troubleshooting Question

Very strange ASA 5510 problem, dual isp / failover issue

Avatar of thunderhead
thunderhead asked on
RoutersHardware FirewallsCisco
11 Comments1 Solution1756 ViewsLast Modified:
Hi

We have a Cisco ASA 5510 set up with two inbound connections.
The config is set so that if the primary ISP cannot ping 4.2.2.2 it will failover to the secondary line, once the primary line can ping the same IP it will fail back.

Nothing out of the ordinary really for this bit of kit.

The set up is as follows:

Internet---> Primary ISP Equipment (x.x.x.249) --> Outside Primary on Cisco ASA (x.x.x.250)
Internet--> Seconadry ISP (x.x.x.30) --> Outside Secondary on Cisco ASA (x.x.x.30)

Cisco --> LAN

Earlier this month or ASA would not contact 4.2.2.2, it could ping the next hop address of the primary line (the ISPs equipment based in our office), naturally we phoned our ISP who, although slow to troubleshoot, said that the line was fine.

We confirmed this by attaching a laptop to the primary line

Internet---> Primary ISP Equipment (x.x.x.249) --> laptop (x.x.x.250)

And could ping 4.2.2.2, and browse the internet without problem.

As the Cisco was no longer covered by warranty / SmartNet we bought a new one.

After upgrading from 8.3(1) to 8.3.2 and finding that the Cisco would fail over, but would not fail back, we downgraded to 8.0(4), applied the config from the old router and were up and running.

Four days later the same problem emerged. We could ping the ISP equipment, but nothing beyond that. A laptop with a x.x.x.250 address would see the ISPs equipment (x.x.x.249) and anything beyond that, so the line was fine.

At the moment we are having to run with the following:

Internet---> Primary ISP Equipment (x.x.x.249) --> Netgear FVX538v2 (x.x.x.250)
Internet--> Seconadry ISP (x.x.x.30) --> Outside Secondary on Cisco ASA (x.x.x.30)

Then some funky routing to get things talking, but we are still having problems as servers cannot have two default gateways etc.

What we have tried so far:

Changing network cables (an obvious first step)
Confirming the Cisco config is ok - Both the ISP and the ASA supplier have confirmed that our config is absolutely fine
Confirming the line is ok - it works fine with a laptop, or with a netgear firewall.
Cisco hardware issue - it happened to one router, and then a brand new one? The first router had been in place without problem for two years.
Speed / Duplex issue? we have tried all combinations of 10/full, auto/auto, 100/full etc on the Cisco and nothing works
Placed a switch (unmanaged) between the primary line ISP equipment and the ASA to also eliminate the idea that it could be a port speed setting issue.
Turned the Cisco on and off, turned the port on and off.
Failover setting issue? Even if the failover / failback was not working between the two line we should still be able to ping out from the cisco primary line

An example of the ping responses from the Cisco (these are only a few seconds apart):

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to x.x.x.249, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.2.2.2, timeout is 2 seconds:
!!!!?
Success rate is 80 percent (4/5), round-trip min/avg/max = 20/52/150 ms

 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.2.2.2, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)

We got a lot of responses like this, if we cleared the ARP cache on the Cisco we get a few ping responses initially then everything stops.

So far our supplier has not been able to come up with any ideas, neither have the ISP, and Cisco wont talk to us as we dont have a SmartNet contract with them.

Does any one else have any ideas what we could try, or have they seen anything like this in the past?
Join the community to see this answer!
Join our exclusive community to see this answer & millions of others.
Unlock 1 Answer and 11 Comments.
Join the Community
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 11 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros