topic Re: Can not see incoming connection events in FMC in Network Security

Can not see incoming connection events in FMC

zmutlu — Fri, 09 Jun 2023 08:56:29 GMT

Hello,

I` am using FMC 7.0.5, connected Firepower 1120.

Test PC connected to Inside port of Firepower IPS, Outside port watching to the Internet, policy (logging configured) and routing configured. I can connect from the Internet to Test PC which is inside network, but I can not see any incoming connections In Analysis-Connections-Events and when I' am trying to ping 8.8.8.8 From Test PC which is inside this information is available in Connection Events and Intrusion Events menu.

Could you please navigate me, what do I have to check to see incoming events?

Thank you.

Re: Can not see incoming connection events in FMC

Rob Ingram — Fri, 09 Jun 2023 09:21:38 GMT

@zmutlu I assume you've enabled logging on all the rules you've configured?

From the CLI of the FTD run the command, system support firewall-engine-debug filter on your test PC IP address, generate traffic to confirm traffic is routed through the FTD and which rule the traffic matched.

Re: Can not see incoming connection events in FMC

MHM Cisco World — Fri, 09 Jun 2023 09:28:38 GMT

did you success register the FTD into FMC ?

Re: Can not see incoming connection events in FMC

zmutlu — Fri, 09 Jun 2023 09:28:44 GMT

@Rob Ingram I did that you propose to confirm traffic is routed through the FTD, yes, I can see traffic between on FTD.

Logging is on.

Re: Can not see incoming connection events in FMC

zmutlu — Fri, 09 Jun 2023 09:31:54 GMT

FTD registered in FMC successfully.

Re: Can not see incoming connection events in FMC

MHM Cisco World — Fri, 09 Jun 2023 09:35:35 GMT

> sftunnel-status

can you share this

Re: Can not see incoming connection events in FMC

zmutlu — Fri, 09 Jun 2023 09:39:32 GMT

You need all of the info or exact info, for example PEER INFO, RUN STATUS?

Re: Can not see incoming connection events in FMC

zmutlu — Fri, 09 Jun 2023 09:51:57 GMT

Here is info in attached file.

Re: Can not see incoming connection events in FMC

MHM Cisco World — Fri, 09 Jun 2023 10:06:55 GMT

only peer INFO

Re: Can not see incoming connection events in FMC

MHM Cisco World — Fri, 09 Jun 2023 10:09:28 GMT

sw_version 7.0.5
	sw_build 72
	Management Interfaces: 1
	eth0 (control events) 00.00.00.00,
	Peer channel Channel-A is valid  type (CONTROL), using 'managemen', connected to '00.00.00.00' via '00.00.00.00'
	Peer channel Channel-B is valid  type (EVENT), using 'managemen', connected to '00.00.00.00' via '00.00.00.00'

You are not register this FW to FMC
the IP is not appear!!!

Re: Can not see incoming connection events in FMC

zmutlu — Fri, 09 Jun 2023 10:13:40 GMT

I removed original IP with 00.00.00.00

Re: Can not see incoming connection events in FMC

MHM Cisco World — Fri, 09 Jun 2023 10:24:12 GMT

OK I get it
now show time in FTD and check the time in FMC are both same ?

Re: Can not see incoming connection events in FMC

zmutlu — Fri, 09 Jun 2023 10:31:24 GMT

Yes, time is the same on both.

Re: Can not see incoming connection events in FMC

MHM Cisco World — Fri, 09 Jun 2023 10:49:20 GMT

security intelligence event <<- can check this see if traffic is BLK by any security policy

Re: Can not see incoming connection events in FMC

zmutlu — Fri, 09 Jun 2023 10:52:17 GMT

There are no records at all.

Re: Can not see incoming connection events in FMC

MHM Cisco World — Fri, 09 Jun 2023 11:12:29 GMT

https://community.cisco.com/t5/network-security/security-intelligence-events-table-is-empty-on-fmc/td-p/3092339

Check this

Re: Can not see incoming connection events in FMC

zmutlu — Fri, 09 Jun 2023 12:14:26 GMT

I`ve checked the link you`ve sent, added categories as shown there, deployed configuration to FTD. After created traffic to Test PC and from it, still no any records in Security Intelligence Events.

Re: Can not see incoming connection events in FMC

Marius Gunnerud — Fri, 09 Jun 2023 16:52:06 GMT

We have had several instances where this issue has presented itself. We fixed this by upgrading the FMC and subsequently FTD to a newer version (I would suggest the starred version listed in the downloads page on cisco.com)

Re: Can not see incoming connection events in FMC

ermiasnegash — Tue, 21 Nov 2023 18:33:14 GMT

we have fmc at 7.2.5 and ftd at 7.0.4 version. Do we need upgrade we face similar issue here

Re: Can not see incoming connection events in FMC

Marvin Rhoads — Wed, 22 Nov 2023 13:22:23 GMT

There's no issue managing FTD 7.0.4 with FMC 7.2.5 - they are quite compatible.Sometimes upgrades fix broken processes and cuase the issue to resolve "magically". However, this problem (assuming you have a registered device with ACP events properly set to log to FMC) usually is a result of some sort of database or process error. As such, it is best to troubleshoot it with the assistance of Cisco TAC.