topic ASA5506X Help - ASA FirePOWER Module offline in Network Security

ASA5506X Help - ASA FirePOWER Module offline

Yuan Li — Wed, 17 Apr 2019 13:52:53 GMT

The device is FTD mode, registered successfully to FMC, and sent the configuration correctly. After one day or so, the device automatically offline, synchronization button can not restore the online. Check the connectivity and port between FTD and FMC, then delete the device on FMC, re-register, and register successfully, but after one day or so, the FTD device offline again. After the device was offline, FMC to FTD communications were checked, because the on-site client computer can manage FMC and take the MPLS dedicated line. error log as follow ATTACH What can I CHECK IT?

Re: ASA5506X Help - ASA FirePOWER Module offline

Yuan Li — Wed, 17 Apr 2019 13:54:12 GMT

Mar 19 09:10:03 ap-wuhan-fw1 ActionQueueScrape.pl[10097]:
Mar 19 09:10:03 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: enterOffBoxManager - Set device to be managed by DC
Mar 19 09:10:03 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: deleting all tasks
Mar 19 09:10:04 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: cleanupIS
Mar 19 09:10:04 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: deleting eotypes:
Mar 19 09:10:05 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: skipping Discovered Identities
Mar 19 09:10:05 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: skipping Special Identities
Mar 19 09:10:06 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: Deleting licenses
Mar 19 09:10:06 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: Deleting state.yml
Mar 19 09:10:06 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: telling pm to go to offbox mode
Mar 19 09:10:06 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: switching to arc settings
Mar 19 09:10:07 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: delete ADI_conf
Mar 19 09:10:07 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: clean user identity data
Mar 19 09:10:08 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: deleting all alertConfig objects
Mar 19 09:10:08 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: removing events
Mar 19 09:10:08 ap-wuhan-fw1 ActionQueueScrape.pl[10097]: Done enterOffBoxManager
Mar 21 12:15:09 ciscoasa ActionQueueScrape.pl[6172]:
Mar 21 12:15:09 ciscoasa ActionQueueScrape.pl[6172]: enterOffBoxManager - Set device to be managed by DC
Mar 21 12:15:09 ciscoasa ActionQueueScrape.pl[6172]: deleting all tasks
Mar 21 12:15:10 ciscoasa ActionQueueScrape.pl[6172]: cleanupIS
Mar 21 12:15:11 ciscoasa ActionQueueScrape.pl[6172]: deleting eotypes:
Mar 21 12:15:11 ciscoasa ActionQueueScrape.pl[6172]: skipping Discovered Identities
Mar 21 12:15:11 ciscoasa ActionQueueScrape.pl[6172]: skipping Special Identities
Mar 21 12:15:12 ciscoasa ActionQueueScrape.pl[6172]: Deleting licenses
Mar 21 12:15:13 ciscoasa ActionQueueScrape.pl[6172]: Deleting state.yml
Mar 21 12:15:13 ciscoasa ActionQueueScrape.pl[6172]: telling pm to go to offbox mode
Mar 21 12:15:13 ciscoasa ActionQueueScrape.pl[6172]: switching to arc settings
Mar 21 12:15:13 ciscoasa ActionQueueScrape.pl[6172]: delete ADI_conf
Mar 21 12:15:14 ciscoasa ActionQueueScrape.pl[6172]: clean user identity data
Mar 21 12:15:16 ciscoasa ActionQueueScrape.pl[6172]: deleting /ngfw/var/sf/user_enforcement/user_ip_map.1552991609
Mar 21 12:15:16 ciscoasa ActionQueueScrape.pl[6172]: deleting /ngfw/var/sf/user_enforcement/user_ip_map.1552986705
Mar 21 12:15:16 ciscoasa ActionQueueScrape.pl[6172]: deleting all alertConfig objects
Mar 21 12:15:16 ciscoasa ActionQueueScrape.pl[6172]: removing events
Mar 21 12:15:17 ciscoasa ActionQueueScrape.pl[6172]: Done enterOffBoxManager

SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (2dd7925a-2987-11e8-8dc8-2b1d7c9e1909), error: Not connected

Apr 10 19:02:59 ap-wuhan-fw1 SF-IMS[6504]: [6513] sftunneld:sf_peers [INFO] Peer 161.242.190.152 needs the first connection

Apr 10 19:02:59 ap-wuhan-fw1 SF-IMS[6504]: [6513] sftunneld:sf_connections [INFO] Start connection to : 161.242.190.152 (wait 300 seconds is up)

