cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1802
Views
6
Helpful
9
Replies

[FMC] Unable to save a backup or to upgrade

Hi,

I am unable to take a backup from a virtual FMC which is managing two Firepower 4110 (HA).

The received error is : Registration or CSM state are blocking Backup

I have a doubt about the actual version (6.2.0) so I have tried to upgrade it to 6.2.1/6.2.0.1/6.2.0.2 but I am getting a somewhat similar error :  Peer registration in progress. Please retry in a few moments.  However, in the menu of managed devices, both FTD are registered with a green status (see attachment).

Any suggestion ?

1 ACCEPTED SOLUTION

Accepted Solutions
Dv Cisco Employee
Cisco Employee

Hi Anouar,

Hi Anouar,

Please go to the CLI of the device, become root and run this command:

Command: mysql -padmin sfsnort -e "select name,ip,uuid,role from EM_peers where role !=0"

This would list out all the peers, find the UUID and IP of the Chassis Mgr which you added wrongly. and then run this command:

remove_peer.pl <IP>

remove_peer.pl <~IP>

remove_peer.pl <uuid>

remove_peer.pl <~uuid>

This should fix the issue. Let me know how it goes.

Regards,

Dv

9 REPLIES 9
Dv Cisco Employee
Cisco Employee

Hi Anouar,

Hi Anouar,

Login to the CLI of both FTD and run the command show managers. There shouldn't be any manager status as Pending. If yes then fix that up.

Let me know how it goes.

Regards,
Dv

I already have registration

I already have registration completed in both.

Cisco Employee

Hello Anouar

Hello Anouar

If the registrations looks fine with FTD then please check the messages log to see why the Backup is failing .Are you copying this to remote storage or locally in FMC ? 

If its remote then please check everything is fine from the remote storage as well.

Regards

Jetsy 

with tail -f /var/log

with tail -f /var/log/messages I found these messages :

Aug 17 12:20:09 firepower SF-IMS[8831]: [8893] sftunneld:sf_connections [INFO] Start connection to : a.b.c.241 (wait 44 seconds is up)
Aug 17 12:20:09 firepower SF-IMS[8831]: [22370] sftunneld:sf_peers [INFO] Peer a.b.c.241 needs a single connection
Aug 17 12:20:09 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [INFO] Connect to a.b.c.241 on port 8305 - eth0
Aug 17 12:20:09 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [INFO] Initiate IPv4 connection to a.b.c.241 (via eth0)
Aug 17 12:20:09 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [INFO] Initiating IPv4 connection to *.241:8305/tcp
Aug 17 12:20:09 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [INFO] Wait to connect to 8305 (IPv6): a.b.c.241
Aug 17 12:20:29 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [ERROR] Unable to connect to port 8305 (IPv4): Operation now in progress
Aug 17 12:20:29 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [INFO] No IPv4 connection to a.b.c.241
Aug 17 12:20:29 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [WARN] Unable to connect to peer 'a.b.c.241'
Aug 17 12:20:29 firepower SF-IMS[8831]: [22370] sftunneld:sf_ssl [INFO] reconnect to peer 'a.b.c.241' in 44 seconds
Aug 17 12:20:31 firepower SF-IMS[8831]: [8893] sftunneld:sf_peers [INFO] Peer a.b.c.241 needs a single connection

This should be the root cause. We have inserted a wrong device address before (.241) which is the Firepower Chassis Manager and not the FTD one

How can we unregister this wrong address as we do not see anything about it from GUI  ?

Dv Cisco Employee
Cisco Employee

Hi Anouar,

Hi Anouar,

Please go to the CLI of the device, become root and run this command:

Command: mysql -padmin sfsnort -e "select name,ip,uuid,role from EM_peers where role !=0"

This would list out all the peers, find the UUID and IP of the Chassis Mgr which you added wrongly. and then run this command:

remove_peer.pl <IP>

remove_peer.pl <~IP>

remove_peer.pl <uuid>

remove_peer.pl <~uuid>

This should fix the issue. Let me know how it goes.

Regards,

Dv

Hi,

Hi,

Is there any risk or we can execute it during work hours.

Dv Cisco Employee
Cisco Employee

No risk as long as you're

No risk as long as you're deleting the entry which we don't need and lying there for no good. 

Re: Hi Anouar,

Hi

How can i find the Right one  ?

i have used the Same command,i find out that there are multiple lines out there,but I have used just one Manager.How can I find that which Entry is working and which one is not needed?

 

Highlighted
Hall of Fame Master

Re: Hi Anouar,

Any peers that have an address other than your Firepower Management Center may be removed.