1

I have small office where running cisco ASA ASA5506 and version 9.4(1) and it's also configured for IPsec VPN tunnel, My LAN subnet is 10.1.1.0/24

So i have found very interesting things in LAN where if i ping 10.1.1.255 (broadcast address) it create nuclear reaction and my packet goes in loop and fill my LAN with traffic and my cisco ASA CPU goes 100%

This is what strom looks in tcpdump

14:38:06.940137 IP 10.1.1.49 > 10.1.1.255: ICMP echo request, id 14677, seq 0, length 64
14:38:06.940387 IP 10.1.1.49 > 10.1.1.255: ICMP echo request, id 14677, seq 0, length 64
14:38:06.940389 IP 10.1.1.49 > 10.1.1.255: ICMP echo request, id 14677, seq 0, length 64
14:38:06.940390 IP 10.1.1.49 > 10.1.1.255: ICMP echo request, id 14677, seq 0, length 64
14:38:06.940550 IP 10.1.1.49 > 10.1.1.255: ICMP echo request, id 14677, seq 0, length 64
14:38:06.940685 IP 10.1.1.49 > 10.1.1.255: ICMP echo request, id 14677, seq 0, length 64

This is how i stop strom, clearing conn in ASA

ASA# clear conn address 10.1.1.49

I believe cisco ASA participating to amplify this storm. here is the basic config snippets of ASA

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface

Notes: I believe one of above option has something to do with this storm.

Routes

S*    0.0.0.0 0.0.0.0 [1/0] via 26.172.22.1, outside
C        10.1.1.0 255.255.255.0 is directly connected, inside
L        10.1.1.1 255.255.255.255 is directly connected, inside

EDIT

I found this link in google but not clean this is my issue or not https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/116170-probsol-asa-00.html

Improve this question
9
  • Satish, we need to see your topology.
    – Ron Trunk
    Sep 29, 2019 at 19:32
  • Have you tried upgrading to any of the bugfix releases in the 9.4(x) series to see if this was addressed already? 9.4(1) is pretty ancient and full of bugs.
    – Jesse P.
    Sep 29, 2019 at 19:48
  • It feel like same-security-traffic permit intra-interface causing hair-pin issue and sending traffic back to host and creating strom. i will see if i can take that option out and make some adjustment around it.
    – Satish
    Sep 30, 2019 at 14:07
  • @Satish Possibly, but Cisco switches, for example, and by default, do not allow directed broadcasts for this and other reasons. It seems more like a bug that a security device such as an ASA WOULD allow for it, which is why I'm wondering if this was addressed in updates since 9.4(1), since that was the base release and had hundreds of bugs in it. So, have you tried updating to the latest release in the 9.4(x) series to see if this still works?
    – Jesse P.
    Sep 30, 2019 at 15:16
  • @JesseP. I have try to look for 9.4.1 bugs but didn't find any clue or evidence, I will try to upgrade and see if it can be fix.
    – Satish
    Sep 30, 2019 at 16:16

1 Answer 1

Reset to default
1

After upgrade to newer version 9.8.2 resolved all of the issue. Thanks for your support.

Improve this answer
1
  • Accept your answer so this doesn't keep coming up as unanswered.
    – Jesse P.
    Oct 12, 2019 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.