topic Re: Interface 'DataplaneInterface0' is not receiving any packets error in FMC in Network Security

Interface 'DataplaneInterface0' is not receiving any packets error in FMC

anousakisioannis — Fri, 21 Feb 2020 17:26:38 GMT

Hi all,

I have a HA pair of ASA 5525 configured as active/standby and installed FirePower on each device.

In FMC, i get the error "Interface 'DataplaneInterface0' is not receiving any packets" for the standby device which is normal as it does not receive any packets.

I created a second Health Policy, i turned off the check for "Interface Status" and i assigned the standby device on it.

Unfortunately, nothing changed and now I see the below message in the newly created policy (Health_Policy_for_HA)

What does it mean out-of-date ?

Also, when i click on the green "tick" symbol, I see the below for the standby FP.

Do you know what are these 2 exclamations marks?

Finally, if you have any other approach/ideas to resolve the issue with the initial error i get are more than welcome.

Thank you

Re: Interface 'DataplaneInterface0' is not receiving any packets error in FMC

Marvin Rhoads — Sat, 31 Aug 2019 02:34:59 GMT

After you create and assign the new Health Policy you have to apply it in FMC. Failure to do so will result in the "Out of Date" warning. Click the check box to the right of the policy to apply the policy and remedy that error:

To see what's the issue being reported by a given policy, go into System > Health > Monitor and click the small arrow next to the error status in question. That will expand the target devices in the lower section of the screen and show you the status of each monitored object.

Re: Interface 'DataplaneInterface0' is not receiving any packets error in FMC

anousakisioannis — Mon, 02 Sep 2019 07:46:49 GMT

Hello Marvin,

Thank you for your reply. I had applied the changes but maybe i got a failure and i didn't notice it.

After re-apply it everything works as expected.

Let me ask something more. I have seen the below updates in the Updates tab

I don't understand what it should be installed. Should i install all of them?

Thanks

Re: Interface 'DataplaneInterface0' is not receiving any packets error in FMC

Marvin Rhoads — Mon, 02 Sep 2019 10:46:14 GMT

You can safely delete all of the VDB updates #323 and earlier as well as the Defense Center (FMC) and sensor patches 6.2.3.13 and earlier.

Then install VDB 327 and redeploy your policies.

If you haven't been installing the patches as they become available, I'd first go into the Rule Updates tab and make sure you download and install the latest (Snort) rules. Redeploy once more.

Finally install the patches - first on FMC and then on your sensors. Redeploy once more time to sync everything.

6.2.3.14 is a good release but I'd watch on cisco.com for 6.4.0.x to get a gold star. When it does, you will then have to download the 6.4 upgrade (for both FMC and your sensors) manually to your computer and then upload them to FMC. Install them (and ...redeploy!) and then the latest patches will appear for you after you select "Download updates".

Re: Interface 'DataplaneInterface0' is not receiving any packets error in FMC

anousakisioannis — Mon, 02 Sep 2019 11:06:18 GMT

Regarding "Sourcefire 3D Defense Center S3 Patch" and "Cisco Network Sensor Patch" updates, which is the difference between them and should i install them in a specific order (1st the Sourcefire 3D ... and 2nd Cisco Network Sensor Patch) ?

1 final question: from sh service-policy sfr i see that i have 500 drops. Where can i see these 500 drops in FMC ?

ASA#sh service-policy sfr

Global policy:
Service-policy: global_policy
Class-map: FIREPOWER-Class
SFR: card status Up, mode fail-open
packet input 8044854, packet output 8044913, drop 500, reset-drop 40

Re: Interface 'DataplaneInterface0' is not receiving any packets error in FMC

Marvin Rhoads — Mon, 02 Sep 2019 11:44:52 GMT

Sourcefire 3D Defense Center is the old name for Firepower Management Center (FMC). When upgrading or patching , FMC upgrades should always be done first since it must always have a release equal to or greater than the managed sensors.

I'm not positive on how the ASA service-policy counts drops. If they are drops due to the packets not being forwarded to the sfr module then FMC would never see them. If they are drops due to a Firepower policy then you would see them in Analysis > Connection Events and then exclude Allow events by right-clicking on any Allow action. Note that FMC only stores so many events (~10,000,000 for an FMCv) so older blocks may have rolled over in the database. You can also check some of the other Event Types with Security Intelligence or Intrusion events for drops/blocks. They are the same as the ones in the Connection Events but stored in separate tables for longer retention.

Re: Interface 'DataplaneInterface0' is not receiving any packets error in FMC

anousakisioannis — Mon, 02 Sep 2019 11:56:44 GMT

Thank you very much Marvin for all the valuable information!