CSCvk06176 - SSEConnector is not coming up because of Wrong Executable

[Jim Jones]

This is a nice annoying bug! It says it is fixed but I don't see where a new release has been pushed on 7/2 either on CCO or through the FMC updates window. Any idea what build number this is fixed in?

[lanbrown]

It was resolved in 6.2.3.2 Build 46.  The issue was, 6.2.3.2 Build 42 had this bug.  You need to contact TAC for a workaround as you cannot install Build 46 over Build 42.  Cisco pulled 6.2.3.2 Build 42 from their site.

[Jim Jones]

Unfortunately the workaround didn't work for me. At this point I either need to uninstall back to 6.3 and then reinstall with -88 or wait until 6.3.3 comes out.

[lanbrown]

What was the workaround?  I'm still awaiting TAC to get back to me.  I have two FMC's; one has the issue, the other doesn't.

[Jim Jones]

Its a bit of code you have to overwrite on your FMC and then a process or 2.

[lanbrown]

I figured it would not be a straightforward process that could be accomplished with a hot fix or the like.  It seems that the initial 6.2.3 build 88 had the issue as the release notes state that any device that ran that build would have this issue, but that is not the case.  That same build was installed on two different FMC's and only one has an issue.  Cisco fixed the issue with the 6.2.3 build 92 release.  So why they list that issue as resolved in in 6.2.3 Build 46 is odd.  If that build resolved it, why offer a new build of 6.2.3.0?

I guess we might have to wait for 6.2.3.3 or 6.2.4.0 to be released.

[Jim Jones]

Honestly don't know why I didn't think of this before but I'm trying to restore my FMC from backup to prior to when the update was performed, then I'll just tell it to fetch and install the later version.

[lanbrown]

Yes, that would work since Cisco has pulled the build that has the issue.

[lanbrown]

Have you only upgraded the FMC or any of the IPS devices as well?  If the devices have been updated, you might run into issue.  The FMC needs to be the same or higher than the devices.  If you read the uninstall instructions for a patch, they say you need to remove the patch from the devices first (which can't be done via the GUI) before you do the FMC.  If you have a cluster or HA setup, it is more complicated.

So restoring the FMC to a lower version when there are devices running the higher code can be an issue.  Even the install guide says the FMC must be done first.

[Jim Jones]

So luckily the only device I've updated is the one on our redundant link so my plan is to go shut the device down until I get the FMC back up and then re updated.

[lanbrown]

That would work as well.  I have two devices updated but not completely sure I want to go down that path.  Right now the error isn't actually causing an issue for where these two IPS units are at.  It would be nice to resolve it, but wiping the FMC, putting the previous code on and restoring it probably is not worth the risk.

Good luck in what you need to do.

[Jim Jones]

Understandable, I'll let you know how this goes.

[lanbrown]

To add more complexity to this issue.  Even if you decided to wipe the box and start with 6.2.3 from scratch.  That image is build 83 whereas the release notes state that the SSEconnector issue was resolved in build 92 which they released on July 5th.

From the 6.2.3.x release notes:

CSCvk06176

If a Firepower Management Center ever ran Version 6.2.3-88 and you upgraded to Version 6.2.3.1 or Version 6.2.3.2, the SSE cloud connection incorrectly dropped and telemetry could not send data. This caveat is resolved in Version 6.2.3-92.

They list that under resolves caveats for 6.2.3.1 and 6.2.3.2.  The bug states that the issue was resolved in 6.2.3.2, which cannot be the case since they actually resolved it via a new base build.  Now you wonder what was fixed between build 83 and 88.

Here is the restore ISO:

Firepower Management Center system software

Sourcefire_Defense_Center_M4-6.2.3-83-Restore.iso

01-APR-2018

2327.92 MB

Does build 83 also have this issue?  Build 88 was released on May 17th.  Since the release notes are saying the actual fix was in build 92, is this something they broke in build 88 or does it go back to build 83?

If build 83 doesn't have the issue, then you could just use the ISO and start from scratch, then apply patch 2 and then perform a restore from a backup under 6.2.3.2 since the backup wouldn't contain the SSEconnector fault.

[Jim Jones]

Ok my work seems to have worked. I now have my vFMC back to 6.2.3 without errors and everything is talking fine. Going to update to 6.2.3.2-46 now, will make sure to take a snapshot of it first this time. ;)

[lanbrown]

Good luck.

Apparently what Cisco did was update the base image and then also updated the two patches with the fix.  This way the majority could patch this; if you were not running patch 2, installing it fixes this issue.  If you were running the previous base image, upgrading to either patch would fix the issue as well.  The people that didn't get the easy path.....the people already running the unfixed patch 2.