topic Re: SSH & HTTPS issue on Firepower 4100 chassis management interface in Network Security

SSH & HTTPS issue on Firepower 4100 chassis management interface

Happy_Trooper — Fri, 21 Feb 2020 17:42:54 GMT

Hello,

I am facing an issue with SSH/HTTPS management access on a Firepower 4100. After un-boxing the device, I consoled in and ran through the initial setup. I assigned the IP, subnet, hostname, default gateway, and IP blocks on the interface. I am able to ping the chassis mgmt interface from a laptop on the same subnet. From my laptop, I use putty to SSH in, I get a response, but using the same credentials that work for console access, it says access denied. I can confirm that my IP is in the IP block list on the private subnet of: 10.200.1.x/24.

When I attempt to access the 4100 via https, I get the login page, but my credentials that work for console access, do not work for web access:

The only network connectivity that I have to the appliance is to the chassis mgmt port. I simply want SSH and/or HTTPS access. I tried creating a 2nd admin user. I have the same issue with that account.

Is there something simple that I am missing to SSH/HTTPS into the chassis management port? I'm on version 2.4(1.101). I have followed the Cisco Firepower 4100 Quick Start Guide. According to the doc, after the initial configuration, one should be able to SSH in to the appliance.

Many thanks for your assistance.

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

nspasov — Sat, 23 Nov 2019 03:07:14 GMT

Hmm, this is strange. I was going to ask if had the ssh/http services enabled (Scope system > scope services > enable ssh/http) but if you are getting a login prompt then those must be running. However, one thing that seems odd here is the GUI login screen that you have in your screenshot. This does look like the FXOS login prompt nor the error message that you would get if your authentication fails. Can you please confirm that you are trying to get to the chassis (FXOS) and not FTD (The application running on the chassis)?

Thank you for rating helpful posts!

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

Happy_Trooper — Sat, 23 Nov 2019 22:34:34 GMT

Hello,

Thank you for your response. The screenshot in my previous post, showing the failed web login, was from going to the management IP: https: //10.200.1.210

I have the devices in a simple configuration, as noted below:

The only network cable connected to the FPR-4110 is to the management port. The remaining ports do not have any SFPs or connections. It looks just like the picture below.

I have a 2nd unit with the same issue. Perhaps it is user error. I have followed the getting started guide, setup the necessary address, subnet, IP block, gateway. Can ping the devices, SSH/HTTPS responds, but does not accept my credentials. If I am connected via console cable, I CAN SSH to the managment IP successfully. But I cannot SSH/HTTPS through a network connection.

Is there a feature that needs to be enabled? HTTP and SSH have been set to enabled. Is there a license that needs to be applied? Is 2.4 buggy with this?

Many thanks for your time and assistance.

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

Marvin Rhoads — Sun, 24 Nov 2019 03:17:18 GMT

Is it possible that somebody else has a different device in the lab using the same IP address?

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

Mohammad Alhyari — Sun, 24 Nov 2019 10:24:38 GMT

Right click on that page and check the source 🙂

see what is actually is there....

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

nspasov — Mon, 25 Nov 2019 06:46:05 GMT

I think Marvin was thinking what I was thinking. I would recommend connecting your PC directly to the mgmt interface and give it an IP address from the same subnet and then try again. The FXOS GUI Login screen should look like this:

https://www.google.com/search?q=firepower+chassis+manager+login&sxsrf=ACYBGNRqfIdruhX0M2FkunU8GMkOvAuVAQ:1574664179204&source=lnms&tbm=isch&sa=X&ved=2ahUKEwjlxKqY4YTmAhV3JzQIHfdrApQQ_AUoAnoECAwQBA&biw=1440&bih=717#imgrc=z-q2yv-jbvfpdM:

Thank you for rating helpful posts!

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

Happy_Trooper — Mon, 02 Dec 2019 13:15:36 GMT

Thank you all for your assistance. I'm going to head over to Networking 101 class 😞 It was an IP conflict.

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

nspasov — Mon, 02 Dec 2019 18:52:52 GMT

Hey, don't feel bad as this happens more often than not. We, tech people, tend to miss the most basic/easy things when troubleshooting as we get smarter and more knowledgeable. It is very common 🙂 Plus, it did not help that the login prompt for the other device also happens to be Cisco.

