topic Hi Jetsy, in Network Security

Deploy Policy failure on Virtual Firesight Defence Center 6.1

gilangintan20 — Tue, 26 Mar 2019 01:17:01 GMT

Hi,

Pujita Patni — Thu, 20 Jul 2017 12:46:55 GMT

Hi,

Can you provide a screenshot of the License page here. I am curios to see what the Licenses come up as. Does the deploy fail instantly or runs for a while ? What the error message that it fails with ?

Thanks,

Pujita Patni

Hello gilangintan20 ,

Jetsy Mathew — Thu, 20 Jul 2017 13:11:14 GMT

Hello gilangintan20 ,

First of all verify the connectivity between the FMC and the NGIPS that you have . If the connectivity is fine then please verify if you have a minimum of Protection and Control license to manage the NGIPS . Each NGIPS needs each protection and control license to manage the access control policies. Check the System > Licenses page is the FMC gui to confirm that if you have enough license or not. If you are planning to use the URL category based rules then you should get the URL license as well.

If the devices got license then check the error that you are getting while the policy apply fails.

You can check the following logs in the NGIPS via ssh to verify the error.

admin@123#pmtool status |grep -i down

Above command will let you know if any services are down.

admin@123# cd /var/log/

admin@123# tail -200f action_queue.log

After applying the policies check this logs to verify the deployment errors.

This will give you an idea about the error messages.

You can also check the /var/log/messages to verify the communication issues.

Let me know if you have any questions.

Rate if this answer helps.

Regards

Jetsy

Hi Jetsy,

gilangintan20 — Sat, 22 Jul 2017 13:36:00 GMT

Hi Jetsy,

Thanks for the reply. I have checked the FMC and NGIPS connections and they both connected.

No result shown from grep-i down.

the results of "tail -200f action_queue.log" :

Jul 22 13:24:01 firepower ActionQueueScrape.pl[7896]: Remote heartbeat task processing failed on 192.168.43.130: Appliance is set to ignore, ignore heartbeat from 219f83ea-21f8-11e7-862b-ab2c744b6f3c at /usr/local/sf/lib/perl/5.10.1/SF/Synchronize/VerticalSync.pm line 446.
Jul 22 13:24:01 firepower ActionQueueScrape.pl[7896]: END TASK || 060ff854-6ee1-11e7-a63e-547fb0f5facf || Synchronize with UM || Sending Update || 1
Jul 22 13:25:00 firepower ActionQueueScrape.pl[7976]: START TASK || 29f42358-6ee1-11e7-a63e-547fb0f5facf || Synchronize with UM || Sending Update || 0
Jul 22 13:25:01 firepower ActionQueueScrape.pl[7976]: DBD::mysql::st execute failed: Table 'sfsnort.rna_vdb_version' doesn't exist at /usr/local/sf/lib/perl/5.10.1/SF/RNA/Vulnerabilities.pm line 1068.

do you know the meaning of these logs ?

also, attached capture whn deploy policy, the progress stuck at 15%.

Please help me 😞

Hi Pujita,

gilangintan20 — Sat, 22 Jul 2017 13:44:13 GMT

Hi Pujita,

Thanks for reply,

attached screenshoot of the licenses page.

I have checked the the log while apply the policy "tail -200f action_queue.log" :

do you know the meaning of these logs ?

also, attached screenshoot from gui when apply the policy, the progress stack at 15%.

do you know what happened? please help :((

Hello gilangintan20,

Jetsy Mathew — Mon, 24 Jul 2017 08:15:34 GMT

Hello gilangintan20,

The logs looks like there is an heartbeat error which will occur due to the communication channel issues.

root@224:~# manage_procs.pl

**************** Configuration Utility **************

1 Reconfigure Correlator

2 Reconfigure and flush Correlator

3 Restart Comm. channel

4 Update routes

5 Reset all routes

6 Validate Network 0

Exit *************************************************************

Enter choice:

In above enter choice option , please enter starting from 6 , 5 , 4 , 3 , 2 and to exit from this mode, enter 0

Also check if the snort process is running or not.

root@224:~# pmtool status | grep snort

You can also check if there is any database errors.

root@224:~# DBCheck.pl

After that if possible try to re-register the sensor to the FMC and see if the issue gets resolved.

Regards

Jetsy

Hi,

gilangintan20 — Tue, 01 Aug 2017 03:23:03 GMT

Hi,

Thanks Jetsy, below the result :

root@firepower:/Volume/home/admin# manage_procs.pl

**************** Configuration Utility **************