topic Hello Sir, in Network Security

How to updates latest patch in Cisco Firepower Management Center 1000

sohel.jujara — Sun, 10 Mar 2019 13:51:12 GMT

Hello,

Any one please share step for How to updates latest patch in Cisco Firepower Management Center 1000.

and ASDM is not working when i take access my Cisco Firepower Management Center.

Regards,

Please read through the guide

Marvin Rhoads — Sat, 03 Jun 2017 08:14:17 GMT

Please read through the guide I linked in your other post.

You need to review them and perhaps labminutes.com or Cisco Live presentations on FirePOWER deployment.

ASDM is for ASA management. FirePOWER 1000 is a management appliance with its own web server GUI built-in. It is upgraded via that web interface by following the steps in the release notes and other guides I posted earlier.

Hello Sir,

sohel.jujara — Thu, 08 Jun 2017 09:27:47 GMT

Hello Sir,

I have updated the versions but i am getting some error while take access to Cisco ASA5516 throw ASDM.

PLease find attched error screenshot.....

If your ASDM is telling you

Marvin Rhoads — Thu, 08 Jun 2017 10:00:11 GMT

If your ASDM is telling you that, then either do as it instructs or else upgrade your local Java to the current version.

More troubling though is that you must not have setup the FirePOWER module for FMC management.

A given module is managed by either FMC or ASDM - never both.

If you follow the Quick Start Guide, it tells you when setting up the FirePOWER module to "configure manager add" as described here:

http://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/sfr/firepower-qsg.html#pgfId-139815

Once you do that (and add the device in the manager as well) it will register as externally managed and ASDM will only show the high level module status (and not have to communicate with the module via https which is why you got that error). All FirePOWER policies and events will be created on, deployed from and seen at the FMC.

Hello,

sohel.jujara — Fri, 09 Jun 2017 07:28:17 GMT

Hello,

After installed Java same issue we are facing,

Please help to how to resolved the issue...

I had said the more important

Marvin Rhoads — Fri, 09 Jun 2017 07:34:14 GMT

I had said the more important thing is to setup your module for managment by the FirePOWER 1000.

Have you done that? If not, why not?

Hi Marvin,

sohel.jujara — Fri, 09 Jun 2017 09:09:10 GMT

Hi Marvin,

thanks for your [rompt resposnse ,

Please share the steps to add the firepower module to FMC 1000 , It would be great if can confirm the port to be opened between FMC and Firepower .

Regards

Sachin

Please read the Quick Start

Marvin Rhoads — Fri, 09 Jun 2017 09:14:45 GMT

Please read the Quick Start Guide that I posted earlier in this discussion to add your module to the FMC.

http://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/sfr/firepower-qsg.html#pgfId-139815

The communications between the module and the management center occurs via tcp/8305 and if there are any ACLs they must allow the communications to be initiated in both directions.

http://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/security_internet_access_and_communication_ports.html#ID-2202-000000dc

Hello,

sohel.jujara — Sat, 10 Jun 2017 09:54:03 GMT

Hello,

Thanks a lot, Finally i have upgraded my Firepower manager and also upgraded firepower module with ASA.

After that i have sync my ASA Firepower module with my Firepower manager.

Now Can you please confirm and guide us, How FMC will automatically take and updates license, Rules, Patches, Signatures….?

How can we configure throw GUI base…?

Please refer to the

Marvin Rhoads — Sat, 10 Jun 2017 18:14:36 GMT

Please refer to the configuration guide which I linked earler. It has a whole section just on updates:

http://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/system_software_updates.html

There are step by step instructions there and it is all via the GUI.

thanks for your Prompt

sohel.jujara — Thu, 15 Jun 2017 08:12:14 GMT

thanks for your Prompt resposnse.

Firepower module has been installed and sync on FMC. but we are getting one error ‘’ Interface 'DataPlaneInterface0' is not receiving any packets ‘’

So Please guide me what is Data Plan Interface0 and how to resolved the error.

Please find attached error screenshot....

DataPlaneInterface0 is the

Marvin Rhoads — Thu, 15 Jun 2017 09:10:29 GMT

DataPlaneInterface0 is the internal connection between an ASA and its FirePOWER module.

