Cannot deploy after upgrading FMC to 6.4.0.7

Isaac Smith — Fri, 21 Feb 2020 17:47:06 GMT

Last night I was upgrading a few of our FWs to 6.4.0.6 and saw the latest was 6.4.0.7. I upgraded my FMC from 6.4.0.6 to .7. Afterward, deployments to sensors in ASAs (various code levels 6.2.3, 6.3.0) would not deploy with the following error:

The 'source' parameter ("/var/cisco/deploy/sandbox/vdb-pkg/vdb_lib/var/sf/DetectorCommon.lua") to SF::System::copy did not pass the 'Type Validator (system.file)' callback

At first it seemed limited to just ASA w/FP services but now I can't deploy to any devices including HA 2310s, 4110s, that are on 6.4.0.6 and 6.4.0.7. I opened a tac case last night but wanted to put this out here to see if anyone else has had this issue. The FTDs provide a bit more detail in the failure:

Refer to the following troubleshooting information when contacting Cisco TAC.

Other logs
Dec 21 00:08:43 Finished Export for AccessControl
Dec 21 00:08:43 Starting Export for ARC
Dec 21 00:08:43 Finished Export for ARC
Dec 21 00:08:43 Starting Export for Beaker
Dec 21 00:08:43 Finished Export for Beaker
Dec 21 00:08:43 Starting Export for Geolocation
Dec 21 00:08:43 Finished Export for Geolocation
Dec 21 00:08:43 Starting Export for Onbox
Dec 21 00:08:43 Finished Export for Onbox
Dec 21 00:08:43 Starting Export for SFDataCorrelator
Dec 21 00:08:43 Finished Export for SFDataCorrelator
Dec 21 00:08:43 Starting Export for SFTunnel
Dec 21 00:08:43 Finished Export for SFTunnel
Dec 21 00:08:43 Starting Export for SensorClustering
Dec 21 00:08:43 Finished Export for SensorClustering
Dec 21 00:08:43 Starting Export for StateSharing
Dec 21 00:08:43 Finished Export for StateSharing
Dec 21 00:08:43 Starting Export for Snort
Dec 21 00:08:44 Finished Export for Snort
Dec 21 00:08:44 Starting Export for FailD
Dec 21 00:08:44 Finished Export for FailD
Dec 21 00:08:44 Starting Validation for ApplicationDetectors
Dec 21 00:08:44 Finished Validation for ApplicationDetectors
Dec 21 00:08:44 Starting Validation for NGFWPolicy
Dec 21 00:08:44 Finished Validation for NGFWPolicy
Dec 21 00:08:44 Starting Validation for PlatformSettings
Dec 21 00:08:44 Finished Validation for PlatformSettings
Dec 21 00:08:44 Starting Validation for SensorPolicy
Dec 21 00:08:44 Finished Validation for SensorPolicy
Dec 21 00:08:44 Starting Validation for AccessControl
Dec 21 00:08:44 FWRuleChecker validation started
Dec 21 00:08:44 FWRuleChecker validation finished
Dec 21 00:08:44 Finished Validation for AccessControl
Dec 21 00:08:44 Starting Validation for ARC
Dec 21 00:08:44 Finished Validation for ARC
Dec 21 00:08:44 Starting Validation for Beaker
Dec 21 00:08:44 Finished Validation for Beaker
Dec 21 00:08:44 Starting Validation for Geolocation
Dec 21 00:08:44 Finished Validation for Geolocation
Dec 21 00:08:44 Starting Validation for Onbox
Dec 21 00:08:44 Finished Validation for Onbox
Dec 21 00:08:44 Starting Validation for SFDataCorrelator
Dec 21 00:08:44 Finished Validation for SFDataCorrelator
Dec 21 00:08:44 Starting Validation for SFTunnel
Dec 21 00:08:44 Finished Validation for SFTunnel
Dec 21 00:08:44 Starting Validation for SensorClustering
Dec 21 00:08:44 Finished Validation for SensorClustering
Dec 21 00:08:44 Starting Validation for StateSharing
Dec 21 00:08:44 Finished Validation for StateSharing
Dec 21 00:08:44 Starting Validation for Snort
Dec 21 00:08:48 Finished Validation for Snort
Dec 21 00:08:48 Starting Validation for FailD
Dec 21 00:08:48 Finished Validation for FailD
Dec 21 00:09:07 Starting publish for ApplicationDetectors
Dec 21 00:09:07 Finished publish for ApplicationDetectors
Dec 21 00:09:07 Starting publish for NGFWPolicy
Dec 21 00:09:07 Finished publish for NGFWPolicy
Dec 21 00:09:07 Starting publish for PlatformSettings
Dec 21 00:09:12 Finished publish for PlatformSettings
Dec 21 00:09:12 Starting publish for SensorPolicy
Dec 21 00:09:12 Finished publish for SensorPolicy
Dec 21 00:09:12 Starting publish for AccessControl
