topic Hi, Go on Access control in Network Security

Source Fire Connection Events not showing/recording

jseidl — Tue, 12 Mar 2019 12:49:22 GMT

Under the Connections>Events we do not get any data

Hi,

Pujita Patni — Thu, 19 Nov 2015 17:36:39 GMT

Hi,

Do you haev logging enabled on your Access Control Policy ?

Thanks,
Pujita

Hi, Go on Access control

Aastha Bhardwaj — Thu, 19 Nov 2015 17:46:56 GMT

Hi, Go on Access control policy and check if Logging is enabled on it and then also on right hand corner you have the window to increase the time frame , increase that for a week and see if you get any events out there.

If all of that is fine check on the sensor:

/var/sf/detection-engine , press tab and then go to instance
/var/sf/detection-engine/*/instance-1 ,Check for conn-unified bookmark file , see what date it was updated.

Also check the below on Defense Center and Sensor:

pmtool status |grep SFData

SFdatacorrelator service should be running.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

Yes logging is on. The Event

jseidl — Thu, 19 Nov 2015 18:44:30 GMT

Yes logging is on. The Event were working. They stop about 10 days ago

Thx. I will try to complete

jseidl — Thu, 19 Nov 2015 18:52:39 GMT

Thx. I will try to complete your above idea. I am new to this product.

I do have this in the syslog:

Nov 19 2015 13:41:38 Sourcefire3D SF-IMS[31120]: [31240] SFDataCorrelator:MySQLEvent [ERROR] mysql_stmt_prepare failed: 1017: Can't find file: 'rna_flow_stats_1440774000' (errno: 2); cmd: INSERT INTO rna_flow_stats_1440774000 (sensor_id,protocol,initiator_port,responder_port,first_packet,last_packet,packets_sent,packets_recv,bytes_sent,bytes_recv,client_app_version,info,netbios_domain,flow_type,tcp_flags,security_zone_ingress_id,security_zone_egress_id,interface_ingress_id,interface_egress_id,user_id,initiator_ip,responder_ip,src_device_ip,fw_policy_id,fw_rule_id,fw_rule_action,fw_rule_reason,app_proto_id,client_app_id,web_app_id,url_category,url_reputation,fw_monitor_rule_id_1,fw_monitor_rule_id_2,fw_monitor_rule_id_3,fw_monitor_rule_id_4,fw_monitor_rule_id_5,fw_monitor_rule_id_6,fw_monitor_rule_id_7,fw_monitor_rule_id_8,ip_rep_src_dst,ip_rep_layer,ip_rep_category,instance_id,counter,file_count,ips_event_count,initiator_country,responder_country,ioc_count,nf_src_as,nf_dst_as,nf_snmp_in,nf_snmp_out,nf_src_tos,nf_dst_to

The above repeats every minute.

I believe that SFdatacorrelator is running see attached

Hi,

Aastha Bhardwaj — Thu, 19 Nov 2015 19:09:27 GMT

Hi,

YOu would need to login on the Defense Center via the Cli.

+Ssh to the Defense centre.

++Escalate the the privilge to root.

admin>sudo su

Enter the root password

root>pmtool status |grep -i Down

root>pmtool status |grep SFData

You would need to check the same thing on the Sensor.

Are you initiating some live traffic. can you create a allow rule with Logging enabled on Top on Defense Centre and see if that works.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

That was helpful. Thx

jseidl — Thu, 19 Nov 2015 19:16:08 GMT

That was helpful. Thx

Here is what I have from DC:

root@Sourcefire3D:/Volume/home/admin# pmtool status |grep SFData
SFDataCorrelator (normal) - Running 6052
Command: /usr/local/sf/bin/SFDataCorrelator --nodaemon
PID File: /var/sf/run/SFDataCorrelator.pid
Enable File: /etc/sf/SFDataCorrelator.run

root@Sourcefire3D:/Volume/home/admin# pmtool status |grep -i Down
RUAScheduledDownload - Period 3600 - Next run Thu Nov 19 20:01:15 2015
root@Sourcefire3D:/Volume/home/admin#

Hi,

Aastha Bhardwaj — Thu, 19 Nov 2015 19:26:32 GMT

Hi,

Check the same thing on the Sensor as well. Try creating a rule on Defense centre to allow the traffic with Logging enabled and place it on top.

Make sure logging is enabled on :

Beginning and End of connection both.

