topic Re: unable go to configuration mode on asa in Network Security

unable go to configuration mode on asa

amralrazzaz — Thu, 12 Nov 2020 23:53:38 GMT

hi all

i have asa 3des license key and i cant add the activation key using cli because i unable to go to configuration mode (no config t command on cli )

im using FTD local managing the asa

EGCAI01-Firepower# show version
---------------[ EGCAI01-Firepower ]----------------
Model : Cisco ASA5516-X Threat Defense (75) Version 6.5.0 (Build 115)
UUID : 2edfecc2-e0fc-11ea-8172-ea9e617e90fb
Rules update version : 2019-08-12-001-vrt
VDB version : 309
----------------------------------------------------

Re: unable go to configuration mode on asa

Mohammed al Baqari — Fri, 13 Nov 2020 02:32:49 GMT

You need to check if you got the right privileges to do this. If you can't
enter config t then you don't have privileges

**** please remember to rate useful posts

Re: unable go to configuration mode on asa

amralrazzaz — Fri, 13 Nov 2020 09:35:57 GMT

so how can i get this privilege ? im the owner of this device and the only one who manage this ?

is there another way to install this strong encryption license on asa like tftp app or something else?

how can i have full privilege on my ASA ? is there a way ?

Re: unable go to configuration mode on asa

Mohammed al Baqari — Fri, 13 Nov 2020 10:18:19 GMT

Hi,

Are using the default one or you created new one. Try to use admin login.

**** please remember to rate useful posts

Re: unable go to configuration mode on asa

amralrazzaz — Fri, 13 Nov 2020 10:40:40 GMT

this what i using the default but just changed the password

how to create local admin user with full access so it can be access on enable mode and config mode ?

is there a way for that ?

Re: unable go to configuration mode on asa

amralrazzaz — Fri, 13 Nov 2020 11:04:45 GMT

i have just created admin user now and is this can have the config mode?

> show user
Login UID Auth Access Enabled Reset Exp Warn Str Lock Max

i connected to asa via ssh with new username and password but same issue there is no config mode ?

rick 1002 Local Config Enabled No Never N/A Dis No 5

Re: unable go to configuration mode on asa

Aref Alsouqi — Sat, 14 Nov 2020 19:21:52 GMT

You seem to have FTD installed on your ASA hardware. If that is the case, then you can't apply anymore any command on the box through the Lina/ASA console. Also, please note that 3des is deprecated and should not be used anymore. Your licenses to the FTD appliance should be applied through your Cisco smart account.

Re: unable go to configuration mode on asa

Marvin Rhoads — Sun, 15 Nov 2020 12:04:45 GMT

You are running Firepower Threat Defense (FTD) image version 6.5.0. That is not the ASA image.

An ASA 3DES-AES license does not apply to an appliance running FTD (whether it is ASA or Firepower hardware).

Additionally, FTD does not have a "config" command mode like ASA software does. There are a very few commands you can enter with the configuration keyword (and licensing is not among them).

Re: unable go to configuration mode on asa

amralrazzaz — Tue, 05 Jan 2021 14:11:26 GMT

I have a problem with deploying any changes to my ASA5516-X and this happen suddenly and cant change the configurations or do any changes ?? how to solve this ?

I have below weird msg when im trying to login to asa using ssh

Last login: Tue Jan 5 13:53:29 UTC 2021 from 10.246.14.222 on pts/0

Copyright 2004-2019, Cisco and/or its affiliates. All rights reserved.
Cisco is a registered trademark of Cisco Systems, Inc.
All other trademarks are property of their respective owners.

Cisco Fire Linux OS v6.5.0 (build 4)
Cisco ASA5516-X Threat Defense v6.5.0 (build 115)

You have logged in while system startup is in progress. Please wait, some feature may be unavailable until startup is complete.

GCAI01-Firepower# show version
---------------[ EGCAI01-Firepower ]----------------
Model : Cisco ASA5516-X Threat Defense (75) Version 6.5.0 (Build 115)
UUID : 2edfecc2-e0fc-11ea-8172-ea9e617e90fb
Rules update version : 2019-08-12-001-vrt
VDB version : 309
----------------------------------------------------

another thing maybe it help:

i cant configure new local use with below error :

> configure user add munir config
Enter new password for user munir:
Confirm new password for user munir:
Couldn't connect to DB at /ngfw/usr/local/sf/lib/perl/5.10.1/SF/Permission.pm line 710.

Printing stack trace:
called from /ngfw/usr/local/sf/lib/perl/5.10.1/SF/Permission.pm (710)
called from /usr/local/sf/bin/cli_usrmgr (322)
called from /usr/local/sf/bin/cli_usrmgr (781)

Re: unable go to configuration mode on asa

Rob Ingram — Tue, 05 Jan 2021 14:09:43 GMT

Hi @amralrazzaz

The error messages indicates the services haven't finished starting, how long have you waited?

Regardless, the FTD is configured via the WebGUI. Have you logged into FDM to apply the configuration change?

