topic Re: Access Control Policies are not deploying correctly. in Network Security

Access Control Policies are not deploying correctly.

kashifglobal12 — Tue, 12 Mar 2019 14:01:16 GMT

Dear all,

I had a very unusual situation. I have two firewalls 5516-x in active-standby mode. I have configured NTP server locally and synchronize the fmc and sourcefire with that but after that suddenly my firewalls condition shifted reverse i.e the active one become the standby and vise versa. so after resolving this issue molicies are not deploying correctly in sourcefire i.e user based access rules are not working.

Re: Access Control Policies are not deploying correctly.

Ajay Saini — Tue, 09 Oct 2018 10:30:51 GMT

Hello,

Can you please clarify what error message is seen when deploying the policies through FMC. Or is that the policy is being pushed but not working. Please clarify and attach any screenshot etc.

Usually, if the deployment is stuck, you would have to engage Cisco TAC who can clear the stuck process using script in shell and fix it.

HTH
AJ

Re: Access Control Policies are not deploying correctly.

kashifglobal12 — Wed, 10 Oct 2018 06:59:57 GMT

Thanks for your reply.

Policies are successfully deploying but not working correctly i.e when I
apply user policy on some user policy is working correctly but on some user
the internet is blocked and I have applied only one policy.

Re: Access Control Policies are not deploying correctly.

babiojd01 — Thu, 11 Oct 2018 17:33:55 GMT

Here is a question, when you deploy the policy and it displays successful but does it take a while to finish? If you go back to the deploy button does the particular firepower module show up in the list as a device you can deploy to right after a successful deployment?

Re: Access Control Policies are not deploying correctly.

Ajay Saini — Sun, 14 Oct 2018 03:00:31 GMT

To be very frank, this is a vague info and not helpful in identifying the root cause.

To move further, I would encourage to look at what you require and what is not working. If you are saying that the rule is deployed correctly and not working for some hosts, then we need to run a packet-tracer on CLI and see where this is failing. Please run a pack-tracer and see which rule the non-working traffic actually hits.

HTH
AJ