topic "No DC Configured" simply in Network Security

Cisco ASA 5506-X with FirePOWER fails to login.

michael — Sun, 10 Mar 2019 13:50:42 GMT

Hi... I performed the following upgraded to the ASA FirePower (module) application and it seems the ASDM Launcher stuck at 28% into authentication. Below are the two patch files I used for the upgrade. The pre-install completed successfully however when uploading the sensor patch I lost connectivity to the sourcefire.

found this dc address not configured...... any thoughts ?

Card Type: FirePOWER Services Software Module

Model: ASA5506

Hardware version: N/A

Serial Number: JAD2032043V

Firmware version: N/A

Software version: 5.4.1-211

MAC Address Range: - deleted 🙂

App. name: ASA FirePOWER

App. Status: Up

App. Status Desc: Normal Operation

App. version: 5.4.1-211

Data Plane Status: Up

Console session: Ready

Status: Up

DC addr: No DC Configured

Mgmt IP addr: 192.168.1.2

Mgmt Network mask: 255.255.255.0

Mgmt Gateway: 192.168.1.1

Mgmt web ports: 443

Mgmt TLS enabled: true

Cisco_Network_Sensor_6.0.0_Pre-install-5.4.1.999-1.sh

Cisco_Network_Sensor_Upgrade-6.0.0-1005.sh

I'm attaching an image and txt file from the show module sfr log console

Thank you for any help.

Michael

"No DC Configured" simply

Marvin Rhoads — Sun, 21 May 2017 07:45:18 GMT

"No DC Configured" simply means the module is not configured to use a Defense Center (old name for FirePOWER Management Center) and instead use ASDM.

If the module has never been used or has a minimal configuration, I'd skip the upgrade and just re-image it to 6.2 and go from there. You will save yourself a lot of time and headache that way.

Hi Marvin, Thanks for getting

michael — Sun, 21 May 2017 08:21:20 GMT

Hi Marvin, Thanks for getting back to me! You are correct the module has it's default configuration. I did a reset and reload and that brought back everything accept for the no DC Configured issue. I'll will give the reimage a whirl.

However it's been a long time since I worked with CLI. So I was hoping you might have a url to a list of relevant commands. I'm having fun with that [noconfirm] response in correlation to the necessary command line options to finalize the tasks.

Thank you again..

Michael.

You're welcome. Beyond the

Marvin Rhoads — Sun, 21 May 2017 08:51:27 GMT

You're welcome. Beyond the initial setup which is described in the quick start guide, there is very little you ever need to do in the sensor cli.

When troubleshooting, the TAC (and expert users) may change to expert mode to drop into the Linux bash shell and check some files and processes.

Hi Marvin,

michael — Sun, 21 May 2017 15:11:02 GMT

Hi Marvin,

I am assuming there is no simple string of code I can use to input the correct DC address to port?

If you have a FirePOWER

Marvin Rhoads — Sun, 21 May 2017 15:27:20 GMT

If you have a FirePOWER Management Center (aka DC), you can add it from the module's cli via the command:

configure manager add <host address or name> <registration key>

Reference:

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118596-configure-firesight-00.html#anc4

That is exactly what I needed

michael — Sun, 21 May 2017 15:46:15 GMT

That is exactly what I needed... Thank you Marvin!!

Hi Marvin,

michael — Mon, 22 May 2017 06:50:49 GMT

Hi Marvin,

I attached a screenshot of the ASDM CLI asking me to input [confirmation]. Is the "noconfirm" even possible to execute with the ASDM CLI or am I messing up when adding it as a perimeter. Because according to "CLI Book 2: Cisco ASA Series Firewall CLI Configuration Guide, 9.3 " I am not seeing anything that indicates to use SSH to Install or Reimage the Software Module. Am I messing up on the "appropriate noconfirm option? Thank you for any further help or insight on adding the option as the parameter to the command... sw-module module sfr recover boot noconfirm

Result of the command: "sw-module module sfr recover boot noconfirm"

sw-module module sfr recover boot noconfirm
^
ERROR: % Invalid input detected at '^' marker.

Michael

"noconfirm" is not an option

Marvin Rhoads — Mon, 22 May 2017 11:47:38 GMT

"noconfirm" is not an option with the module recovery command. You have to perform that from the actual cli - not via the ASDM cli tool.

The command reference is the best place to confirm things like that. Here's the link to that specific command:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s17.html#pgfId-1608801