Does anyone know a way to force an ASA to clear xlate when a tracked route fails (and fails back)

Here is a brief description of my issue., as brief as i can make it anyways.

I have a few clients using a cloud based phone system, where the VOIP phones sit on the inside of the network connecting out to a phone system on the outside. At these specific locations, they are setup with multiple internet lines terminated on an ASA 5505 (version 8.2(5)), and are using tracked routes w/ sla monitor for line fail-over.

Here are the pertinent lines of the config:

interface Vlan1
 nameif inside
 security-level 100
 ip address 10.20.30.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 192.168.100.225 255.255.255.0
!
interface Vlan3
 no forward interface Vlan2
 nameif backup
 security-level 0
 ip address 205.160.6.91 255.255.255.0

access-list acl_out extended permit icmp any any
access-list acl_backup extended permit icmp any any

global (outside) 1 interface
global (backup) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0

access-group acl_out in interface outside
access-group acl_backup in interface backup

route outside 0.0.0.0 0.0.0.0 192.168.100.1 1 track 1
route backup 0.0.0.0 0.0.0.0 205.160.6.1 254

sla monitor 1
 type echo protocol ipIcmpEcho 8.8.8.8 interface outside
 num-packets 3
 frequency 10
sla monitor schedule 1 life forever start-time now

track 1 rtr 1 reachability

Open in new window


My problem occurs during a failure scenario... when the primary line goes down, the route fails over and after a short period, 30-45 seconds or so the phones are back in order, dialing and receiving no issues, 2 way audio working etc.. so no problems here.

The issue happens when i fail back to the primary line. In this case, the route switches back to the primary line and the phones re-establish themselves, but now are stuck with only 1 way audio for both inbound and outbound calls.

After setting this up in a lab to play, I realize why. The ASA, after failing back to the primary line is still holding onto and xlate / connection over the backup interface for SIP (tcp 5060 to the phone)

ciscoasa# show conn | include 10.20.30.10
TCP backup 63.209.193.9:5060 inside 10.20.30.10:51358, idle 0:00:41, bytes 50525, flags UIO

Open in new window


I found out the VOIP vednor is hitting the phone every 45 seconds or so with a SIP, i guess you could say keep-alive and given when i fail back to my primary line the backup line never really goes "down", they continue to send their 45 second interval sip packet to the backup IP, the xlate never clears and and this connection never clears, thus causing my 1 way audio issue.

A reboot of the phone, or a clear xlate on the firewall does the trick, the phone re-establishes itself over the primary line, the stale connection get's dropped and all is good.

My question here:  Does anyone know of a way to force a clear xlate on the ASA, when the tracked route changes. I have tossed around the idea of using SNMP traps to a syslog server to watch for the event, and in turn send an SNMP write back to the ASA with the "clear xlate" command, but am looking to find a way to not rely on anything outside the ASA to handle the routing for this.

Any ideas or thought appreciated!

thanks!
Tim
LVL 1
SYNERGYTECHAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

SYNERGYTECHAuthor Commented:
It would appear I found what i was looking for. I knew this was do-able on the router IOS, but had never seen a way to do it with the ASA.

Looks like starting in version 9.2(1) they released EEM for the ASA:

http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/117883-config-eem-00.html

I should be able to use this to trigger the "clear xlate" command when EEM sees the route fail-over logged.

I'll need to upgrade one of these ASA 5505's to 9.2 and test this, but it looks promising. I will post my findings after i test.

-Tim
0
Pete LongTechnical ConsultantCommented:
<Subscribed> Interested in your findings, not used EEM yet.
0
AkinsdNetwork AdministratorCommented:
Yes
Scripting with EEM will do the trick.
0
SYNERGYTECHAuthor Commented:
Sorry for the delay in posting this, finally just got back to testing this out yesterday.

The EEM config works, i upgraded a test ASA to 9.2(4), logged into ASDM to watch the real-time logs and failed over the interfaces, watching the logs I saw the event ID 622001 logged which is the same event for both removal and addition of the tracked route.

Here is the EEM config that worked for my scenario (to clear the SIP connections on route failover):

event manager applet clearconn5060forsla
 description "Clears SIP connections when the tracked routes change"
 event syslog id 622001
 action 1 cli command "clear conn port 5060"
 output console

Open in new window


The link in my previous post has some pretty good explanation of the EEM option on the ASA. I for one am happy to see it introduced.

Thanks
Tim
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
SYNERGYTECHAuthor Commented:
I found the solution myself and posted the results here. Hope it helps someone else out.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.