topic Re: FirePower User Agent v2.3 build 10 in Network Security

FirePower User Agent v2.3 build 10

Gabrielm1 — Wed, 01 May 2019 16:55:11 GMT

My User agent failed a week or so ago and had to move it off of our Domain Controller.

I am currently running Cisco Firepower Management Center for VMWare version 6.2.3.12. I installed the user agent on a 2012 r2 server. I have a connection with my Active Directory server and I can see user events in the agent log tab:

[2329] - Real Time Event Received - 5/1/2019 7:54:44 AM,AbcdefG,xxx.xxx.xxx.xxx,interactive

I have configured the IP of the server that is running the agent in the FMC - System - Integration - Identity Sources - User Agent and the FMC Health Monitor is showing green status on the user agent status monitor.

When I add the FMC IP address or the DNS name I get an unavailable status. I checked the communication between the user agent and the FMC and it shows connectivity via port 3306:

23:11:10.442517 IP xxx.org.50095 > xxx.org.3306: Flags [.], ack 1, win 513, length 0

Looking at the logs from the user agent I get this error:

[2201] - Report login information from xxx.xxx.xxx.xxx to xxx.xxx.xxx.xxx failed after 5/1/2019 7:45:04 AM. [The host xxx.xxx.xxx.xxx does not support SSL connections.].

Is there an SSL configuration on the FMC that I am missing that allows the user agent and FMC to transfer user activity to the FMC?

Has there been a change in the FMC versions that made the Active Directory User Activity require an SSL connection?

Thanks for any assistance regarding this problem.

Re: FirePower User Agent v2.3 build 10

Marvin Rhoads — Thu, 02 May 2019 02:45:38 GMT

Have you checked the certificate and its expiry status on your FMC?

Re: FirePower User Agent v2.3 build 10

Gabrielm1 — Thu, 02 May 2019 15:17:02 GMT

It has a self signed cert good till 2038...

Current HTTPS Server Certificate
Subject
commonName
firepower

countryName
US

organizationName
Cisco Systems, Inc

organizationalUnitName
Intrusion Management System
Issuer
commonName
firepower

countryName
US

organizationName
Cisco Systems, Inc

organizationalUnitName
Intrusion Management System
Validity
Not Before
May 8 17:35:46 2018 GMT

Not After
May 8 17:35:46 2038 GMT
Version 3
Serial Number XXXXXXXXXXXXXXXXX
Signature Algorithm sha256WithRSAEncryption

Thanks, at least I have something to look into...

Re: FirePower User Agent v2.3 build 10

Jon Major — Thu, 23 May 2019 01:17:09 GMT

I literally just got this exact same issue resolved. To confirm you're hitting bug CSCvo83842 run the following from the FMC's CLI.

mysql -uroot -padmin

mysql> show variables like '%ssl';

If you get:

+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| have_openssl | NO |
| have_ssl | NO |
+---------------+-------+
2 rows in set (0.00 sec)

Then you're impacted by that bug, simple resolution though. All I did was upgrade to 6.2.3.13 and it was resolved.

Re: FirePower User Agent v2.3 build 10

Gabrielm1 — Thu, 23 May 2019 17:19:11 GMT

This is my response from the command.

Re: FirePower User Agent v2.3 build 10

Gabrielm1 — Thu, 23 May 2019 17:20:04 GMT

the attached file is the error I get when I import the cert. What are the commands to import from CLI?

Re: FirePower User Agent v2.3 build 10

Jon Major — Thu, 23 May 2019 18:37:20 GMT

Yikes, and the UA is still giving you SSL errors in the logs? FYI there is
a new UA out, v2.4. Might be worth giving that a shot as well.

Re: FirePower User Agent v2.3 build 10

Gabrielm1 — Thu, 23 May 2019 20:40:31 GMT

Looks like I'm dealing with 2 issues. User agent is working fine now. The problem I'm having is importing my CA cert. Looks like the only answer is have TAC take a look at it.

Thanks for everyone's help...

Re: FirePower User Agent v2.3 build 10

Marvin Rhoads — Fri, 24 May 2019 02:05:18 GMT

@Jon Major Thanks for the heads up on Version 2.4.

There are no release notes just yet; but I see in the configuration guide that it is recommended for FMC 6.2.3 or later:

https://www.cisco.com/c/en/us/td/docs/security/firesight/user-agent/24/config-guide/Firepower-User-Agent-Configuration-Guide-v2-4/Intro.html

Re: FirePower User Agent v2.3 build 10

Jon Major — Fri, 24 May 2019 14:31:20 GMT

Yeah, I just caught it randomly as I was downloading the UA for an
unrelated task. I normally pause to appreciate Cisco hasn't bothered
updating this since 2015 and when I say 'May 2019' I got super excited lol.
It looks exactly the same, seems to function the same. At the end of the
day, I'm sure they would still rather you use ISE with PxGrid lol.

Re: FirePower User Agent v2.3 build 10

Gabrielm1 — Fri, 24 May 2019 15:13:37 GMT

UA 2.2 is working, I was running 2.4 and was not connecting to my FMC so I backed up to 2.2. Of course that didn't help because the issue was with the version of FMC. Once I upgraded to the latest FMC it started communicating. Services are back up.

Now I have to resolve my https cert import. Never ending. Job security right?

Re: FirePower User Agent v2.3 build 10

Jon Major — Fri, 24 May 2019 18:00:20 GMT

All of the job security :-).

For HTTPS cert, is that for the FMC management UI or are you looking to
import an Identity Cert for the FTD (for AnyConnect)?

Re: FirePower User Agent v2.3 build 10

Gabrielm1 — Fri, 24 May 2019 20:34:28 GMT

It's just for GUI management of FMC. Was able to update 10 other servers, but FMC is throwing a fit...

Re: FirePower User Agent v2.3 build 10

Marvin Rhoads — Sat, 25 May 2019 01:37:06 GMT

The "Basic constraints..." error usually has to do with the certificate template used by the issuing CA. Is this from an internal CA?

Re: FirePower User Agent v2.3 build 10

Jon Major — Tue, 28 May 2019 15:40:46 GMT

Marvin's absolutely right (as Marvins are want to be). If you're using a Microsoft CA, I normally duplicate the Web Server template, update the compatibility, enable basic constraints, and mark it as critical. No doubt there is another way to do it, but that way seems to work fine. After that (and adding the new template to my CA to be issued) the FMC imports it just fine. Of note, the GUI doesn't seem to generate a CSR that includes SAN names, so I tend to use Digi Cert's CSR generation utility.

@Gabrielm1

Re: FirePower User Agent v2.3 build 10

Gabrielm1 — Tue, 28 May 2019 14:43:29 GMT

Yes, it's an internal CA signed by digicert.

You have documentation on how to create the template for the CA to import the cert into the FMC without the contraint error?

Re: FirePower User Agent v2.3 build 10

Jon Major — Tue, 28 May 2019 15:40:13 GMT

@Gabrielm1 wrote:
Yes, it's an internal CA signed by digicert.

You have documentation on how to create the template for the CA to import the cert into the FMC without the contraint error?

See my last reply with screenshots.

Re: FirePower User Agent v2.3 build 10

Gabrielm1 — Tue, 28 May 2019 16:12:29 GMT

Got it, didn't see the second page of the thread. Appreciate it...

Re: FirePower User Agent v2.3 build 10

Gabrielm1 — Mon, 10 Jun 2019 14:48:04 GMT

Thanks for everyone's help. I was able to Import our latest CA Cert. Good for 2 years 😉 I've added a work plan I created to rinse and repeat in 2021.

Thanks again