Configure Scheduled Commands on ASA in Multi-Context Mode

• Issue
• Environment
• Resolution
• Cause
• Related Content

Issue

A user needs to automate or schedule the command vpn-sessiondb logoff all to run once per week on a Cisco Secure Firewall (CSF) 1240 that runs the Cisco Adaptive Security Appliance (ASA) software. The requirement is to have this Virtual Private Network (VPN) session cleanup command execute automatically on a weekly basis without manual intervention.

Environment

• Cisco Secure Firewall CSF-1240. Other platforms can be also affected.

• Cisco Adaptive Security Appliance (ASA) multi-context mode configuration.

Resolution

The Embedded Event Manager (EEM) is not supported in multi-context mode. This limitation prevents the scheduling or automation of commands using EEM scripting capabilities.

Alternative approaches for VPN session management would need to be considered, such as:

• Manual execution of the command on a weekly basis.

• External automation tools that can connect to the device and execute commands via SSH or HTTP.

Cause

• The Embedded Event Manager (EEM) feature is not supported when the Cisco Secure Firewall is operating in multi-context mode. EEM is the primary mechanism for scheduling and automating command execution on ASA platforms, but this functionality is disabled in multi-context configurations, preventing the automation of any command.

• Related enhancement request: Cisco bug ID CSCwn84756 (ENH: ASA multiple context mode EEM support).

Related Content

• https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/A-H/asa-command-ref-A-H/e-commands.html#wp1747430020

• https://www.cisco.com/c/en/us/td/docs/security/asa/misc/http-interface/asa-http-interface.html

• Cisco Technical Support & Downloads

• https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn84756