topic Re: Hi Anouar, in Network Security

[FMC] Unable to save a backup or to upgrade

Anouar ABDALLAH — Fri, 21 Feb 2020 14:13:23 GMT

Hi,

I am unable to take a backup from a virtual FMC which is managing two Firepower 4110 (HA).

The received error is : Registration or CSM state are blocking Backup

I have a doubt about the actual version (6.2.0) so I have tried to upgrade it to 6.2.1/6.2.0.1/6.2.0.2 but I am getting a somewhat similar error : Peer registration in progress. Please retry in a few moments. However, in the menu of managed devices, both FTD are registered with a green status (see attachment).

Any suggestion ?

Hi Anouar,

Dinesh Verma — Wed, 16 Aug 2017 05:05:45 GMT

Hi Anouar,

Login to the CLI of both FTD and run the command show managers. There shouldn't be any manager status as Pending. If yes then fix that up.

Let me know how it goes.

Regards,
Dv

I already have registration

Anouar ABDALLAH — Wed, 16 Aug 2017 07:34:01 GMT

I already have registration completed in both.

Hello Anouar

Jetsy Mathew — Thu, 17 Aug 2017 07:27:47 GMT

Hello Anouar

If the registrations looks fine with FTD then please check the messages log to see why the Backup is failing .Are you copying this to remote storage or locally in FMC ?

If its remote then please check everything is fine from the remote storage as well.

Regards

Jetsy

with tail -f /var/log

Anouar ABDALLAH — Thu, 17 Aug 2017 11:45:36 GMT

with tail -f /var/log/messages I found these messages :

Aug 17 12:20:09 firepower SF-IMS[8831]: [8893] sftunneld:sf_connections [INFO] Start connection to : a.b.c.241 (wait 44 seconds is up)
Aug 17 12:20:09 firepower SF-IMS[8831]: [22370] sftunneld:sf_peers [INFO] Peer a.b.c.241 needs a single connection
Aug 17 12:20:09 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [INFO] Connect to a.b.c.241 on port 8305 - eth0
Aug 17 12:20:09 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [INFO] Initiate IPv4 connection to a.b.c.241 (via eth0)
Aug 17 12:20:09 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [INFO] Initiating IPv4 connection to *.241:8305/tcp
Aug 17 12:20:09 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [INFO] Wait to connect to 8305 (IPv6): a.b.c.241
Aug 17 12:20:29 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [ERROR] Unable to connect to port 8305 (IPv4): Operation now in progress
Aug 17 12:20:29 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [INFO] No IPv4 connection to a.b.c.241
Aug 17 12:20:29 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [WARN] Unable to connect to peer 'a.b.c.241'
Aug 17 12:20:29 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [INFO] reconnect to peer 'a.b.c.241' in 44 seconds
Aug 17 12:20:31 firepower SF-IMS[8831]: [8893] sftunneld:sf_peers [INFO] Peer a.b.c.241 needs a single connection

This should be the root cause. We have inserted a wrong device address before (.241) which is the Firepower Chassis Manager and not the FTD one

How can we unregister this wrong address as we do not see anything about it from GUI ?

Hi Anouar,

Dinesh Verma — Thu, 17 Aug 2017 14:23:59 GMT

Hi Anouar,

Please go to the CLI of the device, become root and run this command:

Command: mysql -padmin sfsnort -e "select name,ip,uuid,role from EM_peers where role !=0"

This would list out all the peers, find the UUID and IP of the Chassis Mgr which you added wrongly. and then run this command:

remove_peer.pl <IP>

remove_peer.pl <~IP>

remove_peer.pl <uuid>

remove_peer.pl <~uuid>

This should fix the issue. Let me know how it goes.

Regards,

Hi,

Anouar ABDALLAH — Thu, 17 Aug 2017 14:27:42 GMT

Hi,

Is there any risk or we can execute it during work hours.

No risk as long as you're

Dinesh Verma — Thu, 17 Aug 2017 14:32:14 GMT

No risk as long as you're deleting the entry which we don't need and lying there for no good.

Re: Hi Anouar,

cisco.adm000@gmail.com — Sun, 11 Aug 2019 08:57:10 GMT

How can i find the Right one ?

i have used the Same command,i find out that there are multiple lines out there,but I have used just one Manager.How can I find that which Entry is working and which one is not needed?

Re: Hi Anouar,

Marvin Rhoads — Sun, 11 Aug 2019 12:16:29 GMT

Any peers that have an address other than your Firepower Management Center may be removed.

Re: Hi Anouar,

kvajarka — Thu, 16 Jul 2020 20:48:25 GMT

Refrain from using any database commands. They may cause irreversible problems with the database. Contact TAC for this issue as the backup heavily depends on Database and needs to be handled by TAC only.