Secure Firewall FTD Memory Block Exhaustion Causing Traffic Drops

Issue

Intermittent traffic loss and routing disruption occurs on a Secure Firewall 2110 FTD using Enhanced Interior Gateway Routing Protocol (EIGRP). This leads to djacency drops and loss of internet connectivity. Symptoms correlated with memory block exhaustion (block size 80 and 9472), resulting in datapath packet drops and control-plane impact. Additionally, no crash or core file is generated for the issue as no reboot is triggered.

Memory block depletion causes the FTD unit to stop processing traffic.

firepower# show blocks
SIZE    MAX    LOW    CNT  FAILED
     0   2700   2650   2700      0
     4    200    199    200      0
    80  24000      0      0 2200668
   256   6072   3011   3178      0
  1550   7386   4013   4719      0
  2048    600    572    600      0
  2560    900    889    900      0
  4096    100    100    100      0
  8192    100     97    100      0
  9472  10000      0   2668      1
 16384    100    100    100      0
 65664     16     16     16      0

ASP drops on the FTD showed large counts for "Dispatch queue tail drops (dispatch-queue-limit)" drops:

firepower# show asp drop
Frame drop:
  First TCP packet not SYN (tcp-not-syn)                                12357166
  Packet is blacklisted by snort (snort-blacklist)                       1159498
  Fragment reassembly failed (fragment-reassembly-failed)                  53865
  Dispatch queue tail drops (dispatch-queue-limit)                       1582611

There are also a lot of fragment re-assembly timeouts:

firepower# show fragment
Interface: outside
    Configuration: Size: 200, Chain: 24, Timeout: 5, Reassembly: virtual
    Run-time stats: Queue: 0, Full assembly: 1916508
    Drops: Size overflow: 0, Timeout: 6217,
           Chain overflow: 0, Fragment queue threshold exceeded: 47611,
           Small fragments: 0, Invalid IP len: 0,
           Reassembly overlap: 0, Fraghead alloc failed: 0,
           SGT mismatch: 0, Block alloc failed: 0,
           Invalid IPV6 header: 0, Passenger flow assembly failed: 0
           Cluster reinsert collision: 0

The assigned blocks all show the same allocation indicate impact from defect Cisco bug ID CSCws19823. (run terminal pager 20 command before executing to limit output)

firepower# show blocks assigned 
Class size 2, size 80
             Block           allocd_by            freed_by  data size    alloccnt     dup_cnt  oper location  
0xa800000100058c80  0x000000aaad8556ac  0x000000aaad2cefb8        183       17310           0 alloc cvmx_api_pdts_send_to_host
0xa800000100059400  0x000000aaad8556ac  0x000000aaad2cefb8        183        3748           0 alloc cvmx_api_pdts_send_to_host
0xa800000100059b80  0x000000aaad8556ac  0x000000aaad2cefb8        182       74639           0 alloc cvmx_api_pdts_send_to_host
0xa80000010005a300  0x000000aaad8556ac  0x000000aaad7cf0e8        183       23610           0 alloc cvmx_api_pdts_send_to_host
0xa80000010005aa80  0x000000aaad8556ac  0x000000aaad2cefb8        183       40731           0 alloc cvmx_api_pdts_send_to_host

A review of the connections on the FTD confirms that most of the incoming connections are SMB (TCP/445) traffic on the FTD interface. (run terminal pager 20 before executing to limit output)

firepower# show conn detail
TCP outside: 10.X.X.49/55970 inside: 10.X.X.73/445,
    flags UIO N1, idle 1m13s, uptime 1h52m, timeout 1h0m, bytes 163283, xlate id 0xffe0384b00, flow id 22065316, rule id 268441603, Rx-RingNum invalid, Internal-Data invalid
  Initiator: 10.X.X.49, Responder: 10.X.X.73
  Connection lookup keyid: 3616633230
TCP outside: 10.X.X.72/57775 inside: 10.X.X.214/445,
    flags UIO N1, idle 5s, uptime 2h6m, timeout 1h0m, bytes 182005, xlate id 0xffe0384b00, flow id 22025418, rule id 268441603, Rx-RingNum invalid, Internal-Data invalid
  Initiator: 10.X.X.72, Responder: 10.X.X.214
  Connection lookup keyid: 3661674758
TCP outside: 10.X.X.131/54313 inside: 10.X.X.71/445,
    flags UIO N1, idle 29s, uptime 9m35s, timeout 1h0m, bytes 26205, xlate id 0xffe0384b00, flow id 22429664, rule id 268441603, Rx-RingNum invalid, Internal-Data invalid
  Initiator: 10.X.X.131, Responder: 10.X.X.71
  Connection lookup keyid: 1202806582

Environment

• Cisco Secure Firewall FPR2110-NGFW-K9 Firewall Threat Defense (FTD) version 7.4.3 (first seen)

• SMB (TCP/445) traffic being inspected by the firewall

Resolution

Immediate Workaround

1. Configure a prefilter policy to bypass inspection for SMB traffic on all relevant interfaces, particularly the FTD interface where SMB traffic is entering the firewall.

   access-list CSM_FW_ACL_ line 4 remark rule-id 268459032: PREFILTER POLICY: FTD Prefilter Policy
   access-list CSM_FW_ACL_ line 5 remark rule-id 268459032: RULE: SMB-FastPath
   access-list CSM_FW_ACL_ line 6 advanced trust tcp ifc outside any any eq 445 rule-id 268459032 event-log flow-end

2. Clear existing SMB connections and reset block counters

   clear conn port 445 all
   clear blocks

3. Execute this command to monitor for failed block increments:

   show blocks

Permanent Fix

1. Upgrade to Cisco Secure Firewall Threat Defense version 7.0.9, 7.2.11, 7.4.4, or 7.6.0.

2. After upgrading to the fixed release, monitor memory block utilization to confirm stabilization and verify no further memory block exhaustion occurs.

3. Once upgraded to the fixed version, SMB traffic can be safely removed from prefilter if desired, as the underlying defect has been resolved.

Troubleshooting Commands Used

These diagnostic commands were used to analyze the memory block allocation patterns:

show blocks | redirect disk0:/show.blocks.txt
show blocks pool 80 dump | redirect disk0:/show.block.pool.80.dump.txt
show blocks queue history detail | redirect disk0:/show.blocks.Q.history.detail.txt
show blocks queue history core-local | redirect disk0:/show.blocks.Q.hist.core-local.txt
show blocks old core-local | redirect disk0:/show.blocks.old.core-local.txt
show blocks exhaustion snapshot | redirect disk0:/show.blocks.exhaustion.shapshot.txt
show blocks exhaustion history | redirect disk0:/show.blocks.exhaustion.history.txt
show blocks assigned | redirect disk0:/show.blocks.assigned.txt

Cause

The issue is caused by a known software defect Cisco bug ID CSCws19823 in Cisco Secure Firewall Threat Defense, where high volumes of inspected SMB (TCP/445) traffic could lead to memory block size 80 exhaustion, resulting in datapath packet drops and secondary effects such as EIGRP instability and traffic loss. The defect occurs when SMB traffic undergoes full inspection.

Related Content

• Cisco bug ID CSCws19823 - 80, 1550 and 9472 block depletion seen on ASA/FTD 2100 when SMB multichannel traffic is sent

• Cisco Technical Support & Downloads

Revision History

Revision	Publish Date	Comments
1.0	22-Oct-2026	Initial Release