topic Re: Sfr is unresponsive in Network Security

Sfr is unresponsive

lsanchez — Tue, 12 Mar 2019 13:59:38 GMT

I would like to ask why sfr is unresponsive?

FIT-ASA# show module sfr details
Getting details from the Service Module, please wait...
Unable to read details from module sfr

Card Type: Unknown
Model: N/A
Hardware version: N/A
Serial Number: JAD202200G1
Firmware version: N/A
Software version:
MAC Address Range: 0062.ec8f.92f0 to 0062.ec8f.92f0
Data Plane Status: Not Applicable
Console session: Ready
Status: Unresponsive

FIT-ASA# show module

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
1 ASA 5516-X with FirePOWER services, 8GE, AC, ASA5516 JAD202200G1
sfr Unknown N/A JAD202200G1

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
1 0062.ec8f.92f1 to 0062.ec8f.92f9 1.1 1.1.12 9.9(2)
sfr 0062.ec8f.92f0 to 0062.ec8f.92f0 N/A N/A

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
1 Up Sys Not Applicable
sfr Unresponsive Not Applicable

Thank you in advance.

Re: Sfr is unresponsive

Mohammed al Baqari — Wed, 26 Sep 2018 02:44:41 GMT

What do you see when you try to console from ASA to SFR. Also, get the
output of

sh module sfr log console

Re: Sfr is unresponsive

Marvin Rhoads — Wed, 26 Sep 2018 04:02:24 GMT

It's most likely not installed.

Has it ever worked?

Re: Sfr is unresponsive

lsanchez — Thu, 27 Sep 2018 01:26:25 GMT

thank you for your response

when i tried to access the sfr

im stuck on this, even i press ctrl+x

here is the output when checking sfr log console

Re: Sfr is unresponsive

lsanchez — Thu, 27 Sep 2018 01:27:33 GMT

Thank you for your response.

Yes sir it worked before.

Re: Sfr is unresponsive

Marvin Rhoads — Thu, 27 Sep 2018 07:50:10 GMT

It appears to have gotten severely corrupted to the extent of not starting correctly. You may need to re-install the software module.

Unless it has a lot of locally-configured (via ASDM) settings, I'd just go ahead and re-image it and re-register to FMC and redeploy the policies.

Re: Sfr is unresponsive

lsanchez — Fri, 28 Sep 2018 00:50:11 GMT

i'll try to reinstall, thank you sir

Re: Sfr is unresponsive

Florin Barhala — Fri, 30 Aug 2019 05:32:33 GMT

When you say reinstall you mean recover?

sw-module module sfr recover configure image disk0:/asasfr-5500x-boot-6.3.0-1.img
sw-module module sfr recover boot

Re: Sfr is unresponsive

Marvin Rhoads — Fri, 30 Aug 2019 06:04:36 GMT

Yes, that's correct. Recover and boot.

You might also precede those with an uninstall for the most complete treatment.

Re: Sfr is unresponsive

Florin Barhala — Fri, 30 Aug 2019 07:56:09 GMT

Thank you Marvin!
I do have one more question/concern when it comes to SFR;
As we speak I have the SFR configured as fail-open and still I am worried about production traffic impact.
At what moment the ASA will consider the sensor "ready" to forward traffic? When does "fail-open" is triggered?

This combination of policy-map config along with pushing policies from FMC is confusing to me in regard to any traffic disruption/block.

Thanks!

Re: Sfr is unresponsive

Marvin Rhoads — Fri, 30 Aug 2019 11:59:46 GMT

"fail-open" means if the sfr module fails (i.e. status is "down/down" or even "up/down") the ASA will ignore the service-policy that would otherwise redirect the traffic to it for inspection.

Once the module status is "up/up" traffic redirection will resume.

Re: Sfr is unresponsive

Florin Barhala — Fri, 30 Aug 2019 16:47:13 GMT

That makes sense ; how can anyone determine SFR status?
I reviewed this command, but the output returns a different status than up/down

show module sfr details
Getting details from the Service Module, please wait...
Unable to read details from module sfr

Card Type: Unknown
Model: N/A
Hardware version: N/A
Serial Number: FCH66620UU
Firmware version: N/A
Software version:
MAC Address Range: 0062.1111.9d84 to 0062.1111.9d84
Data Plane Status: Not Applicable
Console session: Ready
Status: Unresponsive

Re: Sfr is unresponsive

Marvin Rhoads — Sat, 31 Aug 2019 02:22:41 GMT

It could be that the sfr module is not installed and that there is either no installed module or one of the legacy types (cxsc or ips).

"show module" will return the overall status of all module types.

Re: Sfr is unresponsive

kvnrndlph — Wed, 21 Oct 2020 21:00:35 GMT

Had a similar issue that was resolved with just a reset.

sw-module module sfr shutdown

sw-module module sfr reset