Loading...
Loading...
- Policy based VPNs suddenly stop passing traffic (inbound or outbound direction) - The IPsec sessions remain up - TX or RX Packet count will not be increasing when looking at show flow-offload-ipsec statistics
- HW has flow-offload-ipsec feature and its enabled (this is enabled by default) - Check status with show flow-offload ipsec info - See docs https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config-76/vpn-overview.html?bookSearch=true
- Disable the following via flexconfig policy or in CLI if ASA no flow-offload-ipsec no flow-offload-ipsec egress-optimization - Doc for Commands: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config-76/vpn-overview.html?bookSearch=true - If Deployments are not possible due to the tunnels being down then see Attachment.
- From FTD we see that the flow-offload-ipsec statistics do not show any crease in the number of packets being transmitted ftd-primary# show flow-offload-ipsec statistics Packet stats of Pipe 0 ---------------------- Rx Packet count : 820049760 <<< We see we're getting packets Tx Packet count : 734092019 >>> not increasing Error Packet count : 448 Drop Packet count : 213 NOTE: The CAM counters displayed are cumulative counters for all offload applications and indicates the total packets offloaded CAM stats of Pipe 0 ---------------------- Option ID Table CAM Hit Count : 3331256439 Option ID Table CAM Miss Count : 0 Tunnel Table CAM Hit Count : 0 Tunnel Table CAM Miss Count : 42 6-Tuple CAM Hit Count : 1582897749 6-Tuple CAM Miss Count : 1748358648 NOTE: The counters displayed are cumulative counters for all offload applications and indicates the total packets offloaded ftd-primary# show flow-offload-ipsec statistics Packet stats of Pipe 0 ---------------------- Rx Packet count : 820050264 <<< increasing Tx Packet count : 734092019 >>> not increasing Error Packet count : 448 Drop Packet count : 213 NOTE: The CAM counters displayed are cumulative counters for all offload applications and indicates the total packets offloaded CAM stats of Pipe 0 ---------------------- Option ID Table CAM Hit Count : 3331281575 Option ID Table CAM Miss Count : 0 Tunnel Table CAM Hit Count : 0 Tunnel Table CAM Miss Count : 42 6-Tuple CAM Hit Count : 1582900128 6-Tuple CAM Miss Count : 1748381405 NOTE: The counters displayed are cumulative counters for all offload applications and indicates the total packets offloaded
Click on a version to see all relevant bugs
Cisco Integration
Learn more about where this data comes from
BugZero Plan
Streamline upgrades with automated vendor bug scrubs
BugZero Prevent
Wish you caught this bug sooner? Get proactive today.