Re: Firepower 1010

Markflan · ‎09-06-2023

Hi there

I have a new firepower 1010 and for some reason I have the error message “gateway cannot be reached through port Ethernet 1/1 named outside” I know my isp line is up and running and NAT rule is on dynamic and yet I still have no internet on my devices. DHCP give out the correct details but I’ve nothing. Where am I going wrong ? I’ve reset 5 times now and. I joy please help

thanks

mark

marce1000 · ‎09-06-2023

- FYI : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz32452

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

Markflan · ‎09-06-2023

Hi there .. thanks for your message .. I’m afraid that didn’t work for me and still no outbound connection ?
I did just connect it off my old FW and did DHCP and worked fine but not an option as j want to remove the old FW completely

thanks

marce1000 · ‎09-06-2023

- I have no further insights on it , if needed contact Cisco (TAC)

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

Rob Ingram · ‎09-06-2023

@Markflan what is your configuration? Have you configured an Access Control Policy rule to permit the relevant traffic?

Provide screenshots of your NAT rules and ACP rules.

Run packet-tracer from the CLI to simulate the traffic flow from inside to outside, this will identify where any problems lie.

Marvin Rhoads · ‎09-06-2023

As noted in the BugID referenced by @marce1000 we see this on 7.0 and earlier when there's no DNS resolution and/or cisco.com is unreachable.

It would be a good idea to first update to the current recommended release (7.2.5) and see if it clears up - the bug should not affect that version. You could also ensure you have a DNS server set for the device so that it can resolve cisco.com for the connectivity test it does to verify connectivity and change the icon color.

It's quite similar to Windows' NCSI (https://learn.microsoft.com/en-us/windows-server/networking/ncsi/ncsi-overview) with its associated icon in the taskbar.

Markflan · ‎09-28-2023

Hi All

thanks for all the advise and follow ups but it turned out that when i recived the latest version of software 7.2.5 from Cisco for the 1010 it immediately worked and then as I found out there was a bug in the version i had .. go figure

thanks again

Mark