topic Re: ASA 5506 ASDM can't connect to Firepower module in Network Security

ASA 5506 ASDM can't connect to Firepower module

Javid_B — Tue, 12 Mar 2019 11:13:39 GMT

I've ran "show module" and the sfr module is Up/Up, and I have IP connection with the module from the ASA CLI.

ASDM log from Java console show "Failed to connect to FirePower, continuing without it"

ASA version - 7.6(1)

ASDM version - 9.6(1)

Firepower module version - 6.0.1.4-82

Java version - JRE 1.8.0_181 x86

Help please.

Re: ASA 5506 ASDM can't connect to Firepower module

Marvin Rhoads — Wed, 17 Oct 2018 12:16:02 GMT

Was it working previously? Is it configured for local (ASDM) management?

If it wasn't working previously and this is a first use of the Firepower service module, I'd suggest reimaging it to the current 6.2.3 release and the use ASDM 7.9(2)+.

To check if it is configured for local management, use the command "show module sfr detail".

Re: ASA 5506 ASDM can't connect to Firepower module

Marius Gunnerud — Wed, 17 Oct 2018 13:36:19 GMT

Is the management port on the ASA connected to your switch and in the same VLAN as your ASA's data interface that you are connecting to with the ASDM?

Re: ASA 5506 ASDM can't connect to Firepower module

Javid_B — Wed, 17 Oct 2018 19:24:00 GMT

Yes, it was working previously, but very long time (about 5-6 months) I didn't connect and check anything because I didn't need to reconfigure.

"Show module sfr detail" gave me "Unable to read details from module sfr". Then I've issued:

conf t

sw-module module sfr reload

After reload the ""Show module sfr detail" gave -

Card type: FirePOWER Services Software Module

Model: ASA5506

Hardware version: N/A

Serial number: JAD203605F4

Firmware version: N/A

Software version: 6.0.1.4-82

MAC Address Range: 00a2.ee92.ed00 to 00a2.ee92.ed00

App. name: ASA FirePOWER

App. Status: Up

App. Status Desc.: Normal Operation

App. version: 6.0.1.4-82

Data Plane Status: Up

Console session: Ready

Status: Up

DC addr:

Mgmt IP addr: 192.168.42.203

Mgmt Network mask: 255.255.255.0

Mgmt Gateway: 192.168.42.253

Mgmt web ports: 443

Mgmt TLS enabled: true

But then when I tried again that command I got "Unable to read details from module sfr" till now.

Re: ASA 5506 ASDM can't connect to Firepower module

Javid_B — Wed, 17 Oct 2018 19:26:29 GMT

Management port of the ASA not configured and not connected. For management we use inside interface IP that is in the same VLAN and network as ASDM and FirePOWER.

Re: ASA 5506 ASDM can't connect to Firepower module

Marvin Rhoads — Thu, 18 Oct 2018 03:20:29 GMT

The Firepower module on an ASA 5500-X series requires that you use the physical management interface.

You don't need to configure it in the ASA operating system but the module must use it for management.

Re: ASA 5506 ASDM can't connect to Firepower module

Javid_B — Thu, 18 Oct 2018 15:12:04 GMT

So, as I understand I should configure management interface on ASA with Firepower IP address (in my case 192.168.42.203) and connect it common switch or I should give some free IP address to management interface of ASA on the same VLAN connect it to the switch but on Firepower set the Management gateway not inside interface of ASA as it now, but that management interface with new IP. Could you please clarify?

Re: ASA 5506 ASDM can't connect to Firepower module

Marvin Rhoads — Thu, 18 Oct 2018 15:20:46 GMT

Please refer to the following link which has a good diagram and additional explanation:

https://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/sfr/firepower-qsg.html#pgfId-139738

The Firepower module can still use the ASA inside address as its default gateway. The Firepower module is like a VM on the ASA hardware that only has one external interface available: the management interface.

Re: ASA 5506 ASDM can't connect to Firepower module

Javid_B — Mon, 22 Oct 2018 11:03:18 GMT

So I've checked the connection and yes, everything was correct - management interface of ASA 5506-x is connected to the same switch as inside interface of ASA and they are in the same vlan. Interface of switch is up and line protocol is up (and indicators are blinking). Everything correct so far but still I can't connect to the Firepower through ASDM (FirePOWER tab is missing). Also I've noticed that ASDM shows the Firepower dashboard in the monitoring tab, but the configuration tab of Firepower in configuration tab is missing. Every time when I try to open the ASDM it takes a long time to enter the menu and then for the first 1-2 minutes everything becomes frozen and after when ASDM comes up I see "lost connection to Firewall" in the graphs before graphs start drawing.

