4

I have two ASA 5525-X joined in cluster. Software on both ASAs is 9.7(1)4. I run them in multi-context mode. We will talk about admin context on which I have problem.

When ASA-1 is master and ASA-2 is slave - everything is ok. When I restart master unit (ASA-1) and ASA-2 becomes a master - everything is ok...until...ASA-1 re-join the cluster as slave unit. After that traffic from subnet object network on2 through admin context stops.

Syslog server reports an error: %ASA-3-210007: LU allocate xlate failed for dynamic-PAT TCP translation from inside : 192.168.1.1 / 12345 ( x.x.x.x / 12345) to outside : Real IP Address / Real Port ( Mapped IP Address / Mapped Port)

x.x.x.x is public IP address on outside interface on my admin context on which I run PAT.

In Cisco documentation for this error we have:

210007 Error Message %ASA-3-210007: LU allocate xlate failed for type [ static | dynamic ]-[ NAT | PAT ] secondary(optional) protocol translation from ingress interface name : Real IP Address / real port ( Mapped IP Address / Mapped Port) to egress interface name : Real IP Address / Real Port ( Mapped IP Address / Mapped Port) Explanation Stateful Failover failed to allocate a translation slot record.

Recommended Action Check the available memory by using the show memory command to make sure that the ASA has free memory available. If no memory is available, add more memory.

I checked the memory, there is no problem with memory.

I have found the documentation about this error on bug CSCue32221, but there is message "No users are affected", which is not my case. It is bug for software version 8.4(4.7), which also is not my case, and "Failover along with twice nat commands configured"...I don't have twice NAT, but I have:

object network on1
nat (inside,outside) dynamic interface
object network on2
nat (inside,outside) dynamic interface

What can I do?

Improve this question
4
  • 3
    This sounds sufficiently complex to put in a trouble ticket with Cisco (if you have support). Another comment is that bugs often affect versions that are not mentioned in the bug report, so you may still be getting hit by it.
    – theglossy1
    Commented Jun 12, 2017 at 20:25
  • When I disabled NAT on "object network on2" failover within cluster started to work fine, as it should. So this issue is the closest to the Bug I described. If someone had similar experiences please help me with advise can I do something else?
    – John
    Commented Jun 13, 2017 at 14:45
  • 1
    If it is a bug, there's not much you can do other than to change sw versions. But I agree with @theglossy that you should open a support case with Cisco.
    – Ron Trunk
    Commented Jun 13, 2017 at 17:09
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin ♦
    Commented Aug 7, 2017 at 16:13

1 Answer 1

Reset to default
1

Seeing the same issue on a ASA5555 cluster pair, since upgrading to 9.7.1(8)

Looks like bug - CSCvc79371, fixed in 9.8.1 (according to release notes for 9.8.1)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.