Apr 10 19:02:59 ap-wuhan-fw1 SF-IMS[6504]: [8966] sftunneld:sf_peers [INFO] Peer 161.242.190.152 needs the first connection

Apr 10 19:02:59 ap-wuhan-fw1 SF-IMS[6504]: [8966] sftunneld:sf_ssl [INFO] Connect to 161.242.190.152 on port 8305 - br1

Apr 10 19:02:59 ap-wuhan-fw1 SF-IMS[6504]: [8966] sftunneld:sf_ssl [INFO] Initiate IPv4 connection to 161.242.190.152 (via br1)

Apr 10 19:02:59 ap-wuhan-fw1 SF-IMS[6504]: [8966] sftunneld:sf_ssl [INFO] Initiating IPv4 connection to 161.242.190.152:8305/tcp

Apr 10 19:02:59 ap-wuhan-fw1 SF-IMS[6504]: [8966] sftunneld:sf_ssl [INFO] Wait to connect to 8305 (IPv6): 161.242.190.152

Apr 10 19:03:11 ap-wuhan-fw1 SF-IMS[5575]: [5767] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (2dd7925a-2987-11e8-8dc8-2b1d7c9e1909), error: Not connected
Apr 10 19:03:19 ap-wuhan-fw1 SF-IMS[6504]: [8966] sftunneld:sf_ssl [ERROR] Unable to connect to port 8305 (IPv4): Operation now in progress
Apr 10 19:03:19 ap-wuhan-fw1 SF-IMS[6504]: [8966] sftunneld:sf_ssl [INFO] No IPv4 connection to 161.242.190.152
Apr 10 19:03:19 ap-wuhan-fw1 SF-IMS[6504]: [8966] sftunneld:sf_ssl [WARN] Unable to connect to peer '161.242.190.152'
Apr 10 19:03:19 ap-wuhan-fw1 SF-IMS[6504]: [8966] sftunneld:sf_ssl [INFO] reconnect to peer '161.242.190.152' in 300 seconds
Apr 10 19:03:19 ap-wuhan-fw1 SF-IMS[6507]: [6516] sfmbservice:sfmb_service [INFO] Start getting MB messages for 161.242.190.152
Apr 10 19:03:21 ap-wuhan-fw1 SF-IMS[6504]: [6513] sftunneld:sf_peers [INFO] Peer 161.242.190.152 needs the first connection
Apr 10 19:03:25 ap-wuhan-fw1 SF-IMS[5400]: [5400] IDSEventProcessor:TunnelHandler [WARN] Failed to connect to manager(tunnel): Not connected

Apr 13 14:00:26 ap-wuhan-fw1 SF-IMS[5400]: [5400] IDSEventProcessor:TunnelHandler [WARN] Failed to connect to manager(tunnel): Not connected

Apr 13 14:00:33 ap-wuhan-fw1 SF-IMS[5575]: [5767] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (2dd7925a-2987-11e8-8dc8-2b1d7c9e1909), error: Not connected
Apr 13 14:00:34 ap-wuhan-fw1 SF-IMS[5575]: [5776] SFDataCorrelator:EventStreamHandler [ERROR] Unable to establish estreamer connection to 161.242.190.152: Not connected
Apr 13 14:00:35 ap-wuhan-fw1 SF-IMS[6504]: [6513] sftunneld:sf_peers [INFO] Peer 161.242.190.152 needs the first connection
Apr 13 14:07:50 ciscoasa syslog-ng[2414]: syslog-ng starting up; version='3.6.2'
Apr 13 14:07:50 ciscoasa kernel: [ 0.368533] pci 0000:00:14.0: System wakeup disabled by ACPI
Apr 13 14:07:50 ciscoasa kernel: [ 0.368991] pci 0000:00:16.0: System wakeup disabled by ACPI
Apr 13 14:07:50 ciscoasa kernel: [ 0.370368] pci 0000:00:01.0: PCI bridge to [bus 01]
Apr 13 14:07:50 ciscoasa kernel: [ 0.370769] pci 0000:02:00.0: System wakeup disabled by ACPI
Apr 13 14:07:50 ciscoasa kernel: [ 0.370898] pci 0000:00:02.0: PCI bridge to [bus 02]

Apr 13 14:07:50 ciscoasa kernel: [ 0.371075] pci 0000:00:03.0: PCI bridge to [bus 03]

Apr 13 14:07:50 ciscoasa kernel: [ 0.371244] pci 0000:00:04.0: PCI bridge to [bus 04]

