topic Re: All, in Network Security

ASA 5506 Firepower Timezone

pbuch — Sun, 10 Mar 2019 13:25:05 GMT

How do i change the timezone for the Firepower module ?

It seems to default to New York, and i cant find any way to change this

/Per Buch

We set the time for event and

Marvin Rhoads — Thu, 16 Jul 2015 15:54:00 GMT

We set the time for event and other displays in the managing FireSIGHT Management Center (or FMC section of the ASDM GUI for the low end devices).

On an FMC, it's under the Username (top right) > User Preferences > Time Zone preference.

But on ASDM ?

pbuch — Thu, 16 Jul 2015 16:17:43 GMT

But on ASDM ?

My 5506 is at home and I don

Marvin Rhoads — Thu, 16 Jul 2015 16:32:50 GMT

My 5506 is at home and I don't have it in front of me to verify. The User Guide for that doesn't mention it so it might not be separately configurable. In that case it would pick it up from the ASA.

Have you set the timezone of the base ASA to your desired setting? (Configuration > Device Setup > System Time > Clock)

Yes, the base asa is at the

pbuch — Thu, 16 Jul 2015 16:34:26 GMT

Yes, the base asa is at the right timezone.

I poked around in my home ASA

Marvin Rhoads — Fri, 17 Jul 2015 03:30:09 GMT

I poked around in my home ASA 5506X. No joy in setting the FirePOWER module time in the ASDM GUI.

However, it appears you can change it in the Linux shell if you really want to. the time is set via a symbol link from the timezone file to /etc/localtime.

Mine was set at UTC by default and I changed it to GMT-5 as follows:

Xshell:\> ssh admin@192.168.1.254

Connecting to 192.168.1.254:22...
Connection established.
To escape to local shell, press 'Ctrl+Alt+]'.

Last login: Thu Jul  2 16:09:38 2015

Copyright 2004-2015, Cisco and/or its affiliates. All rights reserved. 
Cisco is a registered trademark of Cisco Systems, Inc. 
All other trademarks are property of their respective owners.

Cisco Linux OS v5.4.1 (build 12)
Cisco ASA5506 v5.4.1 (build 211)

> 
> expert
admin@Sourcefire3D:~$ 

admin@Sourcefire3D:/etc/sysconfig$ date
Thu Jul 16 20:16:54 UTC 2015
admin@Sourcefire3D:/etc$ sudo ln -sf /usr/share/zoneinfo/Etc/GMT-5 /etc/localtime

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

Password: 
admin@Sourcefire3D:/etc$ date 
Fri Jul 17 01:26:17 GMT-5 2015
admin@Sourcefire3D:/etc$

I tryed withsudo ln -sf /usr

pbuch — Fri, 17 Jul 2015 14:39:50 GMT

I tryed with

sudo ln -sf /usr/share/zoneinfo/Etc/GMT+1 /etc/localtime

Date command show GMT+1 (Denmark)

I still get a warning on the reporting page in ASDM

"time range was adjustet to align with report data"

The time shown on the page is "Fri 17 Jul 2015, 2:35 PM (UTC)"

And the ASA time is 17:35

Hmm. It could be either a bug

Marvin Rhoads — Fri, 17 Jul 2015 22:53:17 GMT

Hmm. It could be either a bug or just that neither of us understands it well enough.

If the unit has Smartnet perhaps you could open a TAC case on it.

No smartnet, its my demo unit

pbuch — Sun, 19 Jul 2015 07:12:56 GMT

No smartnet, its my demo unit.

A serious bug that it is impossible to set the time zone from ASDM.

There are also missing the possibility to change the admin password.

I cant be the only one with this problem.

Did anyone else notice the

azbarcode — Thu, 15 Oct 2015 23:16:19 GMT

Did anyone else notice the time changes in the wrong direction? I am in Arizona and we are always GMT-7. When I set this, the time went forward 7 hours ahead of UTC. You can even see this in Marvin's example. He's at 20:16:54 on a Thursday & then sets GMT-5 and he goes ahead 5 hours into Friday morning. Seems odd to me, but just applying reverse logic it works at least.

I suppose it is a bug. I got

Sasha Morozov — Sun, 01 Nov 2015 21:35:14 GMT

I suppose it is a bug. I got the same problem. The fact is when you change the time by (further is an example) ln -sf /usr/share/zoneinfo/Europe/Moscow /etc/localtime and when you add in /etc/sysconfig/clock

ZONE="Europe/Moscow"

UTC=true

the output of the date command and hwclock command is correct, but

logs in ASDM still show UTC.

On the very ASA time and zone settings are correct and the very ASA's ASDM show correct (Moscow) time.

I'd like to ask (it is a bit offtopic here) - I have the control and protection license on cisco ASA 5506-x and everything works with access policies but user awareness.

I have set up User Agent on windows 7 workstation, it sees Domain Controller and according to logs it polls logs from it, and sends info to ASA firepower (logs tell that "Reported Heartbeat from windows 7 wks to ip of Firepower module"). Also I have set up through ASDM user agent on ASA Firepower. But asa firepower report on dashboard says that user information is unavailable and of course no blocking user traffic from the host where user is logged on according to AccessPolicy (LDAP connection is succesfully set up).

I have spent a week with troubleshooting - no success.

All,

jusrober — Tue, 05 Jan 2016 16:57:06 GMT

All,

Please be advised that changing the time zone from the command line is NOT supported. Doing so will require you to re-image the device to enter back into a supported state.

Thank you,

Justin Roberts

Firepower TAC

How about an update that

pbuch — Tue, 05 Jan 2016 17:01:22 GMT

How about an update that makes i possible from ASDM ?

An enhancement has been

jusrober — Tue, 05 Jan 2016 18:11:33 GMT

An enhancement has been submitted to have this feature added:

https://tools.cisco.com/bugsearch/bug/CSCuu10347

Upgraded to new asdm and asa

pbuch — Tue, 05 Jan 2016 21:35:32 GMT

Upgraded to new asdm and asa image, I cant find any timezone config.

This is becoming a joke 🙂

I have the same problem, with

Thiago Cella — Mon, 22 Feb 2016 19:53:01 GMT

I have the same problem, with a TAC openned, and Cisco not yet corrected.

someone knows any workaround?

No workaround an no solution.

pbuch — Tue, 23 Feb 2016 20:31:38 GMT

No workaround and no solution... after more than 3/4 year

Tks pbuch

Thiago Cella — Tue, 23 Feb 2016 20:42:47 GMT

Tks pbuch

unbelievable and frustrating

I have exact the same problem

Denis Orlov — Wed, 16 Mar 2016 13:18:16 GMT

I have exact the same problem.

I've changed local time directly in linux shell and it's correct now:

> expert
dadmin@Sourcefire3D:~$ date
Wed Mar 16 16:14:14 MSK 2016
admin@Sourcefire3D:~$

But when I connect via ASDM and go to "FirePower->Local->Configuration->Time" I see wrong time.

I there anybody get some comment from Cisco TAC?

It's supported now -

Barrett Cowan — Mon, 21 Mar 2016 21:35:05 GMT

It's supported now - CSCuu70250

http://www.cisco.com/c/en/us/td/docs/security/firepower/601/relnotes/firepower-system-release-notes-version-601.html