I have a very strange issue with Cisco ASA 5505 started about week ago: ASA like a router with outside port to ISP, next port to DMZ and another one to inside network (contains about 50 hosts thru several Cisco SMB switches).
Many, but not all hosts (SIP phones, laptops, desktops) from inside network suddenly stop accessing internet and even ping to ASA doesn't pass thru. Some other hosts, like servers connected thru the same switches always works. DMZ hosts are also works without issues. It could work for 8 hours or happens every 15 mins with no visible understanding. Once the connectivtity for a hosts lost it is possible to restore it with ASA reboot or just wait for 15-20-30 minutes (randomly) before it will self-restore.
Today I have just started digging and found what "clear arp" immediately resolves the issue, but with my knowledge I can't identify the root and how to fix it. Configuration work almost for an year and nothing were changed recently. ISP checked from their side and reported the issue at our side so coundn't help somehow.
Upgraded ASA's software - no changes.
Any help will be appreciated, depersonalized running config is below.
Thanks!
Result of the command: "sh ru" : Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz : ASA Version 9.2(4) ! hostname ciscoasa domain-name XXXX enable password XXXX encrypted names ip local pool vpn-pool 192.168.3.2-192.168.3.254 mask 255.255.255.0 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 switchport access vlan 12 ! interface Ethernet0/7 switchport access vlan 12 ! interface Vlan1 nameif inside security-level 100 ip address 192.168.0.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address ISP_PROVIDED_IP 255.255.255.192 ! interface Vlan12 no forward interface Vlan1 nameif DMZ security-level 50 ip address 172.16.0.1 255.255.255.0 ! boot system disk0:/asa924-k8.bin ftp mode passive clock timezone MSK/MSD 3 clock summer-time MSK/MDD recurring last Sun Mar 2:00 last Sun Oct 3:00 dns domain-lookup inside dns domain-lookup outside dns server-group DefaultDNS name-server DNS1-ISP name-server DNS2-ISP name-server DNS3-INTERNAL_HOSTS name-server 8.8.8.8 domain-name XXXXX same-security-traffic permit intra-interface object network obj_any subnet 0.0.0.0 0.0.0.0 object network NETWORK_OBJ_192.168.2.0_24 subnet 192.168.2.0 255.255.255.0 object network 192.168.3.0 subnet 192.168.3.0 255.255.255.0 object network 192.168.0.1 subnet 192.168.0.0 255.255.255.0 object network ins subnet 192.168.1.0 255.255.255.0 object network 192.168.1.1 host 192.168.1.1 object network asdc host 192.168.0.50 description asdc object network TGP500-01 host 192.168.0.32 object network TGP500-02 host 192.168.0.25 object network TGP500-03 host 192.168.0.30 object network TGP500-04 host 192.168.0.10 object network TGP500-05 host 192.168.0.11 object network DMZ_outside subnet 0.0.0.0 0.0.0.0 object network DMZ subnet 172.16.0.0 255.255.255.0 object-group network SIP_PROVIDER description SIP_PROVIDER network-object SIP_ISP_NETW 255.255.255.0 network-object host SIP_ISP_HOST network-object host SIP_ISP_HOST network-object host SIP_ISP_HOST object-group service SIP-stun tcp-udp description SIP-stun port-object range 3478 3479 object-group service SIP60000 udp description SIP60000 port-object eq 60000 object-group service sip-SIP udp description sip-SIP port-object range 1024 65535 object-group service DM_INLINE_UDP_1 udp group-object SIP-stun group-object SIP60000 group-object sip-SIP object-group protocol TCPUDP protocol-object udp protocol-object tcp object-group network SIPphones description SIP phones network-object object TGP500-01 network-object object TGP500-02 network-object object TGP500-03 network-object object TGP500-04 network-object object TGP500-05 object-group service DM_INLINE_UDP_2 udp group-object SIP60000 group-object sip-SIP object-group service DM_INLINE_TCP_1 tcp port-object eq 3389 port-object eq 7766 access-list main standard permit 192.168.1.0 255.255.255.0 access-list main standard permit 192.168.2.0 255.255.255.0 access-list main standard permit 192.168.3.0 255.255.255.0 access-list main standard permit 192.168.0.0 255.255.255.0 access-list inside_access_in extended permit icmp any any access-list inside_access_in extended permit ip 192.168.0.0 255.255.255.0 192.168.0.0 255.255.255.0 access-list inside_access_in extended permit ip any any access-list global_access extended permit icmp any any access-list outside_access_in remark SIPNAME SIP 5060 access-list outside_access_in extended permit object-group TCPUDP object-group SIPName object-group SIPphones eq sip access-list outside_access_in remark SIPNAME SIP access-list outside_access_in extended permit udp object-group SIP object-group SIPphones object-group DM_INLINE_UDP_1 access-list outside_access_in extended deny object-group TCPUDP any object-group SIPphones eq sip access-list outside_access_in extended deny udp any object-group SIPphones object-group DM_INLINE_UDP_2 