topic Re: Hi Marvin, in Network Security

SFR Firepower is not present/manageble anymore in ASDM

orthicon2009 — Tue, 12 Mar 2019 13:21:43 GMT

Hi Cisco Experts!

Good Day!

Our Firepower sensor in Cisco 5516-X is not accessible anymore in ASDM. I can access ASDM with all firewall configs still intact. Only missing is the SFR configurations. Usually under Firewall Configuration, I could see the "ASA firepower configuration".

It was still working last week though. Not sure what happened but I also rebooted the firewall but still the same.

I can still access through the CLI and the sfr status seems ok. Below are the details of our SFR.

Let me know if there are workaround on this.

show module

Mod Card Type                                    Model              Serial No.
---- -------------------------------------------- ------------------ -----------
   1 ASA 5516-X with FirePOWER services, 8GE, AC, ASA5516            XXXXXXXXXXXXX
sfr FirePOWER Services Software Module           ASA5516            XXXXXXXXXXXXXXX

Mod MAC Address Range                 Hw Version   Fw Version   Sw Version
---- --------------------------------- ------------ ------------ ---------------
   1 XXXXXXXXXXXXX    1.1          1.1.8        9.6(1)
sfr XXXXXXXXXXXXX N/A          N/A          6.1.0.2-57

Mod SSM Application Name           Status           SSM Application Version
---- ------------------------------ ---------------- --------------------------
sfr ASA FirePOWER                  Up               6.1.0.2-57

Mod Status             Data Plane Status     Compatibility
---- ------------------ --------------------- -------------
   1 Up Sys             Not Applicable
sfr Up                 Up

Please check "show module sfr

Marvin Rhoads — Mon, 17 Apr 2017 14:47:45 GMT

Please check "show module sfr detail" and make sure a manager (DC) didn't get configured.

If that's OK, check that you can reach the sfr module IP address from the host you are using for ASDM. You should be able to ssh to it and verify the same thing with "show managers".

ASDM uses https so that needs to be reachable as well. If that's an issue, ASDM should complain about it when launching.

When it doesn't even show, it's usually an indication that it doesn't think it (ASDM) should be managing the sfr module as it pulls the detail information I mentioned during startup to check for local vs. FMC (FirePOWER Management Center - formerly known as Defense Center or DC) management setup.

Hi Marvin,

orthicon2009 — Mon, 17 Apr 2017 14:47:46 GMT

Hi Marvin,

Appreciate the quick reply. Below is the screenshot from Both ASA and SFR module via ssh.

Please note that I was able to access SFR configuration via ASDM last week. Based from the output below, no DC is configured and it is managed locally. HTTPS should not be an issue also since I can access the ASDM via https.

Usually when I access ASDM, I can see five tabs on ASDM’s home page (now it’s just three). But one of the tab that I can see right now in ASDM is the STATUS of SFR that says it's up and running.

I'm thinking if I should re-image again the SFR module to resolve it but I'm hoping if there are other workarounds that you can share before going to that path.

Screenshot from ASA FW via ssh
--------------------------------------------
show module sfr detail
Getting details from the Service Module, please wait...

Card Type:          FirePOWER Services Software Module
Model:              ASA5516
Hardware version:   N/A
Serial Number:      XXXXXXXXXXXXXXXX
Firmware version:   N/A
Software version:   6.1.0.2-57
MAC Address Range: XXXXXXXXXXXXXXXXXXX
App. name:          ASA FirePOWER
App. Status:        Up
App. Status Desc:   Normal Operation
App. version:       6.1.0.2-57
Data Plane Status: Up
Console session:    Ready
Status:             Up
DC addr:            No DC Configured
Mgmt IP addr:       XXXXXXXX
Mgmt Network mask: XXXXXXXXXX
Mgmt Gateway:       XXXXXXXXXXXXX
Mgmt web ports:     443
Mgmt TLS enabled:   true
--------------------------------------------

Screenshot from SFR module via ssh

> show managers
Managed locally.

>

Hmm. You're right - it all

Marvin Rhoads — Mon, 17 Apr 2017 15:10:24 GMT

Hmm. You're right - it all looks OK from the module's point of view. I'd definitely not re-image.

It could well be some ASDM oddness. Can you perhaps try the Java Web start version? (or if you are already using that then try the local installer-based version).

There are some further troubleshooting steps in this document:

http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/200889-Using-ASDM-to-manage-a-FirePOWER-module.html

...though from what you've done so far, we've covered most of those suggestions.

Hi Marvin,

orthicon2009 — Wed, 19 Apr 2017 10:42:53 GMT

Hi Marvin,

It is working now. What I did instead is I updated my JAVA using the latest version, then accessed ASDM so I can Import Firepower self-signed certificate and Exported this Firepower self-signed certificate to Java Control panel(Security>Managed Certificates).

Thanks for updating the

Marvin Rhoads — Wed, 19 Apr 2017 10:51:00 GMT

Thanks for updating the thread.

Updating your Java may have had the effect of clearing your Java cache.

Re: Hi Marvin,

Albert_Hernandez — Fri, 03 May 2019 17:50:59 GMT

How can I updated my Java version? Sorry but I am new on Firepower, it shows this message I suppose it is because my Java version.

[ERROR],(LwDeploymentManagerImpl.java:881)
USMS: 05-03 16:18:43 com.cisco.nm.vms.api.deployment.LwDeploymentManagerImpl, ajp-nio-127.0.0.1-9009-exec-2
USMS: 05-03 16:18:43 Deployment for device 22cce5a0-f276-11e8-a64f-a6b9ef9ce51f is FAILED

Re: Hi Marvin,

Marvin Rhoads — Sat, 04 May 2019 11:43:27 GMT

The error you posted appears to be from an FMC log. That would not be related to your client side Java. I suggest starting a new thread and posting the full details.

Re: Thanks for updating the

chyps — Fri, 29 Sep 2023 20:19:43 GMT

Thanks Marvin. ASDM on my Mac would not show the FirePower menu options until I deleted the Java cache and applets from the Java console.