Re: ASA5506X Help - ASA FirePOWER Module offline

Yuan Li — Thu, 18 Apr 2019 02:14:44 GMT

It seems to be recover in Apr 13

Apr 13 13:57:33 ap-wuhan-fw1 SF-IMS[5575]: [5767] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (2dd7925a-2987-11e8-8dc8-2b1d7c9e1909), error: Not connected
Apr 13 13:57:34 ap-wuhan-fw1 SF-IMS[5575]: [5776] SFDataCorrelator:EventStreamHandler [ERROR] Unable to establish estreamer connection to 161.242.190.152: Not connected
Apr 13 13:57:39 ap-wuhan-fw1 SF-IMS[6504]: [6513] sftunneld:sf_peers [INFO] Peer 161.242.190.152 needs the first connection
Apr 13 13:57:53 ap-wuhan-fw1 SF-IMS[5575]: [5767] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (2dd7925a-2987-11e8-8dc8-2b1d7c9e1909), error: Not connected
Apr 13 13:58:01 ap-wuhan-fw1 SF-IMS[6504]: [6513] sftunneld:sf_peers [INFO] Peer 161.242.190.152 needs the first connection
Apr 13 13:58:01 ap-wuhan-fw1 SF-IMS[6504]: [6513] sftunneld:sf_connections [INFO] Start connection to : 161.242.190.152 (wait 300 seconds is up)
Apr 13 13:58:01 ap-wuhan-fw1 SF-IMS[6504]: [15472] sftunneld:sf_peers [INFO] Peer 161.242.190.152 needs the first connection
Apr 13 13:58:01 ap-wuhan-fw1 SF-IMS[6504]: [15472] sftunneld:sf_ssl [INFO] Connect to 161.242.190.152 on port 8305 - br1
Apr 13 13:58:01 ap-wuhan-fw1 SF-IMS[6504]: [15472] sftunneld:sf_ssl [INFO] Initiate IPv4 connection to 161.242.190.152 (via br1)
Apr 13 13:58:01 ap-wuhan-fw1 SF-IMS[6504]: [15472] sftunneld:sf_ssl [INFO] Initiating IPv4 connection to 161.242.190.152:8305/tcp
Apr 13 13:58:01 ap-wuhan-fw1 SF-IMS[6504]: [15472] sftunneld:sf_ssl [INFO] Wait to connect to 8305 (IPv6): 161.242.190.152
Apr 13 13:58:13 ap-wuhan-fw1 SF-IMS[5575]: [5767] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (2dd7925a-2987-11e8-8dc8-2b1d7c9e1909), error: Not connected
Apr 13 13:58:20 ap-wuhan-fw1 SF-IMS[6507]: [6516] sfmbservice:sfmb_service [INFO] Start getting MB messages for 161.242.190.152
Apr 13 13:58:21 ap-wuhan-fw1 SF-IMS[6504]: [15472] sftunneld:sf_ssl [ERROR] Unable to connect to port 8305 (IPv4): Operation now in progress
Apr 13 13:58:21 ap-wuhan-fw1 SF-IMS[6504]: [15472] sftunneld:sf_ssl [INFO] No IPv4 connection to 161.242.190.152
Apr 13 13:58:21 ap-wuhan-fw1 SF-IMS[6504]: [15472] sftunneld:sf_ssl [WARN] Unable to connect to peer '161.242.190.152'
Apr 13 13:58:21 ap-wuhan-fw1 SF-IMS[6504]: [15472] sftunneld:sf_ssl [INFO] reconnect to peer '161.242.190.152' in 300 seconds
Apr 13 13:58:23 ap-wuhan-fw1 SF-IMS[6504]: [6513] sftunneld:sf_peers [INFO] Peer 161.242.190.152 needs the first connection
Apr 13 13:58:26 ap-wuhan-fw1 SF-IMS[5400]: [5400] IDSEventProcessor:TunnelHandler [WARN] Failed to connect to manager(tunnel): Not connected
Apr 13 13:58:33 ap-wuhan-fw1 SF-IMS[5575]: [5767] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (2dd7925a-2987-11e8-8dc8-2b1d7c9e1909), error: Not connected
Apr 13 13:58:34 ap-wuhan-fw1 SF-IMS[5575]: [5776] SFDataCorrelator:EventStreamHandler [ERROR] Unable to establish estreamer connection to 161.242.190.152: Not connected
Apr 13 13:58:45 ap-wuhan-fw1 SF-IMS[6504]: [6513] sftunneld:sf_peers [INFO] Peer 161.242.190.152 needs the first connection
Apr 13 13:58:53 ap-wuhan-fw1 SF-IMS[5575]: [5767] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (2dd7925a-2987-11e8-8dc8-2b1d7c9e1909), error: Not connected
