0

Clients periodically lose Internet access, but I can connect to Cisco ASA and manage it. If i am ping sites, it works:

Minsk# ping yandex.ru
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 77.88.55.60, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/24/30 ms

The problem is only observed for users. Solved by the command: clear xlate.

Why is this happening?

3

This behavior is typical of a full translation table:

For each connection that is made through the device, there's a record in a table. This table has of course a limited size and once it is full, new connections cannot be made.

The clear xlate command empty the table and thus allow new connections (but of course reset all existing connections).

You have to investigate why there's so many connections at the same time. To do so, you can use the show xlate detail and show conn details commands.

As explained in comment by @Jesse P. one option to workaround the issue is to lower the xlate timeout, but you still should investigate what consumes the connections.

Also another possible explanation (thanks @Ricky Beam) is that you hit the limit of licensed users.

  • 1
    You should make sure your xlate timeout interval is not something crazy high. The default value is usually fine but it can be adjusted to meet your needs. – Jesse P. Oct 30 '20 at 13:16
  • Or you're hitting the licensed number of users. – Ricky Oct 30 '20 at 19:45
  • @JesseP. 3 hours by default. – Ruslan Nov 3 '20 at 6:23
  • 1
    @Ruslan Right, but if there are enough connections to exhaust the limit before some start timing out, that needs to be lowered. Some compliance policies want it lowered to 30 minutes, which may fit this case well, too. – Jesse P. Nov 3 '20 at 11:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.