Dec 21 00:09:12 Finished publish for AccessControl
Dec 21 00:09:12 Starting publish for ARC
Dec 21 00:09:12 Finished publish for ARC
Dec 21 00:09:12 Starting publish for Beaker
Dec 21 00:09:12 Finished publish for Beaker
Dec 21 00:09:12 Starting publish for Geolocation
Dec 21 00:09:12 Finished publish for Geolocation
Dec 21 00:09:12 Starting publish for Onbox
Dec 21 00:09:12 Finished publish for Onbox
Dec 21 00:09:12 Starting publish for SFDataCorrelator
Dec 21 00:09:12 Finished publish for SFDataCorrelator
Dec 21 00:09:12 Starting publish for SFTunnel
Dec 21 00:09:12 Finished publish for SFTunnel
Dec 21 00:09:12 Starting publish for SensorClustering
Dec 21 00:09:12 Finished publish for SensorClustering
Dec 21 00:09:12 Starting publish for StateSharing
Dec 21 00:09:12 Finished publish for StateSharing
Dec 21 00:09:12 Starting publish for Snort
Dec 21 00:09:12 Finished publish for Snort
Dec 21 00:09:12 Starting publish for FailD
Dec 21 00:09:12 Finished publish for FailD
Dec 21 00:09:12 Starting notify for ApplicationDetectors
Dec 21 00:09:12 Finished notify for ApplicationDetectors
Dec 21 00:09:12 Starting notify for NGFWPolicy
Dec 21 00:09:12 Finished notify for NGFWPolicy
Dec 21 00:09:12 Starting notify for PlatformSettings
Dec 21 00:09:15 Finished notify for PlatformSettings
Dec 21 00:09:15 Starting notify for SensorPolicy
Dec 21 00:09:15 Finished notify for SensorPolicy
Dec 21 00:09:15 Starting notify for AccessControl
Dec 21 00:09:15 Finished notify for AccessControl
Dec 21 00:09:15 Starting notify for ARC
Dec 21 00:09:15 Finished notify for ARC
Dec 21 00:09:15 Starting notify for Beaker
Dec 21 00:09:15 Finished notify for Beaker
Dec 21 00:09:15 Starting notify for Geolocation
Dec 21 00:09:15 Finished notify for Geolocation
Dec 21 00:09:15 Starting notify for Onbox
Dec 21 00:09:15 Finished notify for Onbox
Dec 21 00:09:15 Starting notify for SFDataCorrelator
Dec 21 00:09:15 Finished notify for SFDataCorrelator
Dec 21 00:09:15 Starting notify for SFTunnel
Dec 21 00:09:15 Finished notify for SFTunnel
Dec 21 00:09:15 Starting notify for SensorClustering
Dec 21 00:09:15 Finished notify for SensorClustering
Dec 21 00:09:15 Starting notify for StateSharing
Dec 21 00:09:15 Finished notify for StateSharing
Dec 21 00:09:15 Starting notify for Snort
Dec 21 00:09:17 Finished notify for Snort
Dec 21 00:09:17 Starting notify for FailD
Dec 21 00:09:17 Finished notify for FailD
Dec 21 00:09:56 Starting Finalise for ApplicationDetectors
Dec 21 00:09:56 Finished Finalise for ApplicationDetectors
Dec 21 00:09:56 Starting Finalise for NGFWPolicy
Dec 21 00:09:56 Finished Finalise for NGFWPolicy
Dec 21 00:09:56 Starting Finalise for PlatformSettings
Dec 21 00:09:56 Finished Finalise for PlatformSettings
Dec 21 00:09:56 Starting Finalise for SensorPolicy
Dec 21 00:09:56 Finished Finalise for SensorPolicy
Dec 21 00:09:56 Starting Finalise for AccessControl
Dec 21 00:09:56 Finished Finalise for AccessControl
Dec 21 00:09:56 Starting Finalise for ARC
Dec 21 00:09:56 Finished Finalise for ARC
Dec 21 00:09:56 Starting Finalise for Beaker
Dec 21 00:09:56 Finished Finalise for Beaker
Dec 21 00:09:56 Starting Finalise for Geolocation
Dec 21 00:09:56 Finished Finalise for Geolocation
Dec 21 00:09:56 Starting Finalise for Onbox
Dec 21 00:09:56 Finished Finalise for Onbox
Dec 21 00:09:56 Starting Finalise for SFDataCorrelator
Dec 21 00:09:56 Finished Finalise for SFDataCorrelator
Dec 21 00:09:56 Starting Finalise for SFTunnel
Dec 21 00:09:56 Finished Finalise for SFTunnel
Dec 21 00:09:56 Starting Finalise for SensorClustering
Dec 21 00:09:56 Finished Finalise for SensorClustering
Dec 21 00:09:56 Starting Finalise for StateSharing
Dec 21 00:09:56 Finished Finalise for StateSharing
Dec 21 00:09:56 Starting Finalise for Snort
Dec 21 00:09:56 Finished Finalise for Snort
Dec 21 00:09:56 Starting Finalise for FailD
Dec 21 00:09:56 Finished Finalise for FailD
Dec 21 09:07:03 Starting Export for ApplicationDetectors