Apr 13 13:59:07 ap-wuhan-fw1 SF-IMS[6504]: [6513] sftunneld:sf_peers [INFO] Peer 161.242.190.152 needs the first connection
Apr 13 13:59:13 ap-wuhan-fw1 SF-IMS[5575]: [5767] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (2dd7925a-2987-11e8-8dc8-2b1d7c9e1909), error: Not connected
Apr 13 13:59:20 ap-wuhan-fw1 SF-IMS[6507]: [6516] sfmbservice:sfmb_service [INFO] Start getting MB messages for 161.242.190.152
Apr 13 13:59:26 ap-wuhan-fw1 SF-IMS[5400]: [5400] IDSEventProcessor:TunnelHandler [WARN] Failed to connect to manager(tunnel): Not connected
Apr 13 13:59:29 ap-wuhan-fw1 SF-IMS[6504]: [6513] sftunneld:sf_peers [INFO] Peer 161.242.190.152 needs the first connection
Apr 13 13:59:33 ap-wuhan-fw1 SF-IMS[5575]: [5767] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (2dd7925a-2987-11e8-8dc8-2b1d7c9e1909), error: Not connected
Apr 13 13:59:34 ap-wuhan-fw1 SF-IMS[5575]: [5776] SFDataCorrelator:EventStreamHandler [ERROR] Unable to establish estreamer connection to 161.242.190.152: Not connected
Apr 13 13:59:51 ap-wuhan-fw1 SF-IMS[6504]: [6513] sftunneld:sf_peers [INFO] Peer 161.242.190.152 needs the first connection
Apr 13 13:59:53 ap-wuhan-fw1 SF-IMS[5575]: [5767] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (2dd7925a-2987-11e8-8dc8-2b1d7c9e1909), error: Not connected
Apr 13 14:00:00 ap-wuhan-fw1 SF-IMS[5180]: [5180] pm:process [INFO] Started RUAScheduledDownload (15588)
Apr 13 14:00:04 ap-wuhan-fw1 SF-IMS[5180]: [5180] pm:log [INFO] Process 'RUAScheduledDownload' closed output.
Apr 13 14:00:13 ap-wuhan-fw1 SF-IMS[5575]: [5767] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (2dd7925a-2987-11e8-8dc8-2b1d7c9e1909), error: Not connected
Apr 13 14:00:13 ap-wuhan-fw1 SF-IMS[6504]: [6513] sftunneld:sf_peers [INFO] Peer 161.242.190.152 needs the first connection
Apr 13 14:00:20 ap-wuhan-fw1 SF-IMS[6507]: [6516] sfmbservice:sfmb_service [INFO] Start getting MB messages for 161.242.190.152
Apr 13 14:00:26 ap-wuhan-fw1 SF-IMS[5400]: [5400] IDSEventProcessor:TunnelHandler [WARN] Failed to connect to manager(tunnel): Not connected
Apr 13 14:00:33 ap-wuhan-fw1 SF-IMS[5575]: [5767] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (2dd7925a-2987-11e8-8dc8-2b1d7c9e1909), error: Not connected
Apr 13 14:00:34 ap-wuhan-fw1 SF-IMS[5575]: [5776] SFDataCorrelator:EventStreamHandler [ERROR] Unable to establish estreamer connection to 161.242.190.152: Not connected
Apr 13 14:00:35 ap-wuhan-fw1 SF-IMS[6504]: [6513] sftunneld:sf_peers [INFO] Peer 161.242.190.152 needs the first connection
Apr 13 14:07:50 ciscoasa syslog-ng[2414]: syslog-ng starting up; version='3.6.2'
Apr 13 14:07:50 ciscoasa kernel: [ 0.368533] pci 0000:00:14.0: System wakeup disabled by ACPI
Apr 13 14:07:50 ciscoasa kernel: [ 0.368991] pci 0000:00:16.0: System wakeup disabled by ACPI
Apr 13 14:07:50 ciscoasa kernel: [ 0.370368] pci 0000:00:01.0: PCI bridge to [bus 01]
Apr 13 14:07:50 ciscoasa kernel: [ 0.370769] pci 0000:02:00.0: System wakeup disabled by ACPI
Apr 13 14:07:50 ciscoasa kernel: [ 0.370898] pci 0000:00:02.0: PCI bridge to [bus 02]
Apr 13 14:07:50 ciscoasa kernel: [ 0.371075] pci 0000:00:03.0: PCI bridge to [bus 03]
Apr 13 14:07:50 ciscoasa kernel: [ 0.371244] pci 0000:00:04.0: PCI bridge to [bus 04]