ASA 5516-X Intermittent Downtime
-
Hi folks,
I think my ASA is on the way out. Any ideas on what to check to make sure? I've contacted Cisco already, but that response could be slow, so just asking for troubleshooting tips...
So, no network changes for months, and the device has been in use in the rack since last November. Overnight around 3am, all office locations globally lose access to London.
I get a call at about 4am, head in at 5am figuring the office power loss or something. But nope, all power on fine.
I check the ASA and the SSD light on the far left is not green. All other lights green. I also cannot contact the ASA locally ping, use ADSM, or connect by putty. So, I hard reboot by pulling the power.
Within 5 minutes, all services back online. But, the SSD light is flickering green. Not solid.
Then, around 8am (few hours maybe), total loss again. SSD light off. Only option to hard boot.
I have done this several times now and failure looks to happen between 1 - 3 hours of last reboot. No errors in logs. Just instant failure.
I figure based on the light that the SSD in the back needs to be replaced and have contacted Cisco. Any other ideas on what to check in case im wrong?
I have a backup of the configuration so thats fine. But, no reliable device...
Best,
Jim -
That's not "on the way out", that's done.
If you've already paid for the support and/or warranty to replace it, then do that.
If not, pick an EdgeRouter https://www.ui.com/products/#edgemax and get rid of that way to expensive equipment.
Not a fan of Cisco gear at that level of performance. They do make good gear, but the good gear starts around ~$13,000 last I looked.
-
Its under support until July 2020. Just trying to make sure I have done all I can before Cisco call back. Would I be right to say the SSD light should be solid green?
-
@Jimmy9008 said in ASA 5516-X Intermittent Downtime:
Its under support until July 2020. Just trying to make sure I have done all I can before Cisco call back. Would I be right to say the SSD light should be solid green?
If i remember right (probably not), that's an activity light that will blink like the HDD light on a computer.
Most important thing is to get through the Cisco warranty process quickly right now.
-
@Jimmy9008 said in ASA 5516-X Intermittent Downtime:
Its under support until July 2020. Just trying to make sure I have done all I can before Cisco call back. Would I be right to say the SSD light should be solid green?
Don't worry about doing all you can. Get Cisco on the line and tell them the issues. Tell them it's a services out issue and it needs to be replaced.
-
Would the engineer they send out generally restore my backup config to the replacement too? Ive not done that before...
-
@Jimmy9008 said in ASA 5516-X Intermittent Downtime:
Would the engineer they send out generally restore my backup config to the replacement too? Ive not done that before...
Do they even send people onsite? I mean I assume there is a service level agreement that offers this, but pretty sure that wasn't the case for less expensive options - they always jut mailed me a new one - I did the restore, and then they remoted in to setup whatever I needed help with.
-
@Jimmy9008 said in ASA 5516-X Intermittent Downtime:
Would the engineer they send out generally restore my backup config to the replacement too? Ive not done that before...
Depends on the agreement. But generally, from my experience, no.
-
Two is one and one is none.
If you are depending on something, there should be two firewalls.
And in that case you just get the faulty one checked out. That's what support and service is for.Now you are paying the price for not having the right setup in the first place.
-
@Pete-S said in ASA 5516-X Intermittent Downtime:
Two is one and one is none.
If you are depending on something, there should be two firewalls.
And in that case you just get the faulty one checked out. That's what support and service is for.Now you are paying the price for not having the right setup in the first place.
I would go up the food chain and ask how important this connection is. If it's important, have a new one shipped out immediately.
When you get the old one replaced or repaired, have it as a spare on the shelf or better yet set it up in a HA config.
-
@Pete-S said in ASA 5516-X Intermittent Downtime:
@Pete-S said in ASA 5516-X Intermittent Downtime:
Two is one and one is none.
If you are depending on something, there should be two firewalls.
And in that case you just get the faulty one checked out. That's what support and service is for.Now you are paying the price for not having the right setup in the first place.
I would go up the food chain and ask how important this connection is. If it's important, have a new one shipped out immediately.
It's a low end Cisco ASA. Why would they want to buy another one of those when then could get 8 better performing Ubiquiti Edgerouter Pros for the same price?
-
@Pete-S said in ASA 5516-X Intermittent Downtime:
@Pete-S said in ASA 5516-X Intermittent Downtime:
Two is one and one is none.
If you are depending on something, there should be two firewalls.
And in that case you just get the faulty one checked out. That's what support and service is for.Now you are paying the price for not having the right setup in the first place.
I would go up the food chain and ask how important this connection is. If it's important, have a new one shipped out immediately.
When you get the old one replaced or repaired, have it as a spare on the shelf or better yet set it up in a HA config.
Depends on cost of downtime vs cost of a new ASA.
-
@travisdh1 said in ASA 5516-X Intermittent Downtime:
@Pete-S said in ASA 5516-X Intermittent Downtime:
@Pete-S said in ASA 5516-X Intermittent Downtime:
Two is one and one is none.
If you are depending on something, there should be two firewalls.
And in that case you just get the faulty one checked out. That's what support and service is for.Now you are paying the price for not having the right setup in the first place.
I would go up the food chain and ask how important this connection is. If it's important, have a new one shipped out immediately.
It's a low end Cisco ASA. Why would they want to buy another one of those when then could get 8 better performing Ubiquiti Edgerouter Pros for the same price?
Because it's too much work to change when your under a time constraint. And you have no clue what kind of issues you are going to run into and how long it will take to sort it out.
