topic Re: Here are the steps to shut in Network Security

Firepower Sensor Shutdown Reboot Question

QUARK TARO — Tue, 12 Mar 2019 13:19:27 GMT

How can I shutdown the IPS sensor on ASA5525-X with Firepower.

I have issued the command from Firesight Console under devices but still I am able to ping the IPS sensor management IP from other system.

In the Firesight console it shows the sensor as down.

What is the right method to shutdown the sensors?

Also after the sensor shutdown, how can I power-on the sensor without rebooting the firewall?

To completely shutdown the

Marvin Rhoads — Mon, 13 Mar 2017 07:33:24 GMT

To completely shutdown the Firepower module (aka the sfr module in the cli), issue the following command on the ASA command line interface enable mode:

sw-module module sfr shutdown

Start it back up with a reload:

sw-module module sfr reload

This is documented in the command reference here:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s17.html#pgfId-1609168

Begging the question why one would want to do this. I've never done it except as part of an upgrade where it is embedded in the upgrade script.

Thank You.

QUARK TARO — Mon, 13 Mar 2017 08:01:27 GMT

Thank You.

Even after shutting down the sensor from Firesight, I am able to ping the sensor management IP. The sensor is shown as offline in Firesight DC console. Is it a normal behavior?

You're welcome.

Marvin Rhoads — Mon, 13 Mar 2017 08:57:37 GMT

You're welcome.

The FMC-initiated shutdown only terminates the secure connection between itself and the sensor.

If it truly shut it down like the command I mentioned earlier, it would have no way of starting it up again as that has to be done from the ASA cli and the FMC does not have the ability to send commands to the parent ASA.

I think it's because the SFR

Kng Kng — Wed, 26 Apr 2017 21:34:37 GMT

I think it's because the SFR is a Linux system, very different than the ASA firmware based system. Sometime ago during initial testing of our 5585-X chassis (separate ASA and SFR module), I just powered it down thinking it was the same as a regular ASA. I was wrong. The SFR software was corrupted and became usable.

Now I am in the process of replacing the only (no redundancy) power supply of one of our 5585-X chassis. I need to run the shutdown command until the shutdown process is fully done before I can flip the power switch. It's a waiting game. At best I can only judge it by the module indicator activities.

You can monitor progress via

Marvin Rhoads — Thu, 27 Apr 2017 06:53:09 GMT

You can monitor progress via the sfr hardware module console port on the 5585-X.

Alternatively, you can see it (on all platforms) via the command "show module sfr log console".

That command is particularly useful when setting up one for the first time or upgrading - you can see where it is initializing databases, upgrading the OS etc. and track the progress in detail.

The sw-module module sfr

William King — Mon, 15 May 2017 18:55:41 GMT

The sw-module module sfr reload does not start the module back up after issuing the sw-module module sfr shutdown.

It gives the error:

"Module sfr cannot be reloaded, not in Up state."

Do you have to issue the "sw-module module sfr recover" command then? I don't want to reconfigure it, just start it back up.

Here are the steps to shut

Marvin Rhoads — Tue, 16 May 2017 01:26:36 GMT

Here are the steps to shut down and bring up a FirePOWER module:

sw-module module sfr shutdown
sw-module module sfr reset
sw-module module sfr reload

Re: Here are the steps to shut

Douglas Maguire — Fri, 03 May 2019 14:57:15 GMT

Re: Here are the steps to shut

tmatty102 — Fri, 03 May 2019 15:07:44 GMT

Marvin,

we shut down the SFR module earlier and we want to start it up again. I received the message below when I enter the reset command. Do you know what would cause that? and at this point, do i have to recover the module with the recover command?

someone else performed the shutdown, i'm not sure the steps he took to shut down the module.

# sw-module module sfr reset

Unable to reset Module sfr, it does not have a software image installed.

Thanks in advance.

Re: Here are the steps to shut

Marvin Rhoads — Sat, 04 May 2019 11:46:47 GMT

It appears somebody did more that simply shutdown the module - it may be uninstalled.

In that case it would need to be recovered / reinstalled.

Re: Here are the steps to shut

tmatty102 — Mon, 06 May 2019 13:50:12 GMT

I thought so. Just recovered the module.

Thanks for the confirmation!

Re: Firepower Sensor Shutdown Reboot Question

NIKH.SHRI1 — Mon, 12 Jun 2023 13:33:11 GMT

Try this, it worked for me. Thank you

https://edledge.com/unwanted-asa-failover-due-to-sfr-error/

Re: Here are the steps to shut

tanios191 — Tue, 12 Dec 2023 08:01:34 GMT

Hello Marvin,

Sorry to be replying to this old thread but I am having issues with my SFR module on my ASSA5525 the firepower tabs are not showing anymore in asdm also the state of the sfr module in CLI shows as unresponsive I am thinking of reloading the sfr by following the steps described above it but without losing any configuration made will the command sw-module module sfr reset just reload or will it factory reset the sfr module?

Thanks in advance

Re: Here are the steps to shut

Marvin Rhoads — Tue, 12 Dec 2023 13:39:02 GMT

@tanios191 the reset keyword will cause the module to factory reset.

https://community.cisco.com/t5/network-security/resetting-to-factory-default-firepower-module-in-asa/td-p/2853372

Re: Here are the steps to shut

tanios191 — Tue, 12 Dec 2023 13:47:12 GMT

What can I do in that case ?

I am getting the below output:

hoasa01# show module sfr

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
sfr Unknown N/A FCH22467AG6

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
sfr d4c9.3cff.8674 to d4c9.3cff.8674 N/A N/A

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
sfr Down Not Applicable

hoasa01# show module sfr

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
sfr Unknown N/A FCH22467AG6

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
sfr d4c9.3cff.8674 to d4c9.3cff.8674 N/A N/A

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
sfr Down Not Applicable

hoasa01# sw-module module sfr reload
hoasa01# sw-module module sfr reload

Reload module sfr? [confirm]

Module sfr cannot be reloaded, not in Up state.
hoasa01# sw-module module sfr ?

recover Configure recovery of this module
reload Reload the module
reset Reset the module
shutdown Shut down the module
uninstall Uninstall the module
hoasa01# sw-module module sfr reload

Reload module sfr? [confirm]

Module sfr cannot be reloaded, not in Up state.

Re: Here are the steps to shut

Marvin Rhoads — Tue, 12 Dec 2023 14:19:29 GMT

It appears to be totally offline. Have you verified the SSD is being seen with "show inventory"?

You may have to re-image and/or replace the SSD. If it's the SSD and you don't have support, the module may be unrecoverable.

Re: Here are the steps to shut

tanios191 — Tue, 12 Dec 2023 14:26:07 GMT

Here is the output of sh inventory:

hoasa01# show inventory
Name: "Chassis", DESCR: "ASA 5525-X with SW, 8 GE Data, 1 GE Mgmt, AC"
PID: ASA5525 , VID: V06 , SN: FTX2250W0A2

Name: "Storage Device 1", DESCR: "Model Number: Micron_M550_MTFDDAK128MAY"
PID: N/A , VID: N/A , SN: MXA190801MM