FTD Registration Problem

[ammann9113]

Hello everyone

I'm currently encountering a problem which really bugs me...

I have a 5506-X running with the FTD image (6.2) and everything (as far as I can tell) looks well. Except for one thing; the Smart License registration. I always get a error message, telling me I need to check my internet connectivity (for the mangement interface). I am able to access the internet through the ASA, I can ping Google from the ASA CLI, updates are being downloaded and installed every other day...

I've tried "Use the Data Interfaces as the Gateway" and a unique gateway for the management interface, all with the same result..

I need help.. :-) I don't even know where to find logs...

Thanks!

Here's the full error msg:

The device was unable to connect to the Smart Licensing server. This might indicate a gateway problem for the management interface. Please select Evaluation Mode for now. Then, after completing setup, go to Device > System Settings > Management Interface and verify the management address and gateway configuration. There must be a path from the management IP address to the Internet to complete Smart License registration. You can then go to Device > Smart License and try registering again.

[Marvin Rhoads]

The diagnostic interface is the original source but the packet should arrive on the data plane via your "inside_vlan_900 interface" and flow throught the FTD (or not) based on the policies configured.

It is really odd (possibly a bug?) that we see "Drop-reason: (inspect-dns-invalid-pak) DNS Inspect invalid packet" even though the details showed the LINA (ASA code bits) inspection rules passed the packet.I wonder what would happen if you went in and disabled dns inspection - something like

policy-map global_policy
   class inspection_default
      no inspect dns

This should be possible with a flex-config.

[ammann9113]

I did a "configure inspection dns disable", now the packet-tracer command from above runs without an error.

The license registration still fails though...

[Marvin Rhoads]

I have a 5506-X that I've been meaning to update to Smart license vs the eval mode it had been in.

I will lab it up as soon as I get some time and let you know my results.

[ammann9113]

Thanks a lot, Marvin! Have a good day!

[ammann9113]

For anybody, that might be interested...

I finally found the time to re-image my ASA. And with that, the problem was gone. Same version, same settings but I finally was able to register my device.