PIX: Failover message block alloc failed

Posted on 2007-07-24
Last Modified: 2013-11-16
Hardware:   PIX-515E, 128 MB RAM, CPU Pentium II 433 MHz
OS: Cisco PIX Security Appliance Software Version 7.1(2)

I have two of the above firewalls that are connected with a failover LAN connection.  Every couple of months the Primary firewalls beings to deny any new connections through the firewall and I cannot SSH or even console into the firewall.  When I try to console into the FW it scrolls all the logging messages and will not allow me to login.  I get a weird "command...." message after issuing the "enable" command and get sent back to the user exec prompt.  
I have a syslog server running and after that keeps displaying the following message:
"(Primary) Failover message block alloc failed"

Here is Cisco's explanation of the message:
Explanation: Block memory was depleted. This is a transient message and the PIX Firewall should
recover. (Primary) can also be listed as (Secondary) for the secondary unit.

After about 20-30min of no connectivity and the above messages the Primary FW eventually fails over to the secondary FW (on its own) and connections are restored.  I don't see any other issues in the log other than the message above.  
Question by:nakoz69
    LVL 57

    Expert Comment

    by:Pete Long
    Your PIX is getting Overloaded, Along with the show cpu usage command, you can use the show blocks command in order to determine how often the PIX is overloaded

    LVL 57

    Expert Comment

    by:Pete Long
    LVL 1

    Author Comment

    Awsome document!  I never even knew what packet-processing blocks were.  However, there is still one more issue, i cannot access the firewall when it is generating the block errors.  Even trying to console in it will not allow me to login and check the blocks or CPU.
    LVL 57

    Accepted Solution

    Yeah I take your point - I know its a bit of a cop out answer (sorry) but you could try an upgrade to version 8 (cause if you opened a TAC case they would suggest that first)

    I'm assuming that the firewalls fail over properly when this happens?
    LVL 1

    Author Closing Comment

    Upgrading to version 8 fixed the memory issues. The Pix has been running clean for months now with no issues.  Cisco admits there are memory problems with 7.1(2)

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Optimal Xbox 360 connectivity requires "OPEN NAT". If you use Juniper Netscreen or SSG firewall products in a home setting, the following steps will allow you get rid of the dreaded warning screen below and achieve the best online gaming environment…
    This article assumes you have at least one Cisco ASA or PIX configured with working internet and a non-dynamic, public, address on the outside interface. If you need instructions on how to enable your device for internet, or basic configuration info…
    This video discusses moving either the default database or any database to a new volume.
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    758 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now