HTH

Re: unable go to configuration mode on asa

amralrazzaz — Tue, 05 Jan 2021 14:18:26 GMT

@Rob Ingram hi

i was rebooting the asa device and waiting for now 30 mins and then same issue ?

i can access to FTD with admin account but no changes can be applied !!

any changes said ( Last Deployment Failed ) --- check attached

Rob Ingram

Re: unable go to configuration mode on asa

Rob Ingram — Tue, 05 Jan 2021 14:25:30 GMT

Unfortunately that screenshot doesn't provide much information, what does the see details button reveal as to the cause of the issue?

FYI, you appear to be running 6.5.0, you might want to consider upgrading to the latest 6.5 patch 4 or upgrading to 6.6.1 which is the gold star recommended version.

Re: unable go to configuration mode on asa

amralrazzaz — Tue, 05 Jan 2021 14:34:05 GMT

PLEASE check the attached showing more details?

and also why this happen to my asa ?! im just bought it since only 5 months or less and if i dont wanna go with the upgrade option ? what shall i do ? is there any solution without upgrading ?

also can cause this issue?

and why i cant create local user ? or delete existing one ? maybe if i delete the user and recreate again issue with gone or something?? actually i don't know !!

Re: unable go to configuration mode on asa

Rob Ingram — Tue, 05 Jan 2021 14:44:55 GMT

That still doesn't provide any useful information, click > this should expand and provide more information and clue as to the issue.

6.5.0 is the first version of that FTD release, there are a lot of bugs that would have been resolved in the subsequent patches - your issue may or may not be resolvable with an upgrade, but patching would at least keep the FTD up to date.

All management is performed via the WebGUI, changes are not related to a specific user, so I doubt creating a new user will resolve the issue. The exact error would be displayed when you push the policy.

Re: unable go to configuration mode on asa

amralrazzaz — Tue, 05 Jan 2021 15:07:57 GMT

please check this attached pic as per ur request hope it can be useful

if the upgrade could not solve the issue 100% , so is there any possible way to solve issue without upgrading ?

how to upgrade and from where to download the recommended version? its paid or i have to pay for the new release? or i have to open TAC CASE asking for sending me the new patch ?

also i hope that we can solve this issue without upgrade ? shall i remove the power cable totally form ASA and back again or shall i wait like 24 hours after rebooting BECUASE OF THIS MSG APPEARS TO ME (You have logged in while system startup is in progress. Please wait, some featur e may be unavailable until startup is complete.)
? actually dont know why its happened?? we paid a lot or money to face this kind of issues ???!!! ha

Re: unable go to configuration mode on asa

Rob Ingram — Tue, 05 Jan 2021 15:39:48 GMT

I see the error snort generation to sqlite failed but I am not sure how to resolve this. You may want to log a call with TAC to help you troubleshoot. They may well advise to upgrade to the latest patch...

You can download the patch via the cisco website, assuming you have rights.

https://software.cisco.com/download/home/286285782/type/286306337/release/6.5.0.4

Re: unable go to configuration mode on asa

amralrazzaz — Tue, 05 Jan 2021 16:51:29 GMT

regarding the patch version which one to use ?

for the link that u shared is Release 6.5.0.4 and the suggested release is 6.6.1 ? so which best one to use?

and i found many versions from 6.6.1 so which one to use ?:

Firepower Threat Defense upgrade
Do not untar

Cisco_FTD_Upgrade-6.6.1-91.sh.REL.tar

16-Sep-2020

1246.50 MB

Firepower Threat Defense install package

ftd-6.6.1-91.pkg

16-Sep-2020

1125.04 MB

Firepower Threat Defense boot image

ftd-boot-9.14.1.150.lfbff

and also how to save the current configurations on ASA before upgrade?

or no need and the upgarde will not lose the configurations and installed license?

need steps of upgrading my FTD GUI ?

Re: unable go to configuration mode on asa

Rob Ingram — Tue, 05 Jan 2021 16:56:26 GMT

You are currently running 6.5, so 6.5.0.4 is the latest patch for that major version. 6.6 is a new major version, which includes new features. It's upto you which to go for, but 6.6.1 is the latest gold star recommended version by cisco, so perhaps upgrade to 6.6.1

You would use the Firepower Threat Defense upgrade file. Download the file and upload via FDM in the Updates section.

In the GUI you have the option to run a backup, so take a backup and then download the backup file to your computer. If required you can restore from this file. If you perform an upgrade it should not lose your configuration.

Re: unable go to configuration mode on asa

amralrazzaz — Wed, 06 Jan 2021 00:15:34 GMT

unfortunately i also cant take backup from ASA please check the pic attached

the backup file not appear in the table. and i cant then download the backup copy to my system!!!

and also i dont know if i dont have luck to get the backup so can i start upgrading the version and then ill be forced after to reconfigure from scratch !!!

whats ur recommendations ?

thanks

Re: unable go to configuration mode on asa

Rob Ingram — Wed, 06 Jan 2021 08:02:01 GMT

@amralrazzaz it doesn't seem like you can do much! Log a call with TAC to help you further