Also make sure :

Send Connection Events to :Defense Center is checked.

Push the policy on the sensor and then initate live traffic and see if that works.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

The sensor shows the process

jseidl — Thu, 19 Nov 2015 19:44:04 GMT

The sensor shows the process running as well.

I have a new allow rule that has logging enabled.

Still no data showing in the Connections. This had worked in the past. No changes were made. it just stopped working.

Thanks Again for your help

jerry

Hi,

Aastha Bhardwaj — Thu, 19 Nov 2015 20:31:18 GMT

Hi,

At this point of time , I would suggest you to open up a case with TAC , because now we would need to check the flow .

We would need to check on sensor that when was the connection file last updated. If it is recent then we need to check why dont we see the file on the Defense Centre.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

Thx. I will open with TAC

jseidl — Thu, 19 Nov 2015 20:48:39 GMT

Thx. I will open with TAC

Hi,

huucuonghumg — Wed, 18 May 2016 08:35:10 GMT

Hi,

I have same problem, anything perhaps OK but cannot show traffic. if I using firewall transparent Firesight can show traffic but still one error when I check command:

show service-policy sfr

Service-policy: global_policy
Class-map: sfr
SFR: card status Up, mode fail-open monitor-only
packet input 0, packet output 0, drop 0, reset-drop

If I change to router mode anything perhaps OK but no traffic show, no record show and still error above

show service-policy sfr

Service-policy: global_policy
Class-map: sfr
SFR: card status Up, mode fail-open monitor-only
packet input 0, packet output 0, drop 0, reset-drop

Please Help me!

Hi ,

Aastha Bhardwaj — Wed, 18 May 2016 13:49:18 GMT

Hi ,

Have you created an access-list to redirect the traffic from ASA to SFR , check the hitcounts on the access-list , if we dont see any hitcounts on access-list then in that case the ASA itself is not pushing any traffic to SFR , I am assuming the basic connectivity have already been checked and the management interface on ASA is up and running ?

Regards,

Aastha Bhardwaj

Rate if that helps!!!

The problem was a corrupted

jseidl — Wed, 18 May 2016 13:56:26 GMT

The problem was a corrupted database file. Working with TAC the issues was resolved. Thx All.

Hi jseidl

huucuonghumg — Fri, 20 May 2016 07:38:45 GMT

Hi jseidl

can You tell Me the corrupted database file name? it can be asasfr-5500x-boot-5.3.1-152.img or asasfr-sys-5.3.1-155.pkg or firesight management on esxi. I will download it again.

I cannot open TAC because i haven't contract number.

thank you!

Hi Aastha Bhardwaj

huucuonghumg — Fri, 20 May 2016 07:50:18 GMT

Hi Aastha Bhardwaj

I was config the config:

ciscoasa(config)# access-list sfr_redirect extended permit ip any any

ciscoasa(config)# class-map sfr
ciscoasa(config-cmap)# match access-list sfr_redirect
ciscoasa(config)# policy-map global_policy
ciscoasa(config-pmap)# class sfr
ciscoasa(config-pmap-c)# sfr fail-open
ciscoasa(config-pmap-c)# sfr fail-open monitor-only
ciscoasa(config)# service-policy global_policy global

but no thing can show, can You send to Me the file show running config of your firewall asa.

Thank you!

Hi ,

Aastha Bhardwaj — Fri, 20 May 2016 13:11:43 GMT

Hi ,

If you are planning to reimage the SFR on ASA , first you would need the .img file.

Detailed procedure : http://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configure-firepower-00.html

Regards,

Aastha Bhardwaj

Rate if that helps!!!

I'm having the same issue

jwornstaff — Fri, 12 Aug 2016 12:11:36 GMT

I'm having the same issue (nothing being logged to event dashboards) with a new installation, everything is configured correctly as I can tell. Logging enabled, redirect in place and showing packets.

I have one installation that is working perfectly, and a second one, the problem one with "no data".

What did the TAC do to fix your issue with database or other solution. I have a TAC case open but this was just deployed to production and need to fix asap, and TAC ask some questions then disappeared on me.

Hi jwornstaff

huucuonghumg — Sat, 13 Aug 2016 14:25:46 GMT

Hi jwornstaff

You must sure traffic throught from inside to outside (nat, access list permit from inside to outside). After put a laptop test ping or access internet from inside. traffic will show in dashboards. 🙂

thanks