Ok so after a bit more troubleshooting I found the following in the /var/log/update.status:
**********************************************************
OUT: [180517 14:59:39:999] Starting script: 200_pre/009_check_snort_preproc.sh
OUT: Entering 200_pre/009_check_snort_preproc.sh...
OUT:
OUT: Incompatible Dynamic Preprocessors detected! Please reapply policy before continuing. If this error continues, contact support.
OUT: **********************************************************
This made me decide to downgrade back to 6.2.3 on FMC. After the downgrade I'm able to push the Access Control Policy towards the firewall.
So an overview of the problem I was facing:
FMC HA pair was on 6.2.3.1
FTD was on 6.2.3
I was unable to push the ACP and was getting the error:
May 18 06:40:29 The 'source' parameter ("/var/cisco/deploy/sandbox/snort-pkg/usr/local/sf/lib/snort/2.9.12-204/bin/fwrulechecker") to SF::System::copy did not pass the 'Type Validator (system.file)' callback
I was unable to upgrade FTD to 6.2.3 and was getting the error I pasted above.
I was unable to do a snort rule upgrade on the FTD's. FMC was able to download them and install them on FMC but not on FTD.
I also tried to manually install 6.2.3.1 on FTD but that generated the following error:
admin@ftd:/ngfw/var/sf/updates$ sudo install_update.pl --readiness-check6.2.3.1-43.sh.REL.tar
ARGV[0] = --readiness-check
ARGV[1] = Cisco_FTD_Patch-6.2.3.1-43.sh.REL.tar
install_update.pl begins. bundle_filepath: Cisco_FTD_Patch-6.2.3.1-43.sh.REL.tar
System (/ngfw/usr/local/sf/bin/verify_signed_image.sh -s /ngfw/var/tmp/sigstatus_uBvPa0Ty -i Cisco_FTD_Patch-6.2.3.1-43.sh.REL.tar) Failed to verify signature. at /ngfw/usr/local/sf/lib/perl/5.10.1/SF/System/Privileged.pm line 6001.
Package has bad signature! Cisco_FTD_Patch-6.2.3.1-43.sh.REL.tar at /ngfw/usr/local/sf/lib/perl/5.10.1/SF/Update.pm line 370.
Update is not valid at /ngfw/usr/local/sf/bin/install_update.pl line 485.
So as far as I can see I can't use patch1 for 6.2.3
When I upgrade the FMC 6.2.3 I'm unable to push an APC or upgrade FTD. I have a feeling both issues are linked together and generate a catch22.
Any thoughts?
