Cisco ASA 5506-X with FirePOWER doesn't route traffic to the SFR module

[jacobnosal]

Greetings,

We recently were able to get FirePOWER T&C licensing enabled on our ASA 5506-X, but we seem to be unable to route traffic from the firewall through the SFR Module. We have only the 5506, no TMC or virtual appliances.

We made it through this guide to step 6 (https://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/sfr/firepower-qsg.html) and the stats page (the traffic information page on the FirePOWER tab) does not populate. Troubleshooting tips would be appreciated and thank you for any information you can provide.

[Alessandro Roberto Alves]

Hi jacobnosal, Enter the data or print of the Service Policy Rule. Did you follow the procedure below? Configure the ASA Security Policy Redirect traffic to the ASA FirePOWER module by creating a service policy on the ASA that identifies specific traffic that you want to send. Procedure 1.blank.gif In ASDM, Choose Configuration > Firewall > Service Policy Rules. 2.blank.gif Choose Add > Add Service Policy Rule. 3.blank.gif Choose whether to apply the policy to a particular interface or apply it globally and click Next. 4.blank.gif Configure the traffic match. For example, you could match Any Traffic so that all traffic that passes your inbound access rules is redirected to the module. Or, you could define stricter criteria based on ports, ACL (source and destination criteria), or an existing traffic class. The other options are less useful for this policy. After you complete the traffic class definition, click Next. 5.blank.gif On the Rule Actions page, click the ASA FirePOWER Inspection tab. 6.blank.gif Check the Enable ASA FirePOWER for this traffic flow check box. 7.blank.gif In the If ASA FirePOWER Card Fails area, click one of the following: –blank.gif Permit traffic —Sets the ASA to allow all traffic through, uninspected, if the module is unavailable. –blank.gif Close traffic —Sets the ASA to block all traffic if the module is unavailable. 8.blank.gif (Optional) Check Monitor-only to send a read-only copy of traffic to the module, i.e. inline tap mode. By default, the traffic is sent in inline mode. Be sure to configure consistent policies on the ASA and the ASA FirePOWER. Both policies should reflect the inline or monitor-only mode of the traffic. 9.blank.gif Click Finish and then Apply. Repeat this procedure to configure additional traffic flows as desired.

[Chess Norris]

Have you created a policy in the ASA to re-direct traffic to the module?

If not, here are some basic steps to do it from the ASA CLI:

1. Redirect traffic to the module. (Here I will send all IP traffic,
but you can also match on specific source, destination, ports, etc.)

(config)# access-list SFR extended permit ip any any
(config)# class-map SFR
(config-cmap)# match access-list SFR

2. Add that class-map to the default policy-map.

(config)# policy-map global_policy
(config-pmap)# class SFR
(config-pmap-c)# sfr fail-open

Those are the basic steps to re-direct traffic from the ASA firewall to the Firepower module.

Hope it helps.

/Jörgen