OPERATIONAL DEFECT DATABASE
...
...
ASA and FTD Cluster setups may drop packets for Control and Management plane flows destined any spanned ether-channel data interface Examples of features affected: - Routing Protocols (OSPF/EIGRP, affecting either peering or receiving of route updates) - SSH - ASDM (for ASA clusters) - ICMP In such state, when any packet related to the above protocols/features is received by any Slave unit on the cluster setup, instead of being redirected to the Master the packets are dropped with the following reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate For instance, this is trace of an OSPF packet being received and dropped by a Slave member, and preventing the cluster to form peering with the respective external peer: unit-1-1/master# cluster exec unit unit-1-2 show cap cap1 packet-number 3 trace 139 packets captured 3: 17:58:39.350155 802.1Q vlan#100 P0 10.0.118.254 > 10.0.118.157 ip-proto-89, length 76 Phase: 1 Type: CAPTURE Subtype: Result: ALLOW Config: Additional Information: MAC Access list ... Result: input-interface: Inside input-status: up input-line-status: up Action: drop Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate, Drop-location: frame 0x00005589cb5cca87 flow (NA)/NA
Issue has been seen with deployments having the following characteristics: - ASA running release 9.15.0.8 or FTD running 6.7.0-19 - ASA/FTD running in cluster spanned mode - ASA/FTD configured with "snmp-server" statements matching the data interface affected
Possible workaround include: - Downgrade ASA release to 9.14.x or FTD to 6.6 and older releases - Remove the snmp-server trap configuration from the ASA/FTD configuration or Configure SNMP on LINA Management interface instead
Click on a version to see all relevant bugs
Cisco Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.
