Solved

PIX 515 random crashing

Posted on 2006-06-13
10
464 Views
Last Modified: 2013-11-16
Hello everyone

I've been having an intermittent problem on my PIX 515 firewall over the past 6 months.  Every once in a while the PIX will just crash.  No packets are sent to/from the interfaces.  I can't telnet into the unit to see if anything is going on.  I can't even use a standard console cable to get to a prompt.  All the lights are on, some are blinking, but the PIX is dead in the water.  The only thing that fixes it is turning it off then on again.

Because it's so random, I haven't been able to figure out how or why it crashes.  It can happen in the morning, night, weekday, weekend, you name it.  Is there any type of logging on the PIX I can check or enable to see what type of problems are occuring up to the point where it crashes?  

If you need the config let me know.  Our PIX is running 6.3(1) and has 6 interfaces (3 being used for DMZ access).

Any help would be great...

Thanks
Jake
0
Comment
Question by:jsavage66
  • 4
  • 4
  • 2
10 Comments
 
LVL 1

Expert Comment

by:sgh_aba
ID: 16896468
jsavage66,

Is your PIX plugged into a UPS?  Are you sure the power source is clean and you're not getting somekind of power surges?  Have you setup a syslog server so you can see what the last traffic was before the PIX hangs?  And finally, how's the temperature of the unit and the room it's in?

sgh_aba
0
 
LVL 10

Expert Comment

by:Sorenson
ID: 16896498
I would strongly consider upgradeing to 6.3(5).  Configure logging to a syslog server (kiwi makes a good free one, http://www.kiwisyslog.com/downloads.php ) by entering the commands.

logging on
logging buffered errors
logging trap notifications
logging queue 1024
logging host inside x.x.x.x    (where x.x.x.x is the host that is running the syslog application)

0
 
LVL 1

Expert Comment

by:sgh_aba
ID: 16896573
Sorenson,

Does the kiwi free one function in lieu of the Cisco PIX Syslog server that I usually use?

sgh_aba
0
 

Author Comment

by:jsavage66
ID: 16896656
sgh_aba:  Everything in our server room is running off of a huge UPS (36 batteries).  Power is clean.  Temperature in the room is about 70 degrees all day/night.  I do have Kiwisyslog but it was turned off the other day.  I've turned it on again so we'll see what I get the next time it crashes.

Sorenson:  I'll see if I can get the code for 6.3(5).  Also - when I set up "logging trap notifications" I was getting lots of messages about internet access from the internal employees.  Things like 55.55.55.55 accessed 33.33.33.33:80/html/picture.jpg.  

Have a meeting to go to but I'll check on the code update when I'm finished.
0
 
LVL 10

Expert Comment

by:Sorenson
ID: 16897378
I would log everything, and then sort through the times of the crash, to see if you have some type of access that is upsetting the pix.  Also check your connection count to see what is going on (show conn count), i remember an issue with 6.3 where the connections would continually rise and never be reclaimed.

0
Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

 

Author Comment

by:jsavage66
ID: 16904866
The PIX crashed again today around 11am.  I was logging trap notifications and ran through a few pages of log info but didn't see anything around the time it went down.

I just finished upgrading to 6.3(5).  We'll see how that works out I guess.  I saw they have version 7 out but I would need a memory upgrade before installing it.
0
 
LVL 1

Accepted Solution

by:
sgh_aba earned 500 total points
ID: 16907296
jsavage66,

Any chance you can get your hands on a spare 515?  If so you could do a quick copy from the failing on to the spare and see if the problem disappears.  I'm still leaning towards some kind of hardware failure in that your access to everything on the PIX fails (console, lan1, lan2, lan3).

If you're using only 2 of the lan ports (inside,outside) you might even get by with a 506E just for testing purposes...

keep us updated.

sgh_aba
0
 

Author Comment

by:jsavage66
ID: 16913808
Back to the drawning board.  PIX crashed again today running on 6.3.5 code.  Seems like it's getting more frequent.  It used to crash once or twice every 2-3 weeks.  Now it's every other day.

sgh_aba:  I don't have access to another PIX, although, if this continues I may be looking into purchasing another...
0
 
LVL 1

Expert Comment

by:sgh_aba
ID: 16913913
It's hardware...

replace it.

sgh_aba
0
 

Author Comment

by:jsavage66
ID: 17242818
Replaced the PIX and all is well.  Thanks for the help.
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
Let’s list some of the technologies that enable smooth teleworking. 
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now