And if they want HA, which it sounds like they should, Edgerouter is a no-go.
It can do VRRP but it can't sync connections or configuration so it's basically useless for anything mission-critical. -
@Pete-S said in ASA 5516-X Intermittent Downtime:
@travisdh1 said in ASA 5516-X Intermittent Downtime:
@Pete-S said in ASA 5516-X Intermittent Downtime:
@Pete-S said in ASA 5516-X Intermittent Downtime:
Two is one and one is none.
If you are depending on something, there should be two firewalls.
And in that case you just get the faulty one checked out. That's what support and service is for.Now you are paying the price for not having the right setup in the first place.
I would go up the food chain and ask how important this connection is. If it's important, have a new one shipped out immediately.
It's a low end Cisco ASA. Why would they want to buy another one of those when then could get 8 better performing Ubiquiti Edgerouter Pros for the same price?
Because it's too much work to change when your under a time constraint. And you have no clue what kind of issues you are going to run into and how long it will take to sort it out.
And if they want HA, which it sounds like they should, Edgerouter is a no-go.
It can do VRRP but it can't sync connections or configuration so it's basically useless for anything mission-critical.Where are you getting the need for HA from what @Jimmy9008 has said so far?
With the Edgerouters you buy 2, set the config for both and put the extra one on the shelf. If you can't afford 5 minutes of downtime, you shouldn't be using an ASA in the first place.
Edit: And with buying 2 Edgerouters, you still save tons of money on the purchase price!
-
@travisdh1 said in ASA 5516-X Intermittent Downtime:
Where are you getting the need for HA from what @Jimmy9008 has said so far?
From this: "Overnight around 3am, all office locations globally lose access to London".
And from this: "I get a call at about 4am"
5516-X is a midrange device. I've mostly used the older series but there is nothing wrong with the ASA. If it's fast enough for the WAN link, it will get the job done.
-
@coliver said in ASA 5516-X Intermittent Downtime:
@Pete-S said in ASA 5516-X Intermittent Downtime:
@Pete-S said in ASA 5516-X Intermittent Downtime:
Two is one and one is none.
If you are depending on something, there should be two firewalls.
And in that case you just get the faulty one checked out. That's what support and service is for.Now you are paying the price for not having the right setup in the first place.
I would go up the food chain and ask how important this connection is. If it's important, have a new one shipped out immediately.
When you get the old one replaced or repaired, have it as a spare on the shelf or better yet set it up in a HA config.
Depends on cost of downtime vs cost of a new ASA.
Cost of downtime would have to be INSANELY high to outweigh the cost of a new Cisco anything.
-
@Pete-S said in ASA 5516-X Intermittent Downtime:
@travisdh1 said in ASA 5516-X Intermittent Downtime:
Where are you getting the need for HA from what @Jimmy9008 has said so far?
From this: "Overnight around 3am, all office locations globally lose access to London".
That really doesn't tell us anything about the business need, which is what determines the need for HA anything.
From the little we know, the business already decided that they do not need router level HA.
And from this: "I get a call at about 4am"
This is more an issue with @Jimmy9008 not setting realistic expectations with management. If management signed off on having a single firewall, then he shouldn't be working on it at 4am.
-
@travisdh1 said in ASA 5516-X Intermittent Downtime:
If you can't afford 5 minutes of downtime, you shouldn't be using an ASA in the first place.
You mean it takes 5 minutes from the time something stops working until the users have noticed and told their manager, who then managed to get hold of the right people, and then in turn had to call the guy who could get the job done, who would be immediately available to commute or drive or take a cab to work and do the troubleshooting and finally replace the firewall?
-
@Pete-S said in ASA 5516-X Intermittent Downtime:
@travisdh1 said in ASA 5516-X Intermittent Downtime:
Where are you getting the need for HA from what @Jimmy9008 has said so far?
5516-X is a midrange device. I've mostly used the older series but there is nothing wrong with the ASA. If it's fast enough for the WAN link, it will get the job done.
You call that sort of performance a midrange device? The performance of that thing blows chunks. An ER-X is actually comparable! (I'm looking at the stats from https://www.serversupply.com/NETWORKING/SECURITY APPLIANCE/8 PORT/CISCO/ASA5516-FPWR-K9.htm?gclid=CjwKCAiA__HvBRACEiwAbViuUyJP0tx0HO8VIcuyQNsMpI6LeD0m_1d1X0GTUAV9heQJUGX0dyap2xoCqGIQAvD_BwE)
-
@travisdh1 said in ASA 5516-X Intermittent Downtime:
@Pete-S said in ASA 5516-X Intermittent Downtime:
@travisdh1 said in ASA 5516-X Intermittent Downtime:
Where are you getting the need for HA from what @Jimmy9008 has said so far?
From this: "Overnight around 3am, all office locations globally lose access to London".
That really doesn't tell us anything about the business need, which is what determines the need for HA anything.
From the little we know, the business already decided that they do not need router level HA.
And from this: "I get a call at about 4am"
This is more an issue with @Jimmy9008 not setting realistic expectations with management. If management signed off on having a single firewall, then he shouldn't be working on it at 4am.
On the contrary, it tells us a lot about the business needs. Since the business decided to call him in the middle of the night, someone decided the firewall was important enough for them to do that, instead of waiting until the morning.
Maybe nobody brought up the HA option when the firewall was put in place or the need wasn't there at the time.
