topic Excellent - thanks for in Network Security

Smart Software licensing for FR41200 with vASA

Junyx sen — Tue, 20 Jun 2017 16:54:33 GMT

Hi, All

We are trying to register our FP 4120 to the cisco smart licensing. We have already the smart account and assigned the licenses in the virtual acocunt.

Apparenly we are having issue, now we are using the smart software satellite as our environment dont have direct connection to the internet.

Somehow we are having issue genrerating the certchain. Getting invallid cert chain.

we manage to directly connect the FirePower to the internet using the management port but still failed to register.

Anyone had experience to register a Firepower to the smart licensing either using the default mode or the satellite?

Thanks and regards

I've not used a satellite

Marvin Rhoads — Wed, 21 Jun 2017 07:50:47 GMT

I've not used a satellite server but have setup a FirePOWER 4110 with ASA logical device.

Did you get a token from Smart Software Manager portal and apply it to the chassis via FirePOWER Chassis Manager?

That needs to be done before you can allocate the ASA base and 3DES-AES licenses for the ASA logical device.

Hi, Marvin

Junyx sen — Wed, 21 Jun 2017 14:08:13 GMT

Hi, Marvin

Thank you for your feedback.

We just solve the issue today. Firstly we have already the smart account and was able to login to the smart licensing site. Then we created the satellite server and sync it. After we settled the satellite server we can now generate the token and apply to the firepower.

Apparently we need to create a cert chain, this is the part were we got an issue.

After resolving this cert chain issue, we were able to successfully register our firepower and use the features for the ASA VPN.

Regards,

Thanks for letting us know.

Marvin Rhoads — Wed, 21 Jun 2017 14:13:42 GMT

Thanks for letting us know.

Was there a guide or instructions from the TAC on the cert chain issue that you can share?

I have attached the file.

Junyx sen — Wed, 21 Jun 2017 14:21:25 GMT

I have attached the file.

You need to extract the certificate on the satellite server. When creating the cert chain you must include both the default cert from the firepower and from the imported certificate from the satellite server if not both you will get error.

Excellent - thanks for

Marvin Rhoads — Wed, 21 Jun 2017 14:24:46 GMT

Excellent - thanks for sharing!

As I sometimes joke, the down side of having a PhD in Cisco Security licensing is that the shelf life of the knowledge is about a year. 🙂

Re: Excellent - thanks for

martin5641289 — Wed, 04 Sep 2019 07:23:18 GMT

We have similar problem with Firepower 2100 ASA image. The communication to Satellite server did not work too. Wireshark and log „show crypto ssl errors“ showed errors because the communication to Satellite https certificate should be from trusted certificate. We took the CA certificate from Satellitze server where certificates are stored at OS file system. If you have the CA certificate, you can add it from ASDM and test the connection by command „call-home test profile license“. Adding via cli is possible but you need another form of the certificate.

The default config does not contain this Cisco Licensing Root CA certificate so we spent a lot of time to find how to licence our firewall. From customer point of view, it was useless time.

Does anybody know if the necessity of adding Cisco Licensing Root CA to trusted CA for allowing communication to Satellite server is somewhere described? I was not able to find it. Now I found a web page https://www.cisco.com/security/pki/ where are Cisco CA certificates. But Cisco Licensing Root CA is not here and I do not want to read all these certificates if one of them is the same that is used by the Satellite server.