topic Re: Module sfr did not respond to session request. in Network Security

Module sfr did not respond to session request.

KRSC — Fri, 21 Feb 2020 16:58:36 GMT

I have few ASA's in my network for which when I try to do session SFR
Iam getting the message :

"Opening command session with module sfr.
Module sfr did not respond to session request."

What could be the reasons for getting the above messages ?
Has the module gone faulty and require any HW replacemet ?
Or
How can I recover this SFR module, can anyone pls help.

Thanks in Advance
KRSC

Re: Module sfr did not respond to session request.

Abheesh Kumar — Tue, 26 Mar 2019 06:49:07 GMT

Hi,
Can you share the output of below command.
sh module sfr details

-Abheesh

Re: Module sfr did not respond to session request.

KRSC — Tue, 26 Mar 2019 07:23:41 GMT

Below is the command output

sh module sfr details
Getting details from the Service Module, please wait...
Unable to read details from module sfr

Card Type: Unknown
Model: N/A
Hardware version: N/A
Serial Number: FCH2154JQ2D
Firmware version: N/A
Software version:
MAC Address Range: 5cd0.2dc6.3a59 to 2cd0.2ab6.5a59
Data Plane Status: Not Applicable
Console session: Ready
Status: Recover

Re: Module sfr did not respond to session request.

Marvin Rhoads — Wed, 27 Mar 2019 03:36:18 GMT

The Firepower service module ("sfr") appears to be in recovery mode for the one you shared the output on. On all ASA models except the 5585-X it is a software-only module and can be completely re-imaged to get it back up and running. You will then need to re-register it to FMC and redeploy policies.

https://community.cisco.com/t5/security-blogs/reimage-firepower-module-in-cisco-5500-x-firewall-models/ba-p/3760395

Note - Be sure to not try to image an ASA 5506-X or 55512-X with version 6.3 software because they don't support it.

Re: Module sfr did not respond to session request.

EngSaidy — Sat, 15 Jun 2019 12:46:45 GMT

Mine is stuck as well in recover mode. However, the ASA model is 5525

Re: Module sfr did not respond to session request.

Marvin Rhoads — Sat, 15 Jun 2019 14:29:07 GMT

@EngSaidy

Can you provide more details of how you arrived in that state and what you've tried to remedy it thus far?

Re: Module sfr did not respond to session request.

EngSaidy — Sun, 16 Jun 2019 10:42:54 GMT

Firstly, I had 6.0.0 SFR already installed. I wanted to upgrade to 6.2.3, so uploaded the asasfr-5500x-boot-6.2.3-4.img to the flash, then downloaded the asasfr-sys-6.2.3-83.pkg to the device, when everything completed, I waited 24 hours, but did not give a good result, it was kept stuck in recover state.

When After 24 hours, I re-imaged the the device with 6.0.0 and downloaded the packages ... It's working perfect.
The bottom line is, I want to upgrade to 6.2.3, how to do so ... please help

Re: Module sfr did not respond to session request.

Marvin Rhoads — Sun, 16 Jun 2019 11:49:48 GMT

If you want to upgrade vs. re-image you should be able to do so by first going to 6.1.0 and then to 6.2.3.

That said, a reimage straight to 6.2.3 should work as well and save some time. I've done numerous and they always worked OK. The module will show as in recovery state when you have the .img but not the .pkg installed. Only after successfully completing the "system install ..." process will the module be fully "up".

Re: Module sfr did not respond to session request.

EngSaidy — Tue, 18 Jun 2019 08:53:20 GMT

Thank you for your reply. In fact, the problem was with ASA software version which was 9.2, when I upgraded to 9.8, the direct re-imaging to 6.2.3 worked.
Previously, The module was booting normally, While I was downloading the SYS package from FTP, some debugs were showing up that the processing is going on. Waited for 24 hours, the process was not completed.

The bottom line is that ASA version upgrading really worked for me.

Re: Module sfr did not respond to session request.

Marvin Rhoads — Tue, 18 Jun 2019 14:21:07 GMT

Ah OK - thanks for the resolution. I did neglect to confirm with you that you were running a compatible ASA version.

FYI the compatibility list can be found here:

https://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html#id_59075

Re: Module sfr did not respond to session request.

seckka21 — Wed, 07 Jul 2021 12:03:50 GMT

Hi i have the same problem .I am using a ASA 5525 but after sw-module module sfr boot the module remains status recovery.can you help me please

Re: Module sfr did not respond to session request.

Marvin Rhoads — Wed, 07 Jul 2021 14:51:56 GMT

@seckka21 please provide more details. For example, your ASA software version and output of "show module sfr detail".

Re: Module sfr did not respond to session request.

seckka21 — Thu, 08 Jul 2021 08:25:36 GMT

Here you are the output of the command and the version

Re: Module sfr did not respond to session request.

Marvin Rhoads — Thu, 08 Jul 2021 13:14:37 GMT

Your ASA is running software version 9.2(2)4. That is not compatible with any current Firepower service module release.

The current recommended Firepower service module release (6.6.4) requires at least ASA 9.5(2). Recommended would be ASA 9.12(4)26 or 9.14(2)15

https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html#id_60529

https://software.cisco.com/download/home/284143129/type/280775065/release/9.14.2%20Interim

Re: Module sfr did not respond to session request.

seckka21 — Thu, 08 Jul 2021 15:26:28 GMT

my fmc has version 6.2.2 if i upgrade the ASA to version 9.5 will it work with the firepower.?

Re: Module sfr did not respond to session request.

Marvin Rhoads — Thu, 08 Jul 2021 15:50:49 GMT

Yes it will work. The compatibility matrix I linked earlier confirms it. But I would not recommend going with the bare minimum release.

The recommended ASA releases 9.12x or 9.14x are fully compatible with Firepower 6.2.2. and, should you decide to move to the recommended Firepower 6.6.4 later, still remain compatible.

Using a recommended ASA release puts you on a better security footing as they are fully patched for current known vulnerabilities.

Re: Module sfr did not respond to session request.

seckka21 — Fri, 09 Jul 2021 08:02:59 GMT

since I have my 6.2.2 FMC which already supervises a 6.2.2 firepower so I cannot go directly to 6.4.0 for the FMC. For the moment, the need is to make the two firepower work first. to version 6.2.2 afterwards I can go to 6.4. I just have one last question is there an intermediate version between version 9.2 and version 9.14 or I can go directly to version 9.14

Re: Module sfr did not respond to session request.

Marvin Rhoads — Fri, 09 Jul 2021 08:41:35 GMT

Your ASA can be upgraded directly from 9.2 to 9.14.

Just be careful of your site-site VPNs (if you have any configured). Some defaults have changed and you may need to specify some things explicitly for the VPNs to come back up.

Re: Module sfr did not respond to session request.

seckka21 — Fri, 09 Jul 2021 08:45:39 GMT

Thanks very much i will try after i come back to you for the results.

Re: Module sfr did not respond to session request.

seckka21 — Tue, 13 Jul 2021 07:11:17 GMT

Hello

I have another problem.I have shutdown the ASA and restart it then the ASDM is no longer reachable.I have done any change help please.