access-list outside_access_in extended permit tcp any object asdc object-group DM_INLINE_TCP_1 access-list outside_access_in extended deny ip any object asdc inactive access-list outside_access_in extended permit ip any any access-list outside_access_in extended permit ip any object DMZ access-list AnyConnect_Client_Local_Print extended deny ip any4 any4 access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631 access-list AnyConnect_Client_Local_Print remark Windows' printing port access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100 access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353 access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355 access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137 access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns access-list DMZ_access_in extended permit ip any any access-list DMZ_mpc extended permit ip any 172.16.0.0 255.255.255.0 access-list outside_mpc extended permit ip object-group SIPphones object-group SIP access-list outside_mpc_1 extended permit ip any 172.16.0.0 255.255.255.0 pager lines 24 logging enable logging asdm debugging mtu inside 1500 mtu outside 1500 mtu DMZ 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-751.bin no asdm history enable arp timeout 14400 no arp permit-nonconnected ! object network asdc nat (inside,outside) static interface no-proxy-arp service tcp 3389 7766 ! nat (inside,outside) after-auto source dynamic any interface nat (outside,inside) after-auto source static any any no-proxy-arp nat (DMZ,outside) after-auto source dynamic any interface access-group inside_access_in in interface inside access-group outside_access_in in interface outside access-group DMZ_access_in in interface DMZ access-group global_access global route outside 0.0.0.0 0.0.0.0 ISP_GW_ADDR 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 0:15:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy no user-identity enable user-identity default-domain LOCAL aaa authentication enable console LOCAL aaa authentication ssh console LOCAL http server enable http 0.0.0.0 0.0.0.0 outside http 192.168.2.0 255.255.255.0 inside http 192.168.0.0 255.255.255.0 inside http 192.168.3.0 255.255.255.0 outside http 192.168.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact crypto ipsec ikev2 ipsec-proposal DES protocol esp encryption des protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal 3DES protocol esp encryption 3des protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES protocol esp encryption aes protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES192 protocol esp encryption aes-192 protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES256 protocol esp encryption aes-256 protocol esp integrity sha-1 md5 crypto ipsec security-association pmtu-aging infinite crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map inside_map interface inside crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map outside_map interface outside crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0 enrollment self subject-name CN=192.168.1.2,CN=ciscoasa crl configure crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_1 enrollment self subject-name CN=192.168.1.2,CN=ciscoasa crl configure crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_2 enrollment self subject-name CN=192.168.1.1,CN=ciscoasa crl configure crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_3 enrollment self subject-name CN=192.168.2.1,CN=ciscoasa crl configure crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_4 enrollment self subject-name CN=192.168.1.1,CN=ciscoasa crl configure crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_5 enrollment self subject-name CN=192.168.0.1,CN=ciscoasa crl configure crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_6 enrollment self subject-name CN=192.168.0.1,CN=ciscoasa crl configure crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_7 enrollment self subject-name CN=192.168.0.1,CN=ciscoasa crl configure crypto ca trustpool policy crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_0 certificate 747d9154 XXX quit crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_1 certificate 465e9554 XXX quit crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_2 certificate 475e9554 XXX quit crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_3 certificate 485e9554 XXX quit crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_4 certificate 495e9554 XXX quit crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_5 certificate 4a5e9554 XXX quit crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_6 certificate 4b5e9554 XXX quit crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_7 certificate 9a7b9554 XXX quit crypto ikev2 policy 1 encryption aes-256 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 10 encryption aes-192 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 20 encryption aes integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 