topic On the FMC console, see in Network Security

Ping hostname failed in Firepower Module

Kurt Lei — Tue, 12 Mar 2019 13:20:54 GMT

Dear All,

I have perform Schedule Rule Updates in FMC but I can't update now. I found I can't ping or traceroute the hostname. I can nslookup the domain but can't ping. Is there any setting missing now ? Thanks All.

System Support> ping www.yahoo.com
ping: unknown host www.yahoo.com

System Support> nslookup www.yahoo.com
Server: 10.0.232.20
Address: 10.0.232.20#53

Non-authoritative answer:
www.yahoo.com canonical name = fd-fp3.wg1.b.yahoo.com.
Name: fd-fp3.wg1.b.yahoo.com
Address: 116.214.12.74

Kurt

That prompt looks like if

Marvin Rhoads — Thu, 30 Mar 2017 07:37:02 GMT

That prompt looks like if might be from an FTD sensor's clish interface.

The FMC command line should look more a straight Linux bash shell.

Sorry Marvin. I mixed up FMC

Kurt Lei — Fri, 31 Mar 2017 05:13:59 GMT

Sorry Marvin. I mixed up FMC and firepower module. My problem is FirePower Module.

Actually, I can't in Linux mode and system support mode. I confirmed I have configured correct DNS and nslookup works fine. Really can't figure out what's the actual problem.

admin@firepower:~$ ping www.yahoo.com
ping: unknown host www.yahoo.com

System Support> ping www.yahoo.com
ping: unknown host www.yahoo.com
System Support>

Are you running an FTD image?

Marvin Rhoads — Fri, 31 Mar 2017 08:35:26 GMT

Are you running an FTD image? If so, try using "ping system <hostname>".

On the FMC console, see

Claudiu Cismaru — Sat, 01 Apr 2017 18:08:40 GMT

On the FMC console, see whether you have the correct nameservers. For this, run:

cat /etc/resolv.conf

You should have an least one entry, like:

nameserver your_dns_server_ip

Finally, the problem solved

Kurt Lei — Wed, 05 Apr 2017 03:36:21 GMT

Finally, the problem solved by "Waiting". It is strange that the ping works after days.

I thought I got sthg wrong but I try in another Firepower module is the same symptom. I configured same DNS server but didn't work at that moment. However, it works suddenly on the next day.

Kurt,

Claudiu Cismaru — Wed, 05 Apr 2017 07:04:28 GMT

Kurt,

I asked about the correct nameserver as there's a Linux behavior that you encountered.

First you started with no nameservers or nameservers that didn't answer for your requests.

Then, you added the correct nameservers. However, there's a Linux process which helps glibc and caches the requests. This process is nscd (name service caching daemon).

Even if you add the correct nameservers, negative caches are still in memory and they are returned to the glibc uses those values.

The best thing to do, when you change the nameservers is to, in case of the Firepower gear and the issue occurs, restart the nscd daemon with:

/etc/rc.d/init.d/nscd restart

Re: Kurt,

bachdart@garena.com — Tue, 21 Aug 2018 13:11:31 GMT

thanks a lot, it works.

Re: Kurt,

fhobeidat — Fri, 24 May 2019 18:23:17 GMT

Thanks Kurt

I added the nameservers in FMC but I still couldnt ping the hostname. After I followed your advice and restarted the DNS services it worked for me like magic

/etc/rc.d/init.d/nscd restart

Thanks Again