topic Re: Using ASDM to update Firepower Rules | ASA 5506-x in Network Security

Using ASDM to update Firepower Rules | ASA 5506-x

errMsg — Tue, 28 Apr 2020 22:08:13 GMT

On my 5506-x I manage firepower with the ASDM. Im trying to update the rules because they have never been updated. when i navigate to Configuration>ASA firepower Configuration>Updates and click Download Updates it says "Download updates failed: Unable to connect to update server". I have the firepower management port cabled to a switch that has an internet connection, checked the DNS server and tried adding NAT to the interface but it still wont connect. Can anyone point me in the right direction?

Re: Using ASDM to update Firepower Rules | ASA 5506-x

Francesco Molino — Wed, 29 Apr 2020 02:08:21 GMT

Hi
What version do you run?
When you checked dns, you checked the file /etc/resolv.conf?

Re: Using ASDM to update Firepower Rules | ASA 5506-x

errMsg — Wed, 29 Apr 2020 02:49:25 GMT

Firepower 6.2.2

Here is the results from my resolv.conf

admin@firepower:~$ cat /etc/resolv.conf
# automatically generated by /etc/sysconfig/configure-network ; do not edit
# Mon Apr 27 22:07:32 UTC 2020
search example.net
nameserver 208.67.222.123
nameserver 208.67.220.123

Re: Using ASDM to update Firepower Rules | ASA 5506-x

Marvin Rhoads — Wed, 29 Apr 2020 04:42:52 GMT

Is there any proxy server in your network?

From the module cli are you able to ping a public address using its name (e.g., "ping www.cisco.com")?

Re: Using ASDM to update Firepower Rules | ASA 5506-x

errMsg — Wed, 29 Apr 2020 14:18:12 GMT

I dont have a proxy

admin@firepower:~$ ping cisco.com
ping: unknown host cisco.com

admin@firepower:~$ ping 8.8.8.8
ping: icmp open socket: Operation not permitted

Re: Using ASDM to update Firepower Rules | ASA 5506-x

Marvin Rhoads — Wed, 29 Apr 2020 17:40:44 GMT

It appears there's not a valid name server (DNS) configured.

See this article for details on updating it:

https://www.petenetlive.com/KB/Article/0001173

The ping command requires you to switch to root superuser first:

sudo su -

Re: Using ASDM to update Firepower Rules | ASA 5506-x

errMsg — Wed, 29 Apr 2020 17:52:59 GMT

Sudo doesent return anything either...

admin@firepower:~$ sudo ping cisco.com
ping: unknown host cisco.com
admin@firepower:~$ sudo pint 8.8.8.8
sudo: pint: command not found
admin@firepower:~$ sudo ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
30326

30326 30326

Re: Using ASDM to update Firepower Rules | ASA 5506-x

Marvin Rhoads — Wed, 29 Apr 2020 18:32:15 GMT

So internet is confirmed reachable and the configured resolver isn't resolving an FQDN into an IP address.

Check the configured resolver and change/fix it as necessary. Instructions in the article I linked earlier.

Re: Using ASDM to update Firepower Rules | ASA 5506-x

errMsg — Wed, 29 Apr 2020 20:56:47 GMT

Thanks for the link Marvin. Turns out that restarting the service allowed Firepower to connect.

sudo /etc/rc.d/init.d/nscd restart

I did change the dns but it was restarting the nscd that got me in.

Thanks for pointing me in the right direction!

Re: Using ASDM to update Firepower Rules | ASA 5506-x

Marvin Rhoads — Thu, 30 Apr 2020 02:32:41 GMT

You're welcome. Thanks for letting us know it's resolved.