Issue Adding Sourcefire Module to Defence Centre - ASA 5512-X

petenixon — Sun, 10 Mar 2019 13:22:28 GMT

Hi guys,

I'm currently having problems adding an SFR module to defence centre, the error received is not very descriptive (please check connectivity).

I have deployed SFR in my network as follows:

ASA 5512-X HA Active/Standby

interface GigabitEthernet0/1.31
vlan 31
nameif inside-core
security-level 100
ip address 10.31.250.10 255.255.0.0

interface Management0/0
management-only
nameif management
security-level 100
ip address 192.168.224.1 255.255.255.224

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface

Global ACL allowing ip any to any

Layer 3 switch connected to both the management and inside interfaces:

int vlan 900
ip address 192.168.224.3 255.255.255.240

int vlan 31
ip address 10.31.250.20 255.255.0.0

Sourcefire module has been configured to use the layer 3 interface as its default gateway and I can ping from the SFR module to its gateway and the sourcefire server.

Sourcefire server is running 5.3.1 and the module is running 5.3.1-155.

Module has had the manager configured using IP and registration key, which matches on the server. The server also has the correct number of licenses installed.

I would really appreciate any assistance on this as I really can't see where the problem might be, the last thing I need to try is to disable failover...

Thanks all.

SSH into the sensor and run

Pavel Trinos — Tue, 12 May 2015 18:44:18 GMT

SSH into the sensor and run commands:

show managers (make sure that host IP is proper and registration is Pending)

show network (you have a SM mismatch, make sure you match it)

Verify that you routing is symmetric, I've had issues with that too.

Try to add sensor by IP (is you are using FQDN)

Thanks Pavel, that's exactly

petenixon — Tue, 12 May 2015 21:43:57 GMT

Thanks Pavel, that's exactly what I found. Assymetric routing issue was causing the problem.

topic Thanks Pavel, that's exactly in Network Security

Issue Adding Sourcefire Module to Defence Centre - ASA 5512-X

SSH into the sensor and run

Thanks Pavel, that's exactly