Dec 21 09:07:03 The 'source' parameter ("/var/cisco/deploy/sandbox/vdb-pkg/vdb_lib/var/sf/DetectorCommon.lua") to SF::System::copy did not pass the 'Type Validator (system.file)' callback

Re: Cannot deploy after upgrading FMC to 6.4.0.7

kkamacmaya — Tue, 24 Dec 2019 09:54:42 GMT

Hi,

I had the same problem after the FMC upgrade to 6.4.0.7-53. When I look at the logs, I see that the problem does not have the DetectorCommon.lua file in the "/var/cisco/deploy/sandbox/vdb-pkg/vdb_lib/var/sf" directory. As a workaround, I copied this file from directory "/var/cisco/deploy/sandbox/vdb-pkg/vdb_lib/var/sf/appid/odp/libs" to directory "/var/cisco/deploy/sandbox/vdb-pkg/vdb_lib/var/sf" and deployed the policy again.

Regards,

Re: Cannot deploy after upgrading FMC to 6.4.0.7

Isaac Smith — Tue, 24 Dec 2019 15:49:02 GMT

Interesting. TAC has opened a defect and is working on a real fix. The actual issue has to do with the latest VDB 330 in my case. The workaround was TAC changed config files and back revved to VDB 329. This fixed deployments to FTDs but not SFRs. I just got off a call with development and they had to replace some files (waiting for clarification) I believe related to /var/cisco/packages/vdb-329.tgz and the DetectorCommon.lua files and now I can deploy to SFRs. Awaiting the BU to find the actual fix. During the holidays it's tough as the BU shuts down.

CSCvs54942

Re: Cannot deploy after upgrading FMC to 6.4.0.7

Marvin Rhoads — Fri, 27 Dec 2019 14:00:00 GMT

Thanks for sharing the details of your case @Isaac Smith - it's good to know.

I will definitely avoid that combination until a fix is released!

Re: Cannot deploy after upgrading FMC to 6.4.0.7

Isaac Smith — Mon, 30 Dec 2019 18:12:50 GMT

Thanks. I see the bug is public and there are 4 other cases listed so obviously i'm not the only one.

Re: Cannot deploy after upgrading FMC to 6.4.0.7

jjohann — Tue, 31 Dec 2019 15:45:24 GMT

Thanks Isaac. I was also told that my issue was related to a bug. Not sure if it's the same one. I'll research those solutions more.

Re: Cannot deploy after upgrading FMC to 6.4.0.7

CarlosGarcia84 — Thu, 02 Jan 2020 16:14:15 GMT

I am afraid to upgrade to 6.4.0.7 has Cisco found a working resolution yet? Will be checking this thread for more updates.

Thank you

Re: Cannot deploy after upgrading FMC to 6.4.0.7

Ivan Sokirko — Wed, 08 Jan 2020 13:49:52 GMT

@CarlosGarcia84 wrote:
I am afraid to upgrade to 6.4.0.7 has Cisco found a working resolution yet? Will be checking this thread for more updates.
Thank you

Cisco publish new hotfix. Cisco_Firepower_Mgmt_Center_Hotfix_AA-6.4.0.8-4.sh.REL.tar I'ts resolve my issue.

Re: Cannot deploy after upgrading FMC to 6.4.0.7

CarlosGarcia84 — Mon, 27 Jan 2020 21:42:11 GMT

That did it

Thank you!

topic Re: Cannot deploy after upgrading FMC to 6.4.0.7 in Network Security

Cannot deploy after upgrading FMC to 6.4.0.7

Re: Cannot deploy after upgrading FMC to 6.4.0.7

Re: Cannot deploy after upgrading FMC to 6.4.0.7

Re: Cannot deploy after upgrading FMC to 6.4.0.7

Re: Cannot deploy after upgrading FMC to 6.4.0.7

Re: Cannot deploy after upgrading FMC to 6.4.0.7

Re: Cannot deploy after upgrading FMC to 6.4.0.7

Re: Cannot deploy after upgrading FMC to 6.4.0.7

Re: Cannot deploy after upgrading FMC to 6.4.0.7