topic Cannot Register any SFR Modules in the FirePOWER Management Console in Network Security

Cannot Register any SFR Modules in the FirePOWER Management Console

Peter Long — Tue, 12 Mar 2019 12:55:28 GMT

I've got, two 5515-X firewalls (in Active/Standby) and two remote sites with ASA5506-X firewalls (connected via site to site IPSEC VPN).

I've deployed the FirePOWER Management Appliance (VMware) version 6.0.0.1 Build 26, I've updated the SFR modules in all the firewalls to 6.0.0.1 build 26, I've tried to register them with and without a NAT ID, (the management appliance is on the same LAN at the 5515-X pair).

This Is all I get

Could not establish connection with sensor. Make sure the registration keys match, that the software versions are compatible, and that the network is not blocking the connection.

They keys match I've tried with simple passwords complex passwords and 1234

The software version is the same

Comms is OK, i.e from the network the Management appliance is on, I can browse to https for all the SFR modules.

It would seen that the problem is on the Management Center but as all the licences are tied to its MAC address I don't want to blow it away and rebuild it?

Anyone have a clue?

Pete

No one ever answers my

Peter Long — Sun, 06 Mar 2016 14:56:27 GMT

No one ever answers my questions?

Update :

Built a fresh FMC, then re-imaged one of the SFR modules (versions 6.0.0-1005)

Same problem

Downloading version 5.4 now.................

To me it seems like a

Dennis Perto — Wed, 09 Mar 2016 11:19:00 GMT

To me it seems like a networking problem. But if they are on the same LAN it cannot be it.

Please make updates on your progress. 🙂

Hi ,

Aastha Bhardwaj — Wed, 09 Mar 2016 14:27:11 GMT

Hi ,

Can you try to telnet from the FMC to the sensor on port 8305 and see if that works.

You can check /var/log/messages and grep for sftunnel and see messages on both FMC and Sensor and see what error you get when you try to register ?

Regards,

Aastha Bhardwaj

Rate if that helps!!!

I forgot I still had this

Peter Long — Tue, 23 Aug 2016 14:13:44 GMT

I forgot I still had this open, here is how I fixed it (scroll down to problems)

Cisco Add FirePOWER Module to FirePOWER Management Center

Pete

Thanks for the update Pete.

Marvin Rhoads — Wed, 24 Aug 2016 03:10:02 GMT

Thanks for the update Pete.

I have one I'm working on now with similar error message. I will give that a try to see if it helps.

FWIW I can telnet on tcp 8305 from FMC to sfr module but not vice versa. So tcp 3-way handshake is working fine.

I have checked, verified and restarted sftunnel process on the FMC.

Update - rebooting the

Marvin Rhoads — Wed, 24 Aug 2016 14:50:42 GMT

Update - rebooting the FirePOWER Management Center fixed the issue for me. Once I did that, registration succeeded without any issue.

Cheers Marvin, I has two 5506

Peter Long — Wed, 24 Aug 2016 15:07:26 GMT

Cheers Marvin, I had two 5506's on remote sites and a pair of 5515's on the main site, none of them would register, despite being able to ping each other and the management console.

Static routes fixed it for me - I re-imaged them as well, so they got restarted a lot.

Glad you got it working bud 🙂

Regards,

Pete

Hi

Ali Abbaszadeh — Wed, 31 Aug 2016 07:05:12 GMT

i have problem like peter but i don't know what can i do to solve this problem ?

Thanks in advance

Hi

Ali Abbaszadeh — Wed, 31 Aug 2016 07:09:41 GMT

i have a problem like peter but i don't know what can i do to solve this problem ?

Thanks in advance

Did you follow the link above

Peter Long — Wed, 31 Aug 2016 07:13:47 GMT

Did you follow the link above, can you give us some more information on the setup and layout of your network?

peter i said my

Ali Abbaszadeh — Wed, 31 Aug 2016 07:25:55 GMT

Peter i said my configuration is like you for example FirePOWER Management version is 6.0.0.1 and Both are same key but the result is under photo

The second problem is that how can ping firepower from firesight? there is any option in firesight for do it?

Thanks mate

Firesight is a Linux

Peter Long — Wed, 31 Aug 2016 07:35:57 GMT

Firesight is a Linux distribution log onto the CONSOLE

SFR is also a Linux distribution log onto the SESSION

Cisco FirePOWER – Adding a Static Route

Cisco FirePOWER SFR Module Cannot Ping

Pete

Hi

Ali Abbaszadeh — Tue, 06 Sep 2016 09:13:54 GMT

Still I have that error when I want to add firepower in firesight and firepower ip is 10.4.30.240 and firesight ip is 192.168.30.105. it means they are not at same network. I want to know they should be in same network or not??

Hi Peter

Dennis Perto — Tue, 06 Sep 2016 09:24:44 GMT

Hi Peter

Please do not make other people change the access permissions for any files.
Not recommended:

sudo chmod u+s /bin/ping

Instead elevate your rights like this:

sudo su -
[ENTER PASSWORD]

Then you can ping, as intended.

It should work, if you have

Dennis Perto — Tue, 06 Sep 2016 09:26:14 GMT

It should work, if you have the routing setup correctly.

Okay . they can ping each

Ali Abbaszadeh — Tue, 06 Sep 2016 09:40:04 GMT

Okay . they can ping each other but I can not add ?? What's your opinion?

Make sure that each can reach

Marvin Rhoads — Tue, 06 Sep 2016 12:10:43 GMT

Make sure that each can reach the other on tcp/8305.

If they cannot, verify each is listening on that port.

If either is not, it's usually easiest to open a TAC case to investigate the cause of the process (sftunnel) that is responsible for the communications between sensor and management center.

You can check on the process with the instructions in this thread:

https://supportforums.cisco.com/discussion/13009051/firesight-process-status-stunnel

I have found a restart of FirePOWER Management Center can sometimes restart the sftunnel process.

Thanks Marvin

Ali Abbaszadeh — Wed, 07 Sep 2016 05:59:11 GMT

Thanks Marvin

i checked them and both of them work with tcp\5305. but still i have that problem.

Could not establish connection with sensor. Make sure the registration keys match, that the software versions are compatible, and that the network is not blocking the connection.

ping is okay/ firepower of version is okay but they are not at same network and routing is okay .

I'm sick no one knows what's problem ?

Thanks

I'd have TAC check your

Marvin Rhoads — Wed, 07 Sep 2016 06:10:04 GMT

I'd have TAC check your sftunnel.

I don't remember the exact syntax but I had one where the registration was mis-entered on the sensor. That was causing the manager to not register.

Once the TAC was looking at in in real time we had it figured out in 10 minutes. The team who handle the FirePOWER issues are quite good.