Firewall Issue

Posted on 2010-03-28
Medium Priority
Last Modified: 2012-06-21
Hi Experts !!!

We have two firewall fwsm modules deployed on two different 6509 chassis at two different sites, connected via layer 2 link, as primary and standby modules.

NATng is enabled on the primary firewall module and all xlate and conns are getting replication to standby module.

Yesterday, suddenly NAT engine in the primary fwsm module stopped working and no inboun/outbound traffic was being passed. No changes were made.

Any ideas, what could be the issue and how it can be fixed? FWSM ver is 3.1(1)


Question by:vbongarala
  • 3
  • 2

Author Comment

ID: 28901933
Plz provide elaborate steps to fix the issue, instead of brief.

Assisted Solution

troubleshooter141 earned 400 total points
ID: 28914102
have you done a show log or show tech? I would do a show log and see if you find an answer tere as to what might have happen. Also I would do a sow tech and enter the output on the ouput interpreter tool on Cisco's website. This might give you a good idea of what's happened and what to do to address the issue.

Author Comment

ID: 28934795
I did, show logging but did not find anything unusual but did not do show tech.

What does 'show tech' cmd do and does it provide insight into what happened and what caused the issue, that cannot be known from other show cmds ?


Expert Comment

ID: 28974985
It is a combination of several show commands (see list below). This is the command I am normally asked by Cisco tech support when troubleshooting an issue with them. What I would do is log the session, then run the command. Save the output as a log file. Go to https://www.cisco.com/cgi-bin/Support/OutputInterpreter/home.pl and upload the file you just saved. It will analyze it for you and give you recommendations and show you issues based on the analysis.

The output of the show tech-support command can include the output of the following commands:

•show apollo traffic

•show appletalk traffic

•show bootflash

•show bootvar

•show buffers

•show cdp neighbors

•show cef

•show clns traffic

•show context

•show controllers

•show decnet traffic

•show interfaces

•show ip cef

•show ip interface

•show ip traffic

•show isis

•show mpls

•show novell traffic

•show processes cpu

•show processes memory

•show running-config

•show stacks

•show version

•show vines traffic

•show xns traffic

•show file systems

•dir nvram:

•show disk0: all

•show process cpu

•show pci controller


Accepted Solution

vbongarala earned 0 total points
ID: 28997396
We rebooted the fwsm module and issue got fixed but i'm not quite satisfied as i really still do not know what caused it.

Do you see any other angle to the issue ?


Featured Post

Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
In this article, we’ll look at how to deploy ProxySQL.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

601 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question