Sfr is unresponsive

[lsanchez]

I would like to ask why sfr is unresponsive?

FIT-ASA# show module sfr details
Getting details from the Service Module, please wait...
Unable to read details from module sfr

Card Type: Unknown
Model: N/A
Hardware version: N/A
Serial Number: JAD202200G1
Firmware version: N/A
Software version:
MAC Address Range: 0062.ec8f.92f0 to 0062.ec8f.92f0
Data Plane Status: Not Applicable
Console session: Ready
Status: Unresponsive

FIT-ASA# show module

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
1 ASA 5516-X with FirePOWER services, 8GE, AC, ASA5516 JAD202200G1
sfr Unknown N/A JAD202200G1

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
1 0062.ec8f.92f1 to 0062.ec8f.92f9 1.1 1.1.12 9.9(2)
sfr 0062.ec8f.92f0 to 0062.ec8f.92f0 N/A N/A

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
1 Up Sys Not Applicable
sfr Unresponsive Not Applicable

Thank you in advance.

[Mohammed al Baqari]

What do you see when you try to console from ASA to SFR. Also, get the
output of

sh module sfr log console

[lsanchez]

thank you for your response

when i tried to access the sfr

im stuck on this, even i press ctrl+x

here is the output when checking sfr log console

[Marvin Rhoads]

It's most likely not installed.

Has it ever worked?

[lsanchez]

Thank you for your response.

Yes sir it worked before.

[Marvin Rhoads]

It appears to have gotten severely corrupted to the extent of not starting correctly. You may need to re-install the software module.

Unless it has a lot of locally-configured (via ASDM) settings, I'd just go ahead and re-image it and re-register to FMC and redeploy the policies.

[lsanchez]

i'll try to reinstall, thank you sir

[Florin Barhala]

When you say reinstall you mean recover?

sw-module module sfr recover configure image disk0:/asasfr-5500x-boot-6.3.0-1.img
sw-module module sfr recover boot

[Marvin Rhoads]

Yes, that's correct. Recover and boot.

You might also precede those with an uninstall for the most complete treatment.

[Florin Barhala]

Thank you Marvin!
I do have one more question/concern when it comes to SFR;
As we speak I have the SFR configured as fail-open and still I am worried about production traffic impact.
At what moment the ASA will consider the sensor "ready" to forward traffic? When does "fail-open" is triggered?

This combination of policy-map config along with pushing policies from FMC is confusing to me in regard to any traffic disruption/block.

Thanks!

[Marvin Rhoads]

"fail-open" means if the sfr module fails (i.e. status is "down/down" or even "up/down") the ASA will ignore the service-policy that would otherwise redirect the traffic to it for inspection.

Once the module status is "up/up" traffic redirection will resume.

[Florin Barhala]

That makes sense ; how can anyone determine SFR status?
I reviewed this command, but the output returns a different status than up/down

show module sfr details
Getting details from the Service Module, please wait...
Unable to read details from module sfr

Card Type: Unknown
Model: N/A
Hardware version: N/A
Serial Number: FCH66620UU
Firmware version: N/A
Software version:
MAC Address Range: 0062.1111.9d84 to 0062.1111.9d84
Data Plane Status: Not Applicable
Console session: Ready
Status: Unresponsive

[Marvin Rhoads]

It could be that the sfr module is not installed and that there is either no installed module or one of the legacy types (cxsc or ips).

"show module" will return the overall status of all module types.

[kvnrndlph]

Had a similar issue that was resolved with just a reset.

sw-module module sfr shutdown

sw-module module sfr reset