0

Clients periodically lose Internet access, but I can connect to Cisco ASA and manage it. If i am ping sites, it works:

Minsk# ping yandex.ru
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 77.88.55.60, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/24/30 ms

The problem is only observed for users. Solved by the command: clear xlate.

Why is this happening?

Improve this question

1 Answer 1

Reset to default
3

This behavior is typical of a full translation table:

For each connection that is made through the device, there's a record in a table. This table has of course a limited size and once it is full, new connections cannot be made.

The clear xlate command empty the table and thus allow new connections (but of course reset all existing connections).

You have to investigate why there's so many connections at the same time. To do so, you can use the show xlate detail and show conn details commands.

As explained in comment by @Jesse P. one option to workaround the issue is to lower the xlate timeout, but you still should investigate what consumes the connections.

Also another possible explanation (thanks @Ricky Beam) is that you hit the limit of licensed users.

Improve this answer
4
  • 1
    You should make sure your xlate timeout interval is not something crazy high. The default value is usually fine but it can be adjusted to meet your needs.
    – Jesse P.
    Oct 30, 2020 at 13:16
  • Or you're hitting the licensed number of users.
    – Ricky
    Oct 30, 2020 at 19:45
  • @JesseP. 3 hours by default.
    – Ruslan
    Nov 3, 2020 at 6:23
  • 1
    @Ruslan Right, but if there are enough connections to exhaust the limit before some start timing out, that needs to be lowered. Some compliance policies want it lowered to 30 minutes, which may fit this case well, too.
    – Jesse P.
    Nov 3, 2020 at 11:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.