Thank you for rating helpful posts!

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

Marvin Rhoads — Mon, 02 Dec 2019 18:55:39 GMT

No worries - the reason I came up with the answer is because I've made same error once or twice in my long career. 🙂

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

mnice — Wed, 10 Feb 2021 11:03:00 GMT

Hello

Please Help me to resolve this problem

I use erase configuration on my FPR 4110 and after I can't access to FTD and when I try different procedure I stop on this step with this error

Error: Update failed: [App Instance cannot be started. Please provision LogicalDevice before starting application.]

Regards.

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

Marvin Rhoads — Wed, 10 Feb 2021 12:33:17 GMT

@mnice

If you have erased the configuration at the chassis level then you need to start over with provisioning a logical device again as the message indicates.

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

mnice — Wed, 10 Feb 2021 12:37:02 GMT

Hello marvin

Thank you sof much for your return

Provisioning a logical device means to allocate resources such as cpu disk and ram by creating a profile resource.?

Regards.

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

mnice — Wed, 10 Feb 2021 12:44:48 GMT

Hello Marvin

When I tried to allocate resources through the cli because the HTTPS access not work, I got this message

Error: Update failed: [Specified in CSP image header, FTD application does not support dynamic resources allocation.]

Regards.

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

Marvin Rhoads — Wed, 10 Feb 2021 13:15:32 GMT

Simply follow the detailed guide which can be found here:

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp4100/firepower-4100-gsg/ftd_fdm_deploy.html#task_edc_lvw_g3b

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

mnice — Wed, 10 Feb 2021 13:25:44 GMT

Hello marvin

Thank you for your return

The problem is , I have only Cli access I can't connect to the chassis in HTTPS it connects once at startup after it displays me incorrect user and password after impossible to restart the page.

Is there an access list problem ??? knowing that I didn't configure the IP-Block.

Thank you for helping me marvin .

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

Marvin Rhoads — Wed, 10 Feb 2021 13:29:58 GMT

Earlier in the same document you will find the detailed procedure on how to start from the very beginning again with the chassis - erasing the entire configuration from the console only access and build it all new, including the admin user password.

Reference:

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp4100/firepower-4100-gsg/chassis_setup.html#id_69569

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

Marvin Rhoads — Wed, 10 Feb 2021 14:45:40 GMT

Did you go through the guide starting with the erase-config section and including the out-of-box setup?

That should result in a "fresh" web interface. If it doesn't, you might try opening it in an incognito/private browser session.

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

mnice — Wed, 10 Feb 2021 15:01:06 GMT

Hello marvin

Thank you for your return

I applied an erase configuration after reboot I came on the basic configuration page I entered all the information requested after I save

As soon as I finish I have access to the HTTPS but the username and password intered show me is wrong I dont know why !!! and after few seconds the access is down.

I try with private access same problem.

Possible to connect to my equipment remotely to perform a check on my problem ?

Regards.

after a few rehearsals I lose access to the portal

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

mnice — Wed, 10 Feb 2021 15:06:36 GMT

Hello marvin

This is what I have to solve for the ftd application to be run

ftd-A /ssa/slot* # sh app

Application Instance:
App Name Admin State Oper State Running Version Startup Version Clus
ter State Cluster Role
---------- ----------- ---------------- --------------- --------------- ----
----------- ------------
ftd Disabled Offline 6.2.2.81 6.2.2.81 Not

ftd-A /ssa/slot/app-instance* # enable
ftd-A /ssa/slot/app-instance* # commit-buffer
Error: Update failed: [App Instance cannot be started. Please provision LogicalDevice before starting application.]

Regards.

Re: SSH & HTTPS issue on Firepower 4100 chassis management interface

Marvin Rhoads — Wed, 10 Feb 2021 16:53:17 GMT

You might want to contact TAC since they are equipped to do a WebEx session with you r to resolve your issue in real time.

If you get the Firepower Chassis manager issue resolved it is 10x easier to provision the logical device in the GUI and go fro there.