ASA 5505 lost connection to Firesight

[sebastienbellinger33134]

We have a VMware Firesight server in one office and 3 ASA 5505 appliances. I made a configuration change on the Firesight server by adding a DNS rule that ended up blocking the connecting from an ASA in a remote office from the Firepower management server. Is there a way to modify the firepower policy on the ASA from CMD to allow the ASA to connect to the management server again? Maybe rollback deployment or whitelist the remote server? Currently all internet traffic is being blocked at the remote office because of this new policy.

[nspasov]

Hi there-

• 5505s do not run FTD/Firepower so perhaps you meant a different hardware model?
• To answer your question: Currently, there is no rollback functionality. Thus, you will have to restore the connectivity between the FMC and the managed Firewall via another device/method. 
• If you want to have a local and centralized management, I would recommend looking into FDM (On box) with CDO (Centralized cloud management). 

Thank you for rating helpful posts!

[sebastienbellinger33134]

Sorry. I meant 5506 and 5508. Is it possible to unregister the asa and edit the policy from ADSM?

[nspasov]

Are you running the unified image (FTD) or ASA with FirePOWER services where you have both the ASA and Firepower software running?

Thank you for rating helpful posts!

[sebastienbellinger33134]

Both ASA and firepower running.

[nspasov · Accepted solution]

If you have both images running (ASA with FirePOWER) then your standard ASA features (L3/L4 ACLs, NAT, VPN, etc) are still managed independently from the FMC. Thus, if the connectivity is broken due to ASA configurations then you should be able to make the appropriate changes via CLI/ASDM. If the connectivity is broken due to rules in the FirePOWER module then you can re-configure the ASA to bypass the module temporarily so you can restore the connectivity, then make the appropriate changes in the FMC and then re-configure the ASA again to inspect traffic through the FirePOWER module. 

You have two options to temporary bypass the FirePOWER module:

1. Completely remove the traffic-redirection in your policy-map
2. Utilize the "monitor-only" keyword in your policy-map. This will essentially instruct the FirePOWER module to only monitor the redirected traffic without taking any action (Drop, Trust, Allow)

For more information on this, you can reference the following link:

https://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configure-firepower-00.html

I hope this helps!

Thank you for rating helpful posts!