30 encryption 3des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 40 encryption des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 enable inside client-services port 443 crypto ikev2 enable outside crypto ikev2 remote-access trustpoint ASDM_Launcher_Access_TrustPoint_0 telnet timeout 5 ssh stricthostkeycheck ssh 192.168.0.0 255.255.255.0 inside ssh timeout 5 ssh version 2 ssh key-exchange group dh-group14-sha1 console timeout 0 dhcpd dns 192.168.0.1 interface inside ! dhcpd address 172.16.0.5-172.16.0.50 DMZ dhcpd dns 8.8.8.8 interface DMZ dhcpd lease 604800 interface DMZ dhcpd enable DMZ ! priority-queue outside threat-detection basic-threat threat-detection statistics threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 ntp server 129.6.15.29 source outside ssl trust-point ASDM_Launcher_Access_TrustPoint_2 outside ssl trust-point ASDM_Launcher_Access_TrustPoint_7 inside vpnlb-ip ssl trust-point ASDM_Launcher_Access_TrustPoint_7 inside ssl trust-point ASDM_Launcher_Access_TrustPoint_2 outside vpnlb-ip webvpn enable inside enable outside anyconnect-essentials anyconnect image disk0:/anyconnect-win-4.0.00048-k9.pkg 1 anyconnect enable tunnel-group-list enable group-policy DfltGrpPolicy attributes dns-server value 192.168.0.1 split-tunnel-network-list value main webvpn anyconnect ssl compression deflate group-policy GroupPolicy_main internal group-policy GroupPolicy_main attributes wins-server none dns-server value 192.168.0.1 vpn-tunnel-protocol ikev2 ssl-client split-tunnel-policy tunnelspecified split-tunnel-network-list value main default-domain value XXX webvpn anyconnect profiles value main_client_profile type user tunnel-group main type remote-access tunnel-group main general-attributes address-pool vpn-pool authentication-server-group (inside) LOCAL authentication-server-group (outside) LOCAL authorization-server-group LOCAL default-group-policy GroupPolicy_main tunnel-group main webvpn-attributes group-alias main enable ! class-map outside-class1 match access-list outside_mpc_1 class-map DMZ-class match access-list DMZ_mpc class-map inspection_default match default-inspection-traffic class-map outside-class match access-list outside_mpc ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options class class-default user-statistics accounting policy-map outside-policy class outside-class priority class outside-class1 police input 2000000 1500 policy-map DMZ-policy class DMZ-class police output 2000000 1500 ! service-policy global_policy global service-policy outside-policy interface outside service-policy DMZ-policy interface DMZ prompt hostname context no call-home reporting anonymous hpm topN enable Cryptochecksum:XX : end
sh ver
Result of the command: "sh ver" Cisco Adaptive Security Appliance Software Version 9.2(4) Device Manager Version 7.5(1) Compiled on Tue 14-Jul-15 22:19 by builders System image file is "disk0:/asa924-k8.bin" Config file at boot was "startup-config" ciscoasa up 5 hours 38 mins Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz, Internal ATA Compact Flash, 128MB BIOS Flash M50FW016 @ 0xfff00000, 2048KB Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0) Boot microcode : CN1000-MC-BOOT-2.00 SSL/IKE microcode : CNLite-MC-SSLm-PLUS-2.06 IPSec microcode : CNlite-MC-IPSECm-MAIN-2.09 Number of accelerators: 1 0: Int: Internal-Data0/0 : address is 442b.034a.96fa, irq 11 1: Ext: Ethernet0/0 : address is 442b.034a.96f2, irq 255 2: Ext: Ethernet0/1 : address is 442b.034a.96f3, irq 255 3: Ext: Ethernet0/2 : address is 442b.034a.96f4, irq 255 4: Ext: Ethernet0/3 : address is 442b.034a.96f5, irq 255 5: Ext: Ethernet0/4 : address is 442b.034a.96f6, irq 255 6: Ext: Ethernet0/5 : address is 442b.034a.96f7, irq 255 7: Ext: Ethernet0/6 : address is 442b.034a.96f8, irq 255 8: Ext: Ethernet0/7 : address is 442b.034a.96f9, irq 255 9: Int: Internal-Data0/1 : address is 0000.0003.0002, irq 255 10: Int: Not used : irq 255 11: Int: Not used : irq 255 Licensed features for this platform: Maximum Physical Interfaces : 8 perpetual VLANs : 20 DMZ Unrestricted Dual ISPs : Enabled perpetual VLAN Trunk Ports : 8 perpetual Inside Hosts : Unlimited perpetual Failover : Active/Standby perpetual Encryption-DES : Enabled perpetual Encryption-3DES-AES : Enabled perpetual AnyConnect Premium Peers : 25 perpetual AnyConnect Essentials : 25 perpetual Other VPN Peers : 25 perpetual Total VPN Peers : 25 perpetual Shared License : Disabled perpetual AnyConnect for Mobile : Enabled perpetual AnyConnect for Cisco VPN Phone : Enabled perpetual Advanced Endpoint Assessment : Enabled perpetual UC Phone Proxy Sessions : 2 perpetual Total UC Proxy Sessions : 2 perpetual Botnet Traffic Filter : Disabled perpetual Intercompany Media Engine : Disabled perpetual Cluster : Disabled perpetual This platform has an ASA 5505 Security Plus license. Configuration register is 0x1
Added: show logging once user's reported internet absense http://pastebin.com/3CqXGtuk