topic Hello, in Network Security

Error on the sensor.

n.avramenko87 — Tue, 12 Mar 2019 13:03:03 GMT

Hello! I have a lot of problems with firepower and can not to configure it. I have an error on sensor. What it si mean? Help me please!

Hi,

Pujita Patni — Mon, 27 Jun 2016 17:07:05 GMT

Hi,

What hardware model is this ?

By error are you referring to the green light on the warning icon (Triangle with exclamation) ?

Thanks,

Pujita

model 7100,yes- what is mean

n.avramenko87 — Tue, 28 Jun 2016 06:05:49 GMT

model 7100,yes- what is mean - green light on the warning icon?

I have Fatal RPC Error when i

n.avramenko87 — Tue, 28 Jun 2016 09:42:46 GMT

I have Fatal RPC Error when i try to apply device changes.What it is mean?

I have Defense Center running software version: 5.4.1.7

And if I login to Sensor I see Sourcefire Linux OS v5.3.0 (build 63). May be it is problem? How I can update sensor if it posible? Thank you!

Hello,

Pujita Patni — Tue, 28 Jun 2016 14:17:58 GMT

Hello,

This LED is the System Status LED.

It indicates the system status:

A green light indicates the system is powered up and operating normally, or powered down and attached to AC power.
An amber light indicates a system fault.

Here is more info on the same : http://www.cisco.com/c/en/us/td/docs/security/firepower/hw/firepower_device/firepower_7k8k_device/hardware.html

Thanks & Regards,

Pujita

Please rate this post and mark answered if it helps.

Hello,

Pujita Patni — Tue, 28 Jun 2016 14:24:31 GMT

Hello,

I see you are using FP7000 series on v5.3.x and the same is managed via FMC running 5.4.1.7. I see a compatibility issue here and we should first fix this issue.

Please upgrade to 5.4.0.6 or higher, in order to manage via FMC running 5.4.1.7.

Attaching compatibility table for your reference.

Here is more about the same :

http://www.cisco.com/c/en/us/td/docs/security/firesight/5408/relnotes/FireSIGHT-System-Release-Notes-version5408-and-5417.html#pgfId-649471

Thanks & Regards,

Pujita

Please rate this post and mark answered if it helps.

THANK YOU!!! I try to do that

n.avramenko87 — Tue, 28 Jun 2016 14:59:27 GMT

THANK YOU!!! I try to do that! I neet to update from my fire power sensor from v5.3.0 ti 5.4!

Hi,

Pujita Patni — Tue, 28 Jun 2016 16:56:01 GMT

Hi,

Yes, you will need to update it from 5.3.0 to 5.4.0.6

The upgrade path will be:

1: Upgrade to 5.3.0

2: Upgrade to 5.3.0.1

3: Upgrade to 5.4.0

4: Upgrade to 5.4.0.6

Thanks,

Pujita

Rate the post if it helps.

Hello Team,

Jetsy Mathew — Wed, 29 Jun 2016 06:21:00 GMT

Hello Team,

Whenever you upgrade, please refer the release notes.

FireSIGHT System Release Notes, Version 5.4.0.6 and Version 5.4.1.5

http://www.cisco.com/c/en/us/td/docs/security/firesight/5406/relnotes/FireSIGHT-System-Release-Notes-version5406-and-5415.html

FireSIGHT System Release Notes, Version 5.4

http://www.cisco.com/c/en/us/td/docs/security/firesight/540/relnotes/FireSIGHT-System-Release-Notes-v5-4.html

Sourcefire 3D System Release Notes, Version 5.3.0.1:

http://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/3d-system/53/Sourcefire_3D_System_5301_Release_Notes.pdf

Sourcefire 3D System User Guide, Version 5.3.0

http://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/3d-system/53/Sourcefire_3D_System_User_Guide_v53.pdf

Rate if this post helps you.

Regards

Jetsy

Thank you for your help! It

n.avramenko87 — Wed, 29 Jun 2016 06:50:02 GMT

Thank you for your help! It is very important for me! I start to understand how it is works. But where i can see what series of device i have? 2 or 3? .... O! I find this information!

Ok! I try and see in

n.avramenko87 — Wed, 29 Jun 2016 07:05:36 GMT

Ok! I try and see in firesight that i have version -5.3.0.3. And I find that the system offers me to update the device -Sourcefire 3D Device S3 Patch 5.3.0.8-15. I try to update but it is faild.

Now I download update Sourcefire 3D Device S3 Patch 5.3.0.4 and trying to install it.

Unfortunately I have problems

n.avramenko87 — Wed, 29 Jun 2016 07:39:59 GMT

Unfortunately I have problems! (My version 5.3.0.3)

1.If i try ti install updates From FireSight - it is faild.

2.If i try ti upload updates from archive (5.3.0.4-9.sh)- Upload failed: Update package is corrupt.

3.I try to upload 5.4.0-763 - is uploaded and I try to install it - it is faild too.

Hello Team,

Jetsy Mathew — Wed, 29 Jun 2016 08:20:01 GMT

Hello Team,

It looks like some communication issues are there.

To verify it can you try reapplying the policies once to see if it will be successful or not. If its not successful , please check if there is any RPC timeouts are there or connectivity issues exist.

Regards

Jetsy

O! There is no problem with

n.avramenko87 — Wed, 29 Jun 2016 10:34:46 GMT

O! There is no problem with connections beetween FireSight and Sensor. both see each other. But they in difference vlan. May be problem with it?

Does the policy reapply was

Jetsy Mathew — Wed, 29 Jun 2016 10:34:47 GMT

Does the policy reapply was fine ?

If you about access policy -

n.avramenko87 — Wed, 29 Jun 2016 10:45:40 GMT

If you about access policy - no ( But i have emty access policy. hardly it is a problem.

Hello Team,

Jetsy Mathew — Wed, 29 Jun 2016 10:49:04 GMT

Hello Team,

Can you see if the patch got pushed to the device by checking /var/sf/Upgrade Directory of the desired version.

If it didnt even get pushed verify the following from sensor CLI :-

pmtool status |grep sftunnel

pmtool status |grep SFData

Regards

Jetsy

Thank you for help! If i see

n.avramenko87 — Wed, 29 Jun 2016 11:02:22 GMT

Thank you for help! If i see admin@Sourcefire3D:/var/sf/updates$ i see only old updates. I think it is not good.

Command pmtool status |grep sftunnel - sftunnel dowm. Is it bad?

Hello Team,

Jetsy Mathew — Wed, 29 Jun 2016 11:08:45 GMT

Hello Team,

As i guessed the issue is with the communication channels in the sensor.

Sftunnel is the main communication channel between the FMC and sensor.

Here you can see the service is down and thus you cannot push upgrade as well as cannot reapply the AC policy.

Please try restarting the service by elevate as root user.

pmtool enablebyid sftunnel

Verify the status once again.

If its still down, please try resatrting the same.

pmtool restartbyid sftunnel

Rate if this answer helps you.

Regards

Jetsy

I reboot device! Now i having

n.avramenko87 — Wed, 29 Jun 2016 12:22:14 GMT

I reboot device! Now i having :

sftunnel (system) - Running 3960

I try to install updates. But Update Install failed (Update Install failed).

After that i try to check service and - sftunnel (system) - Down.

Service stoped working after installing updates.