There is a problem with downloading pcap capture from Cisco ASA 5520 from https://<ip_of_asa>/admin/capture/<capture_name>/pcap - an empty file with size 24 bytes is downloaded while https://<ip_of_asa>/admin/capture/<capture_name> (without pcap in url) shows captured packets fine. The problem started when ASA memory usage was at high level. Now it is back to normal but capture download still fails. The capture was removed and a new one created - this didn't help. I've already faced this problem before and in that case it was resolved after ASA restart. In this case ASA reboot is not an option. Is there a way to resolve this issue without reboot?
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.– Ron Maupin ♦Dec 25, 2018 at 9:23
-
This issue was finally resolved after ASA reboot. At the time when the question was asked a reboot was not possible so it not really an answer. But I'll probably have to add that as an answer.– Andrey GrachevDec 25, 2018 at 10:33
-
Please do. We get a lot of questions with no accepted answers popping up all the time. Users complain that we just see the same questions over and over, so I'm trying to clear the backlog of the year. Thanks.– Ron Maupin ♦Dec 25, 2018 at 10:35
Add a comment
|
2 Answers
As a workaround, it looks like you can manually copy the capture via CLI to any of the normal destinations: https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/c4.html#wp2144072
This means you should also be able to SCP it off the ASA, if you can't push it to HTTP/FTP/TFTP via the copy command. Here's a good post on using SCP if you haven't before: https://thestupidengineer.wordpress.com/2015/04/01/scp-file-to-asa/
You can download Putty's SCP client if you don't have a 'Nix box to use.
-
Thank you for the answer. While this a valid solution, I can't use it since I don't have console access to ASA. It is possible to ask colleagues to use such method once or twice but capture needs to be downloaded periodically. The only way for me right now is to restore download via https. Sep 2, 2018 at 10:00
-
@AndreyGrachev, I don't understand why you think that you must have console access to the ASA. SCP works over the network, and you should be able to telnet or SSH into the ASA. In fact, it is recommended that you actually disable the HTTP and HTTPS servers in your ASA.– Ron Maupin ♦Sep 2, 2018 at 15:14
-
@RonMaupin, sorry, under console access I actually meant CLI (telnet or SSH) - don't have any of that. HTTP is currently used because there is some automated processing done by downloading the capture periodically. Sep 2, 2018 at 15:29
-
@AndreyGrachev, if you do not have CLI access to the ASA, then I do not understand how you think you can resolve a problem on it. For a question to be on-topic here, you must have direct control. Also, it sounds like your capture/processing is really a kludge. There may be better ways to do what you want. You can set up a logging server, and the ASA can automatically send to it on its own, then you can take data from the server at your leisure.– Ron Maupin ♦Sep 2, 2018 at 15:37
-
It sounds like you need to configure NetFlow and have a NetFlow server. You seem to be using the wrong tool for the job. In any case, we would need to see the full (sanitized) ASA configuration.– Ron Maupin ♦Sep 2, 2018 at 16:02
The issue was resolved after ASA reboot. Not a real answer since the question was about a fix without reboot. Adding it not to leave the question hanging unaccepted.