We most commonly see that error in two cases:

1. If the steps to "Configure the ASA Security Policy" (as directed in the quick start guide linked earlier) are not followed. Unless that is done, the module receives no traffic and the alert results.

2. In an HA pair the Standby unit will not be passing traffic through its interfaces. This case is normal and requires no action.

Hello Marvin,

sohel.jujara — Wed, 21 Jun 2017 13:13:22 GMT

Hello Marvin,

Thanks for your promt support....

Please help with the license detail required with FMC 1000 to manage IPS services of NGFirepower .

is there any separate license required for FMC 1000 to manage the IPS or by default came with the hardware.

Regards

Sachin

The FMC 1000 itself has a

Marvin Rhoads — Wed, 21 Jun 2017 13:17:50 GMT

The FMC 1000 itself has a right-to-use license (i.e. no PAK or license file needed).

Any devices you manage with it require their own licenses (Control+Protect, URL, Malware) to be added to the FMC 1000. For that you use the license page on the FMC 1000 GUI to get the key and then combine it with the device license PAK on the Cisco licensing portal to get a license file. The content of that file is then pasted into the licensing page.

Once you have the device licenses there you assign them to your registered devices via the Device Management page in FMC.

Re: The FMC 1000 itself has a

walter baziuk — Tue, 30 Jan 2018 14:42:30 GMT

The ASA update process is very buggy and needs a redesign. each step is very version focused and needs a re-loook IMHO

my FMC is 6.2.2

TAC sent me an SFO conversion file to migrate to FTD

it was run on a 6.2.2.1 VM

my FMC VM reject this version as being incompatible.

i'm trying to update the FMC to 6.2.2.1 and am stuck.

i have the .SH patches, but the FMC vm does not accept them

the cisco document is NOT clear on how to apply the .SH patch

please advise

Re: The FMC 1000 itself has a

Marvin Rhoads — Tue, 30 Jan 2018 15:44:56 GMT

If you are running FMC and check for updates from the GUI, it should detect and download the correct 6.2.2.1 patch for FMC. (More major upgrades (such as 6.1 to 6.2) need to be downloaded manually.)

In case of doubt, the correct file would be "Sourcefire_3D_Defense_Center_S3_Patch-6.2.2.1-73.sh.REL.tar". You can see it here:

https://software.cisco.com/download/release.html?mdfid=286259687&softwareid=286271056&release=TSAgent-1.2&relind=AVAILABLE&rellifecycle=&reltype=latest

Re: The FMC 1000 itself has a

walter baziuk — Tue, 30 Jan 2018 15:49:06 GMT

does 6.2.2.1 address this serious issue raised by CERT?

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1

Re: The FMC 1000 itself has a

Marvin Rhoads — Tue, 30 Jan 2018 15:56:40 GMT

No.

If you have a Firepower module in an ASA then the vulnerability requires an ASA patch.

If you have an FTD device, you will need one of the 6.2.2.2 hotfixes noted below. They aren't out just yet (as of 29 January 2018) but should be released shortly.

Cisco_FTD_Hotfix_AB-6.2.2.2-4.sh.REL.tar (All FTD hardware platforms except 21xx)
Cisco_FTD_SSP_FP2K_Hotfix_AC-6.2.2.2-6.sh.REL.tar (21xx FTD hardware platform)

Also note the vulnerability only applies if you are using the webvpn feature (i.e. remote access SSL VPN).

Re: The FMC 1000 itself has a

Rahul Govindan — Tue, 30 Jan 2018 16:00:24 GMT

The hotfix was released a few hours ago (at least for the 4100 devices). I ran through the hotfix install on the FMC for one of my customers without issues.

Re: The FMC 1000 itself has a

walter baziuk — Wed, 31 Jan 2018 14:26:36 GMT

The FMC is at V 6.2.2. The TAC SFO file is at 6.2.2.1. That is need to migrate to FTD

FMC fails the upload as the versions are not the same (;

The latest S3 6.2.2.1 hotfix patch fails in both GUI auto update and manual application

The Rules and GEO updates all work

TAC case opened no, resolution yet

screen shouts attached

Any help would be very appreciated and i will pass onto TAC