs?

No i cannot.

Now do i need extra license to upgrade from 6.1.4 to 6.35? Company bought this pix aboout 2 years ago with failover license.

I will try to setup kiwi and see how that goes this time, and will also remmove the access-l inside.

Regards
Pankaj

 

[boymarty24]

You need a smartnet contract for software downloads. The same contract gives you the possible to replace the pix with a new one ( if this one is broken )


Btw do you have a failover pix now? If not clear the failover config to see if that solves your problem.

 

[sla07]

what messages are you logging?...what does your show log output give you?...not sure if the pix's can do this but maybe try a 'sh cpu' right when the issue finishes to see where the cpu level is....how much traffic is going through right now?....do you have any mrtg or cacti graphs that show whats going on right before the pix hangs?....

 

[bytehd]

happens to me too on 2 different 501s.
Seems this is the norm for Cisco 501s.


George Walkey
Senior Geek in charge

http://www.insyncva.com

 

[geo2500]

Since you bought this pix will failover licence, this is the norm. The router will restart once a day. It's mentioned at Cisco's site. This is done because the pix with failover licence costs much less than a pix with normal licence. Otherwise, everybody would buy the cheap solution.
A pix with failover licence needs another pix that is the active pix.

 

[bytehd]

mine dont have failover
try again

George Walkey
Senior Geek in charge

http://www.insyncva.com

 

[pankajchawla]

geo2500 .....cud you reffer me to the link which says that?

Regards
Pankaj Chawla

 

[Supergrrover]

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_qanda_item09186a0080094874.shtml#fail

Do a sho ver to see if what license you have running. It is a Failover license, then that is what's happening.

Also, you should force the stateful links to 100f.




Brent
Systems Engineer / Consultant
CCNP

 

[NetworkGhost]

This behavior is not the Norm for an Cisco Device. The most important info is the logs. Doesnt look like you have loggin to your buffer enabled.

Try this

logging on
logging buffered 4


Now when this happens check out the logging buffer when the Pix becomes available again.

sh log



Copy the data and post it. Are the times this happens similar ? 2 PM and 5 PM for example