topic Is unregistered FTD still functional? in Network Security

Is unregistered FTD still functional?

h.dam — Thu, 24 Feb 2022 15:52:50 GMT

Hello all,

We have a FTD A/P pair registered after purchase. They are working well until last month. They have lost the licenses without reason and became unregistered.

This is the first time I met after more than ten years pratices on Cisco devices.

I'd like to know the following if you guys can help me:

1/ What are the potential causes to make them lost?

2/ If the FTD are unregistered, can they continue to work as before, eg. to permit/deny traffic flow according to the policy? (I noticed that I cannot apply changes)

Thank you very much.

Re: Is unregistered FTD still functional?

Marvin Rhoads — Thu, 24 Feb 2022 15:57:44 GMT

You may be affected by this field notice:

https://www.cisco.com/c/en/us/support/docs/field-notices/721/fn72103.html

As you noticed, policy changes are not allowed without any license. Existing Access Control Policies will continue to work.

Re: Is unregistered FTD still functional?

h.dam — Thu, 24 Feb 2022 21:00:05 GMT

Hello Marvin,

Thank you very much for the document.

My FTDs are v7.0.1.But I didn't find this version in the document.

As I understood, there are two solutions. 1/ software upgrade 2/ import the IdenTrust Commercial CA certificate

In my case, which solution do I need to do?

Regards

Re: Is unregistered FTD still functional?

Marvin Rhoads — Fri, 25 Feb 2022 08:18:48 GMT

I've found that even if you have 7.0.1 you may still need to "remove the certificate file at /etc/sf/gch/call_home_ca and restart the Smart Licensing Agent (sla) process to resume communications with Cisco Smart Software Manager (CSSM)".

Please refer to the field notice that I linked earlier for the step-by-step instructions.

Re: Is unregistered FTD still functional?

h.dam — Fri, 25 Feb 2022 15:00:36 GMT

Thank you very much.

Regards