topic ASA SFR module health modules disabled in Network Security

ASA SFR module health modules disabled

tato386 — Sun, 10 Mar 2024 18:07:54 GMT

I just upgraded my FMCv from 7.2.5.1 to 7.4.1. I have two FTDs and two SFR modules being managed. After the FMC upgrade one of the SFR devices show *all* health modules as being disabled. It uses the same health policy as the "good" SFR and I can't find any individual setting on FMC or the SFR that would cause this. Also note that the SFR module shows as online and managed in the FMC. It appears to be only a health model or service related problem. I have included a pic of the status. Any ideas?

Thanks,

Diego

Re: ASA SFR module health modules disabled

Mark Elsen — Sun, 10 Mar 2024 17:56:34 GMT

= FYI : https://community.cisco.com/t5/network-security/asa-firepower-module-down/m-p/4662139#M1092339
(there is no included pic)

Re: ASA SFR module health modules disabled

tato386 — Sun, 10 Mar 2024 18:09:16 GMT

@Mark Elsen that post is interesting, but this is not a failover pair, just two individual ASA/SFR devices. I have uploaded pic. Thanks!

Re: ASA SFR module health modules disabled

Marius Gunnerud — Sun, 10 Mar 2024 20:48:50 GMT

Have you verified that the SF tunnel is up and active? In expert mode on the SFR module and / or the FMC issue the following commands:

pmtool status | grep -i down

pmtool status | grep -i sftunn

Re: ASA SFR module health modules disabled

tato386 — Sun, 10 Mar 2024 21:31:36 GMT

sftunnel appears to be normal:

root@sfr17-2:~# pmtool status | grep -i down
root@sfr17-2:~#

root@sfr17-2:~# pmtool status | grep -i sftunn
sftunnel (system) - Running 2178
Command: /usr/local/sf/bin/sftunnel -d -f /etc/sf/sftunnel.conf
PID File: /var/sf/run/sftunnel.pid
Enable File: /etc/sf/sftunnel.conf
Command: /usr/local/sf/bin/sfmgr -d -f /etc/sf/sftunnel.conf
Enable File: /etc/sf/sftunnel.conf
Requires: sftunnel
Command: /usr/local/sf/bin/sfmbservice -d -f /etc/sf/sftunnel.conf
Enable File: /etc/sf/sftunnel.conf
Requires: sfmb,sftunnel
Requires: sftunnel

Re: ASA SFR module health modules disabled

Marius Gunnerud — Sun, 10 Mar 2024 21:47:42 GMT

Have you tried restarting the sfr module? What about reloading the ASA?

sw-module module sfr restart

Re: ASA SFR module health modules disabled

tato386 — Mon, 11 Mar 2024 12:48:55 GMT

yes, I restarted both several times and I was also able to upgrade the sfr from 7.0.6 to 7.0.6.1 so there is no doubt the FMC/SFR relationship is fine. problem seems specific to health module or processes.

Re: ASA SFR module health modules disabled

Marius Gunnerud — Mon, 11 Mar 2024 13:36:08 GMT

This sounds like something is hanging either on the SFR or on the FMC, have also tried restarting the FMC?

What about creating a new Health policy and applying it to the SFR module? Settings > Health > Policy

Re: ASA SFR module health modules disabled

tato386 — Mon, 11 Mar 2024 14:31:42 GMT

no change after restart of the FMC. This SFR was using its own unique policy and one of the first things I did was to use the policy from the other SFR (which shows normal) and that didn't make any difference either. this one definitely has me scratching my head...

Re: ASA SFR module health modules disabled

Marius Gunnerud — Tue, 12 Mar 2024 07:33:41 GMT

Please run the following commands in expert mode on the SFR module and on the FMC (for comparison).

pmtool status | grep Waiting

Re: ASA SFR module health modules disabled

tato386 — Tue, 12 Mar 2024 20:15:45 GMT

# pmtool status | grep Waiting
threatcorrelator (normal) - Waiting
beakerd (system) - Waiting
stunnel (normal) - Waiting
httpsd (system,gui) - Waiting
idhttpsd (system,gui) - Waiting
sfipmid (normal) - Waiting
sfestreamer (normal) - Waiting
snmpd (normal) - Waiting
adi_proxy (normal) - Waiting
UIMP (normal) - Waiting
hmlsd (normal) - Waiting
CloudAgent (system) - Waiting
UEChanneld (normal) - Waiting
ui_archiver (normal) - Waiting
eventserver (normal) - Waiting
eventserver2 (normal) - Waiting
mojo_server (system,gui) - Waiting
memcached (normal) - Waiting