topic Re: Running Configuration from FTD showing old and obsolete firewall r in Network Security

Running Configuration from FTD showing old and obsolete firewall rules

systems100 — Wed, 29 Sep 2021 08:57:51 GMT

Dear All,

Kindly assist,

Am generated running config from cisco FTD cli, but then it displayed old and obsolete firewall rules and not the rules currently on it which i deployed via Cisco FMC.

Is there anyway to generate the current running config from Cisco FMC or via another mode on the Cisco FTD?

I will appreciate a prompt response.

Re: Running Configuration from FTD showing old and obsolete firewall r

balaji.bandi — Wed, 29 Sep 2021 09:55:21 GMT

From FMC, Devices, select the device, From General click Get device config as mentioned below.

Re: Running Configuration from FTD showing old and obsolete firewall r

systems100 — Wed, 29 Sep 2021 10:35:21 GMT

Hi Balaji,

Many thanks.

However clicking on the Get device config, am not still able to get the device configuration itself, rather it is trying to get the configuration from another device to the device.

What else do you suggest i do?

Re: Running Configuration from FTD showing old and obsolete firewall r

balaji.bandi — Wed, 29 Sep 2021 11:24:27 GMT

Did your FMC manage many FTD devices ? make sure you select the correct device to get config.

Re: Running Configuration from FTD showing old and obsolete firewall r

Oliver Kaiser — Wed, 29 Sep 2021 17:47:37 GMT

Just to clarify - You edited your accesspolicy, pushed the changes via deployment to your firewall, but when you directly connect to your firewall via SSH after the deployment is done you do not see the correct configuration on there?

Can you verify that

a. Your accesspolicy is assigned to the firewall in question

b. Your deployment was successful (and that the deployment transcript includes the changes to your accesspolicy

c. State of configuration via SSH using > show access-control-config (you may use /<your-firewall-rule> to search the output

If your deployment was successful and you see the changes in the transcript but not on the device itself I'd suggest opening a TAC Case. Using https://bst.cloudapps.cisco.com/bugsearch or https://www.cisco.com/c/en/us/support/security/defense-center/products-release-notes-list.html you may also search for open/fixed caveats that might match your problem