topic there is 2 directories with in Network Security

Upgrade readiness check complete status:Failed - SFR module

draganaxl55 — Tue, 12 Mar 2019 13:20:25 GMT

Hi all,

trying to install Cisco_Network_Sensor_Hotfix_A-6.2.0.1 with web gui.

Readiness Check status show this:

Failure Logs@ /var/log/sf/Cisco_Network_Sensor_Hotfix_A-6.2.0.1/upgrade_readiness

when I open the main_upgrade_script.log, and the error shows up:

FAILED 200_pre/006_check_snort.sh

Currently the sfr module has version 6.2.0-362.

Can anyone please figure out how to solve this problem?

Regards,

First make sure you have a

Marvin Rhoads — Wed, 22 Mar 2017 15:31:24 GMT

First make sure you have a current VDB downloaded to your FMC and then deploy the current Access Control Policy to the sensor. That will ensure that the Snort rules are current on the sensor and restart the Snort engine - a common cause of that error.

If that's all OK and it still fails, you can look at the details of the failure by going onto the sensor in cli expert mode and looking at the directory:

/var/log/sf/Cisco_Network_Sensor_Hotfix_A-6.2.0.1/200_pre

You should see a file named 006_check_snort.log which is a verbose log telling you exactly why this update attempt failed. A successful log file looks like this:

admin@firepower:/var/log/sf/Cisco_Network_Sensor_Hotfix_A-6.2.0.1/200_pre$ more 006_check_snort.sh.log
**********************************************************
[170217 12:55] Starting script: 200_pre/006_check_snort.sh
Entering 200_pre/006_check_snort.sh...
MODEL is Elektra sensor
Exiting 200_pre/006_check_snort.sh.
admin@firepower:/var/log/sf/Cisco_Network_Sensor_Hotfix_A-6.2.0.1/200_pre$

Hi Marvin,

draganaxl55 — Thu, 23 Mar 2017 09:55:50 GMT

Hi Marvin,

thanks for your answer,

Current VDB version is Build 279. To the updates tab there is available update for Sourcefire Vulnerability and Fingerprint Database Updates - Version 279. When I click install gives me the following info:

- No valid appliances available for Sourcefire Vulnerability and Fingerprint Database Updates 279

This update has either already been applied or cannot be applied to this version.

FYI - The following directory does not exist. Between "Cisco_Network_Sensor...." and "200_pre" there is one more folder "upgrade_rediness"

/var/log/sf/Cisco_Network_Sensor_Hotfix_A-6.2.0.1/200_pre

/var/log/sf/Cisco_Network_Sensor_Hotfix_A-6.2.0.1/upgrade_read
iness/200_pre$

The file 006_check_snort.log gives me the following output:

MODEL is Elektra sensor
Snort build is too old. Please apply AC Policy from DC before attempting upgradee

What is "Snort build"? The version of the software or the signatures?

Thank you,

Yes - sorry about mixing up

Marvin Rhoads — Thu, 23 Mar 2017 10:01:45 GMT

Yes - sorry about mixing up the correct folder name.

What does your sensor show when you type "show version" (from the user shell - i.e., not in expert mode)?

Snort build is the version of Snort (which is included automatically as you apply various upgrades).

Cisco Fire Linux OS v6.2.0

draganaxl55 — Thu, 23 Mar 2017 10:10:21 GMT

Cisco Fire Linux OS v6.2.0 (build 42)
Cisco ASA5516 v6.2.0 (build 362)

> show version
-------------------[ firepower2 ]-------------------
Model : ASA5516 (72) Version 6.2.0 (Build 362)
UUID : 0907cb82-0c39-11e7-ba37-a49b16e4d57a
Rules update version : 2017-03-20-001-vrt
VDB version : 279
--------------------------------------------------

Thanks for your super fast reply 🙂

Hmm that all looks in order.

Marvin Rhoads — Thu, 23 Mar 2017 10:17:15 GMT

Hmm that all looks in order.

How about insted of the readiness check you just go ahaed and try to deply the hotfix directly? It might work then since it appears you have the latest rules and VDB.

The update failed at 10%.

draganaxl55 — Thu, 23 Mar 2017 10:59:04 GMT

The update failed at 10%.

How can I check the log about this?

Thank you,

Might be the same thing - the

Marvin Rhoads — Thu, 23 Mar 2017 11:32:47 GMT

Might be the same thing - the original directory I mentioned should be the correct one. Look for the latest subdirectory there and check it's log file.

If that's so, then I would recommend opening a TAC case for more detailed analysis.

there is 2 directories with

draganaxl55 — Thu, 23 Mar 2017 12:52:34 GMT

there is 2 directories with this log.

/var/log/sf/Cisco_Network_Sensor_Hotfix_A-6.2.0.1/200_pre

/var/log/sf/Cisco_Network_Sensor_Hotfix_A-6.2.0.1/upgrade_readiness/200_pre

They both have the same file 006_check_snort.sh.log and the following output:

[170323 10:53] Starting script: 200_pre/006_check_snort.sh
Entering 200_pre/006_check_snort.sh...
MODEL is Elektra sensor
Snort build is too old. Please apply AC Policy from DC before atteing upgradee

I saw one other fellow report

Marvin Rhoads — Thu, 23 Mar 2017 15:30:41 GMT

I saw one other fellow report that same problem and he never did reply back with his final resolution.

I suspect it is a bug and recommend you open a TAC case to investigate further.

Please let us know what you find.

Do you think it would be ok

draganaxl55 — Thu, 23 Mar 2017 20:49:28 GMT

Do you think it would be ok if I reset the sfr modules and downgrade them to version 6.1.0.

Or some other suggestion?

Thank you!

Re-imaging is usually a last

Marvin Rhoads — Fri, 24 Mar 2017 02:30:25 GMT

Re-imaging is usually a last resort.

Why not just open a TAC case? If you are upgrading that implies you have service entitlement.

I just downgrade to version 6

draganaxl55 — Fri, 24 Mar 2017 13:33:52 GMT

I just downgrade to version 6.1.0. to both devices. We connected them to the firesight manager center. The readiness check was successful. Tried to install the patch, and still don't know if the installation is successful.

hey there draganax....i also

Eddie in.Mass — Mon, 27 Mar 2017 21:19:51 GMT

hey there draganax....i also attempted to do the v6.1.x upgrade to v6.2.x , last week

the Threat Defence Center did pass the Readiness Check...but the SFR/ Sourcefire part failed...2x....both on the Snort 'check'

i did open a ticket on FRI 3/24...as the Engineer feels it to be some sort of bug with the readiness check script.

no answer as of yet though , 3/27.

i too did consider to just 'go forward anyhow'...but seems like you tried it and only go to like 10% completion, then bombed out, yeah ?

I also had this problem and

Scott Pickles — Tue, 28 Mar 2017 20:01:07 GMT

I also had this problem and re-deployed my access control policy and then pushed and it worked.

Hi Edwick,

draganaxl55 — Tue, 28 Mar 2017 21:22:19 GMT

Hi Edwick,

I have successfully upgraded to 6.2.0.

Try removing ASA's from management center, then upgrade from ASDM. After that again add them to management center.

Re: I also had this problem and

nicos6688 — Tue, 17 Oct 2017 11:33:30 GMT

Yes, same here - after upgrading Firepower Management Center to 6.2.2 Access control policy needs to be redeployed before you will proceed to update Network Sensor.