CSM (Cisco Security Manager) 4.10 error discovering ASA with service-policy

[lbenigni]

Hello,

I have a problem regarding CSM 4.10 and ASA. When I try to discover an ASA from CSM I receive two Internal errors:

Policy Discovery Failed: com.cisco.nm.vms.discovery.DiscoveryException: Internal Error

Exception importing policy group: id = 7992934205670, type = PG.FIREWALL.InspectRule, name = .fw-namePG.FIREWALL.InspectRule.

If I remove the line "service-policy global_policy global", everything works fine.

I tested ASA 5505 (7.2.5) and ASA 5512X (9.1.6.11).

Any suggestions?

[alpaezca]

Hello,

When did you start running into this issue? is a new installation or did you upgrade CSM Database from 4.8 or 4.9 to 4.10?

Please check the following bug CSCuz33931

[lbenigni]

Hello Alejandra,

it's an upgrade from 4.2.1 and I followed the entire upgrade path.

I looked at the bug you mentioned and I tried to do the upgrade to version 4.11, but I found another bug (CSCuz41194) and the first problem continues.

Is it possible to have a definitive solution?

Thank you

[alpaezca · Accepted solution]

Hello,

You can try with the following solution, please do a Backup of the CSM Database prior to apply it, just in case

1. Stop the daemon manager.

2. Reset the password for the "vms" database.

To do this, open a command prompt in CSCOpx/bin directory and issue the following command "perl dbpasswd.pl dsn=vms npwd=admin" 

** This will reset the DB password to "admin".

3. Connect to the DB using the dbisqlc program. 

4. Execute the following query.

5. Commit the changes:

Type "commit" in dbisqlc and press "execute".

6. Close the dbisqlc tool and restart the daemon manager.

Let me know how everything goes, and In case the issue persist, then open a case with TAC

[lbenigni]

Hello,

the solution you mentioned worked perfectly!
I have attached a file with the steps.
Many thanks

Leonardo