Solved: Unable to register ASA with FP services at FMC

pgerstenberger · ‎12-18-2018

Hello Community,

I´m not able to register my ASA with Firepower at the FMC after I deleted the device. Following error message at the FMC:

FMC: pigtail | grep -IP

MSGS: 12-18 09:32:42 ifs-fire-v1 SF-IMS[5083]: [5083] sfmgr:sfmanager [INFO] set peer PEER_ADD to register FP-IP-OF-ASA
MSGS: 12-18 09:32:42 ifs-fire-v1 SF-IMS[5082]: [5082] sftunneld:sf_peers [INFO] Using a 20 entry queue for FP-IP-OF-ASA - 8104
MSGS: 12-18 09:32:42 ifs-fire-v1 SF-IMS[5082]: [5082] sftunneld:sf_peers [INFO] Using a 20 entry queue for FP-IP-OF-ASA - 8121
MSGS: 12-18 09:32:42 ifs-fire-v1 SF-IMS[5082]: [5082] sftunneld:stream_file [INFO] Stream CTX initialized for FP-IP-OF-ASA
MSGS: 12-18 09:32:42 ifs-fire-v1 SF-IMS[5082]: [5082] sftunneld:sftunnel [INFO] set peer PEER_ADD FP-IP-OF-ASA to register
MOJO: 12-18 09:32:42 [Tue 2018] [info] [5854] Exists file /var/sf/peers/FP-IP-OF-ASA/mgr.sox? 180 at PERLLIB/SF/PeerManager/RegUtils.pm line 629.
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [5139] sftunneld:sf_peers [INFO] Peer FP-IP-OF-ASA needs a single connection
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [5139] sftunneld:sf_connections [INFO] Start connection to : FP-IP-OF-ASA (wait 0 seconds is up)
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_peers [INFO] Peer FP-IP-OF-ASA needs a single connection
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_ssl [INFO] Connect to FP-IP-OF-ASA on port 8305 - eth0
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_ssl [INFO] Initiate IPv4 connection to FP-IP-OF-ASA (via eth0)
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_ssl [INFO] Initiating IPv4 connection to FP-IP-OF-ASA:8305/tcp
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_ssl [INFO] Wait to connect to 8305 (IPv6): FP-IP-OF-ASA
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_ssl [INFO] Connected to FP-IP-OF-ASA:8305 (IPv4)
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_ssl [INFO] Successfully connected using SSL to: 'FP-IP-OF-ASA'
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_ssl [INFO] Peer FP-IP-OF-ASA supports separate events connection
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_ssl [INFO] Peer FP-IP-OF-ASA registration is complete remotely
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_ssl [INFO] Connect: AUTHENTICATED peer 'FP-IP-OF-ASA'
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_peers [INFO] Peer FP-IP-OF-ASA needs a single connection
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_ssl [INFO] Connect: Start child thread for peer 'FP-IP-OF-ASA'
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_channel [INFO] >>>>>>> initChannels peer: FP-IP-OF-ASA <<<<<<
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:stream_file [INFO] Stream CTX destroyed for FP-IP-OF-ASA
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_connections [INFO] Socket '/var/sf/peers/FP-IP-OF-ASA/conn.sox': 71 is accepting services.
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:stream_file [INFO] Stream CTX initialized for FP-IP-OF-ASA
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_connections [INFO] Peer FP-IP-OF-ASA main thread started
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_heartbeat [INFO] Saved SW VERSION from peer FP-IP-OF-ASA (6.2.3.2)
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_connections [INFO] Need to send SW version and Published Services to FP-IP-OF-ASA
MSGS: 12-18 09:32:47 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_channel [INFO] >> ChannelState do_dataio_for_heartbeat peer FP-IP-OF-ASA / channelA / CONTROL [ msgSock & ssl_context ] <<
MSGS: 12-18 09:32:50 ifs-fire-v1 SF-IMS[5083]: [5201] sfmgr:sfmanager [INFO] Established connection to sftunnel for peer FP-IP-OF-ASA (fd 18)
MSGS: 12-18 09:32:50 ifs-fire-v1 SF-IMS[5083]: [10675] sfmgr:sfmanager [INFO] Writing out service number - SFMGR for peer FP-IP-OF-ASA
MSGS: 12-18 09:32:50 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_heartbeat [INFO] RPC Service is published for peer FP-IP-OF-ASA.
MSGS: 12-18 09:32:50 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_peers [INFO] Using a 20 entry queue for FP-IP-OF-ASA - 6666
