Can't update anything via proxy in Cisco FMC

[sina.naser]

Hi everyone

Due to oraganization's policies We Update our servers through HTTP proxy.

We have a Cisco FMC (VM, version 7.0.5) and want to system, VDB, Snort update through proxy. proxy server connection is ok. But when I hit download after few minutes I encounter this error "Peer certificate cannot be authenticated with known CA certificates" .

What should I suppose to do in this case?

I appreciate any help

Tnx in advance

[Rob Ingram]

@sina.naser are you doing SSL decryption on the proxy? If so perhaps add an exclusion for the FMC or add the proxy root cert to the FMC as a trusted certificate.

[sina.naser]

Tnx for your reply. No SSL decryption. It's simple Mikrotik Proxy 

[sina.naser]

This is a forced task that assigned to me. Do you have any other idea?

Tnx

[MHM Cisco World]

If you face issue with ssl inspection then why you not make this traffic bypass ssl inspection?

[sina.naser]

I fastpath the traffic to the proxy via prefilter. So no SSL inspection in FTD. I saw this message a bug in previous versions. But This FMC updated to the latest suggested version

[MHM Cisco World]

what is Firepower platform you have ?

[sina.naser]

FPR 2110 running FTD 7.0.5

[MHM Cisco World]

clear conn address <<- clear the traffic in FPR and check again.

[Sheraz.Salim]

If you are using a MikroTik proxy server and encountering the "Peer certificate cannot be authenticated with known CA certificates" error while trying to update your Cisco FMC (Firepower Management Center) through the HTTP proxy, the issue is likely related to SSL certificate verification.

can you also check proxy server logs, examine the logs on your MikroTik proxy server to identify any errors or issues related to the SSL handshake or certificate verification. The logs may provide valuable information and lead to reslove the FMC issue.

[sina.naser]

Mikrotik doesn't show any descriptive logs just show the IPs. Is there any specific configuration that I must consider in mikrotiK for this issue?

[Sheraz.Salim]

Its difficult to say could you confirm if you can run the packet capture on both end and capture the data.

also please confirm if anything is change in the path for FMC. how it was upgraded (fmc) last time where the same proxy was used?

[sina.naser]

Last week Cisco made the version 7.2.4 suggested. I have updated to this version and the problem solved!