Re: ASA 5506 ASDM can't connect to Firepower module

Marius Gunnerud — Mon, 22 Oct 2018 11:07:59 GMT

I remember that in my home lab I had a similar issue where I was not able to get ASDM to connect with the firepower. I think it had something to do with ARP since after I ping the FTD mgmt interface ASDM was able to connect to Firepower. Unfortunately, I had to do this each time I was going to make changes to Firepower (ping firepower mgmt IP, then open up ASDM).

Re: ASA 5506 ASDM can't connect to Firepower module

Javid_B — Mon, 22 Oct 2018 11:57:47 GMT

Didn't help.

Re: ASA 5506 ASDM can't connect to Firepower module

Marvin Rhoads — Mon, 22 Oct 2018 12:13:09 GMT

Check the output of "show module sfr detail" and see if the module has been configured to be managed by a "DC" (Defense Center - old name for Firepower Management Center).

If it is, then you will first have to "configure manager delete" from the module's cli.

Re: ASA 5506 ASDM can't connect to Firepower module

Javid_B — Mon, 22 Oct 2018 12:20:15 GMT

As you may see below, DC field is empty:

Card type: FirePOWER Services Software Module

Model: ASA5506

Hardware version: N/A

Serial number: JAD203605F4

Firmware version: N/A

Software version: 6.0.1.4-82

MAC Address Range: 00a2.ee92.ed00 to 00a2.ee92.ed00

App. name: ASA FirePOWER

App. Status: Up

App. Status Desc.: Normal Operation

App. version: 6.0.1.4-82

Data Plane Status: Up

Console session: Ready

Status: Up

DC addr:

Mgmt IP addr: 192.168.42.203

Mgmt Network mask: 255.255.255.0

Mgmt Gateway: 192.168.42.253

Mgmt web ports: 443

Mgmt TLS enabled: true

Re: ASA 5506 ASDM can't connect to Firepower module

Marvin Rhoads — Mon, 22 Oct 2018 12:26:07 GMT

Sorry - I didn't scroll back and realize you already provided that information.

Can you confirm the address assigned to the module is unique to it? Also, make sure you have not configured an IP address on the ASA management interface.

Re: ASA 5506 ASDM can't connect to Firepower module

Javid_B — Tue, 23 Oct 2018 07:38:09 GMT

FirePOWER IP is unique in network and management interface of ASA doesn't have an IP address.

Also I've noticed that show disk on sfr module show 100% full of /var/ , but when I searching that folder in expert mode with ls -lah I couldn't find which folder are so big and show disk-manager gave me 100% full Temporary, Backups and logs.

Could this be an issue of device access in ASDM or this is the another forum topic ?

Re: ASA 5506 ASDM can't connect to Firepower module

Marvin Rhoads — Tue, 23 Oct 2018 09:19:55 GMT

Is this a lab device or is it passing production traffic?

If it's in the lab I would just go ahead and re-image it and start over with version 6.2.3.

If it's in production I'd open a TAC case. It may have more issues that just ASDM access.

Re: ASA 5506 ASDM can't connect to Firepower module

Javid_B — Thu, 25 Oct 2018 07:02:31 GMT

Is this version supported by:

ASA version - 9.6(1)

ASDM version - 7.6(1)

or I need to upgrade everything?

Re: ASA 5506 ASDM can't connect to Firepower module

Marvin Rhoads — Thu, 25 Oct 2018 10:20:12 GMT

Your ASA software is OK with respect to compatibility. For ASDM, you should use 7.9(2) with Firepower 6.2.3.x.

Reference:

https://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html#id_59075

Re: ASA 5506 ASDM can't connect to Firepower module

Javid_B — Thu, 25 Oct 2018 10:39:20 GMT

Ok. Thank you. As I understood I have to uninstall current version of FirePOWER and install the new version 6.2.3.x with .img and .pkg files downloaded from cisco. Am I right?

Re: ASA 5506 ASDM can't connect to Firepower module

Marvin Rhoads — Thu, 25 Oct 2018 11:00:24 GMT

Yes, that's correct.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa93/configuration/firewall/asa-firewall-cli/modules-sfr.html#pgfId-1485825

...except that you shutdown and uninstall the sfr module in your use case (not ips) and then follow the procedure as written.

You'd start with 6.2.3 (asasfr-5500x-boot-6.2.3-4.img and asasfr-sys-6.2.3-83.pkg) and then patch it to 6.2.3.6 (Cisco_Network_Sensor_Patch-6.2.3.6-37.sh.REL.tar).

Those files can all be found here (entitlement required to download):

https://software.cisco.com/download/home/286283326/type/286277393/release/6.2.3.6