MSGS: 12-18 09:32:50 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_connections [INFO] Need to send SW version and Published Services to FP-IP-OF-ASA
MSGS: 12-18 09:32:50 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_channel [INFO] >> ChannelState do_dataio_for_heartbeat peer FP-IP-OF-ASA / channelA / CONTROL [ msgSock & ssl_context ] <<
MSGS: 12-18 09:32:50 ifs-fire-v1 SF-IMS[5083]: [10674] sfmgr:sfmanager [INFO] Waiting for RPC service to be published on peer FP-IP-OF-ASA
MSGS: 12-18 09:32:52 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_heartbeat [INFO] Saved SW VERSION from peer FP-IP-OF-ASA (6.2.3.2)
MSGS: 12-18 09:32:52 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_heartbeat [INFO] (2)FORWARDED Product Info received from peer FP-IP-OF-ASA to SFMGR
MSGS: 12-18 09:32:52 ifs-fire-v1 SF-IMS[5083]: [10674] sfmgr:sfmanager [INFO] SFMGR is published on peer FP-IP-OF-ASA
MSGS: 12-18 09:32:52 ifs-fire-v1 SF-IMS[5083]: [10674] sfmgr:sfmanager [INFO] SFMGR: UNIX socket '/var/sf/peers/FP-IP-OF-ASA/mgr.sox': 19 is listening...
MOJO: 12-18 09:32:56 [Tue 2018] [info] [5854] Remote::SF::PeerManager::getPeerInfoLocal(FP-IP-OF-ASA): Permission denied (role=manager) for peer IP-OF-FMC,07cbfcae-cf87-11e7-a4be-78217e6a16c9,07cbfcae-cf87-11e7-a4be-78217e6a16c9) to execute SF::PeerManager::getPeerInfoLocal. at PERLLIB/SF/RemoteRun.pm line 835.
MOJO: 12-18 09:33:10 [Tue 2018] [info] [5854] Remote::SF::PeerManager::getPeerInfoLocal(FP-IP-OF-ASA): Permission denied (role=manager) for peer IP-OF-FMC,07cbfcae-cf87-11e7-a4be-78217e6a16c9,07cbfcae-cf87-11e7-a4be-78217e6a16c9) to execute SF::PeerManager::getPeerInfoLocal. at PERLLIB/SF/RemoteRun.pm line 835.
MOJO: 12-18 09:33:24 [Tue 2018] [info] [5854] Remote::SF::PeerManager::getPeerInfoLocal(FP-IP-OF-ASA): Permission denied (role=manager) for peer IP-OF-FMC,07cbfcae-cf87-11e7-a4be-78217e6a16c9,07cbfcae-cf87-11e7-a4be-78217e6a16c9) to execute SF::PeerManager::getPeerInfoLocal. at PERLLIB/SF/RemoteRun.pm line 835.
MOJO: 12-18 09:33:38 [Tue 2018] [info] [5854] Remote::SF::PeerManager::getPeerInfoLocal(FP-IP-OF-ASA): Permission denied (role=manager) for peer IP-OF-FMC,07cbfcae-cf87-11e7-a4be-78217e6a16c9,07cbfcae-cf87-11e7-a4be-78217e6a16c9) to execute SF::PeerManager::getPeerInfoLocal. at PERLLIB/SF/RemoteRun.pm line 835.
MOJO: 12-18 09:37:08 [Tue 2018] [info] [5854] Not Connected FP-IP-OF-ASA... at PERLLIB/SF/PeerManager/RegUtils.pm line 771.
MOJO: 12-18 09:37:08 [Tue 2018] [info] [5854] Could not establish connection with FP-IP-OF-ASA at PERLLIB/SF/PeerManager/Registration.pm line 1284.
MSGS: 12-18 09:37:09 ifs-fire-v1 SF-IMS[5083]: [5083] sfmgr:sfmanager [INFO] set peer PEER_REMOVED pending FP-IP-OF-ASA
MSGS: 12-18 09:37:09 ifs-fire-v1 SF-IMS[5083]: [5083] sfmgr:sfmanager [INFO] MARK TO FREE peer FP-IP-OF-ASA
MSGS: 12-18 09:37:09 ifs-fire-v1 SF-IMS[5082]: [5082] sftunneld:sftunnel [INFO] set peer PEER_REMOVED FP-IP-OF-ASA pending
MSGS: 12-18 09:37:09 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_connections [INFO] Peer FP-IP-OF-ASA is removed...Exiting child thread
MSGS: 12-18 09:37:09 ifs-fire-v1 SF-IMS[5082]: [10577] sftunneld:sf_connections [INFO] <<<<<<<<<<<<<<<<<<<<<< ShutDownPeer FP-IP-OF-ASA >>>>>>>>>>>>>>>>>>>>>>>>

Restart of FMC and ASA did not solve the problem by the way.

Thanks in advance!

Greetings

Philipp

pgerstenberger · ‎12-18-2018

Hello Marvin,

yes. I already tried to delete and add the manager without success. But meanwhile i solved the problem.

I made manually an update of the Firepower instance of the ASA. After that i was able to register the device in the FMC again.

I followed these instructions which solved my problem.

https://ciscoskills.net/2017/07/12/update-firepower-devices-manually/

Thanks and regards,

Philipp

View solution in original post

Marvin Rhoads · ‎12-18-2018

Did you try to "configure manager delete" and then "configure manager add" from the ASA Firepower service module?

pgerstenberger · ‎12-18-2018

Hello Marvin,

yes. I already tried to delete and add the manager without success. But meanwhile i solved the problem.

I made manually an update of the Firepower instance of the ASA. After that i was able to register the device in the FMC again.

I followed these instructions which solved my problem.

https://ciscoskills.net/2017/07/12/update-firepower-devices-manually/

Thanks and regards,

Philipp