topic Exiting Expert Mode in Network Security

Exiting Expert Mode

tahscolony — Sun, 10 Mar 2019 13:42:43 GMT

Somehow my MC got stuck in Expert mode, and I need to perform an ACL rollback. Some schmo deleted the any any and killed ALL HTTP/SSH access to it,(not me). I logged in via the VM console and got presented with ~$, which is the expert shell, but can't find anywhere how to return to the system command prompt.

The system command prompt

Oliver Kaiser — Wed, 09 Nov 2016 20:08:54 GMT

The system command prompt (sfcli) is only available on sensors as far as I know. You may add a temporary rule to iptables to permit https access, reconfigure your acl via the web ui and everything should work just fine again (your temp rule will be overwritten too, so no need to delete it afterwards).

Just do the following...

sudo su -

iptables -I INPUT -p tcp --dport 443 -j ACCEPT

Then goto FMC UI and configure your acl again.

Mark as helpful if this solved your issue or let me know if you have any additional questions

I did some digging around and

tahscolony — Wed, 09 Nov 2016 20:41:22 GMT

I did some digging around and found it to be regular linux underneath and was able to find that he didn't completely delete all rules, I still had access from our monitoring server and was able to gain GUI there and restore the broken rules.

Try the 'clish' command

Cory Brown — Wed, 09 Nov 2016 21:34:49 GMT