Retrieving Coredump of an ASA running on Firepower platform

akapande · ‎04-29-2020

This is an English translation of the Japanese version(link)

The 'coredump enable' command like the one described here--

https://community.cisco.com/t5/security-documents/enabling-coredump-on-the-asa/ta-p/3124802

is not implemented on the ASA running on Firepower Platform. Instead, if an unauthorized reboot occurs in the ASA running on Firepower Platform, the coredump will be automatically recorded in the disk on FXOS as a core.lina file. As for the crashinfo, it is saved on the ASA side.

The method to transfer the coredump recorded on FXOS to the FTP Server is described below.

firepower-2130# connect local-mgmt                                         
firepower-2130(local-mgmt)# dir workspace:/cores                           

1 119687295 Jan 10 07:15:31 2020 core.lina.core-5.6.1652.1578640497.gz     
2     16384 Jan 09 05:16:01 2020 lost+found/                               
3      4096 Jan 09 05:16:56 2020 sysdebug/

Usage for workspace://
167921864704 bytes total
201359360 bytes used                                                       
167720505344 bytes free                                                    
firepower-2130(local-mgmt)# copy workspace:/cores/core.lina.core-5.6.1652.1578640497.gz ftp://username:password@host_ip/
Server name/IP: <host_ip>                                              
Remote username: username                                                  
Remote filepath:                                                           
Connected to <host_ip>
220 HOGE Fileserver
331 Please specify the password.
Password:                                                                  
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
200 Switching to Binary mode.
local: /opt/cisco/csp/workspace/cores/core.lina.core-5.6.1652.1578640497.gz remote: core.lina.core-5.6.1652.1578640497.gz
229 Entering Extended Passive Mode (|||2022|).
150 Ok to send data.
100% |*********************************************************************************************************|   114 MiB   26.79 MiB/s    00:00 ETA
226 Transfer complete.                                                    
119687295 bytes sent in 00:04 (26.76 MiB/s)
221 Goodbye.
firepower-2130(local-mgmt)#

ciscoasa# dir

Directory of disk0:/

1069804  drwx  49           05:20:56 Jan 09 2020  log
268445163  -rw-  33696792     07:26:58 Jan 09 2020  asdm.bin
268445173  drw-  25           07:14:57 Jan 10 2020  coredumpinfo
537544773  -rw-  9283         06:34:47 Jan 09 2020  ppg.cfg
537544774  drwx  21           05:19:42 Jan 09 2020  smart-log
537544736  -rw-  123634       07:14:57 Jan 10 2020  crashinfo_lina.1652.20200110.071445

3 file(s) total size: 33829709 bytes
21475885056 bytes total (21319647232 bytes free/99% free)

ciscoasa#

akapande · ‎04-29-2020

Alternatively you can also use SCP, SFTP or TFTP to export

Edit:

Starting from 9.13, ASA running on Firepower 2100 will have appliance mode by default. In that case the core file has to be copied from the ASA CLI instead of FXOS.

ciscoasa# show flash:
--#-- --length-- -----date/time------ path
268609320 49 Aug 16 2019 00:47:20 log
134284672 133 Apr 30 2020 22:05:01 log/ssp_tz
134284677 36145 Apr 30 2020 22:05:00 log/ssp_tz/ssp_tz.log.1.gz
134284674 36150 Apr 30 2020 14:45:00 log/ssp_tz/ssp_tz.log.5.gz
134284715 36131 Apr 30 2020 16:35:00 log/ssp_tz/ssp_tz.log.4.gz
134284676 36317 Apr 30 2020 18:25:00 log/ssp_tz/ssp_tz.log.3.gz
134284696 36045 Apr 30 2020 20:15:00 log/ssp_tz/ssp_tz.log.2.gz
134284673 458364 Apr 30 2020 23:41:56 log/ssp_tz/ssp_tz.log
268609280 123 Aug 24 2019 03:32:36 log/from_tmp
268609281 370641 Apr 30 2020 23:35:38 log/from_tmp/asa-ssp_ntp.log
268609282 101365 Apr 30 2020 22:03:06 log/from_tmp/asa-appagent.log
268609283 424092 Apr 30 2020 12:55:43 log/from_tmp/asa-miovif.log
268609284 5242989 Nov 22 2019 16:38:59 log/from_tmp/asa-miovif.log.bak
268609285 5242899 Nov 20 2019 23:44:57 log/from_tmp/asa-ssp_ntp.log.bak
402669760 147 Jan 07 2020 09:52:51 log/ssp_ntpd
402669761 339247 Jan 07 2020 09:52:48 log/ssp_ntpd/ssp_ntp.log.sav
402669762 2504 Jan 07 2020 09:52:48 log/ssp_ntpd/ntp.log.sav
402669763 260398 Apr 30 2020 01:34:57 log/ssp_ntpd/ssp_ntp.log
402669764 9465 Apr 30 2020 01:46:13 log/ssp_ntpd/ntp.log
402669765 43119 Sep 09 2019 19:56:15 log/ssp_ntpd/ssp_ntp.log.3.gz
402669766 43339 Oct 07 2019 15:56:35 log/ssp_ntpd/ssp_ntp.log.2.gz
402669767 43773 Nov 04 2019 11:56:14 log/ssp_ntpd/ssp_ntp.log.1.gz
134284693 34033084 Apr 30 2020 00:45:28 asdm.bin
134284697 6 Jan 07 2020 10:54:02 fxos
268609286 21 Nov 28 2019 03:43:20 datatracprivate-storage
402669768 6 Nov 28 2019 03:43:20 datatracprivate-storage/DataTrac
134284698 6 Nov 28 2019 03:41:34 shared-storage
134284700 7744 Nov 30 2019 02:00:44 old_running.cfg
134284701 23830 Jan 31 2020 03:56:04 admin.cfg
134284702 2151 Dec 08 2019 01:20:05 custa
134284703 39856 Dec 08 2019 01:20:06 datatrac
134284704 3550 Dec 08 2019 01:20:07 managed-cust
134284705 5003 Dec 11 2019 06:48:26 oldconfig_2019Dec11_0814.cfg
268609287 25 Nov 28 2019 03:43:32 MCprivate-storage
402669781 6 Nov 28 2019 03:43:32 MCprivate-storage/Managed-Cust
62788 21 Aug 16 2019 00:47:03 smart-log
62789 25898 Apr 30 2020 01:35:52 smart-log/agentlog
134284706 25 Aug 16 2019 00:47:06 coredumpinfo
134284707 59 Aug 16 2019 00:47:06 coredumpinfo/coredump.cfg
134284714 18 Nov 28 2019 03:41:33 adminprivate-storage
268609334 58 Jan 31 2020 03:37:20 adminprivate-storage/admin
268609335 377498912 Dec 11 2019 04:15:35 adminprivate-storage/admin/cisco-asa-fp2k.9.13.1.SPA
268609336 34033084 Jan 31 2020 03:37:47 adminprivate-storage/admin/asdm-7131.bin
134284699 4096 Oct 30 2019 03:57:32 cores
32577 4096 Aug 16 2019 00:44:18 cores/sysdebug
32578 4096 Aug 16 2019 00:44:18 cores/sysdebug/tftpd_logs
11 16384 Aug 16 2019 00:43:28 cores/lost+found

21475885056 bytes total (20892876800 bytes free)


ciscoasa# copy flash:/cores/core.lina.core-5.6.1652.1578640497.gz ftp://username:password@host_ip/

PS: Firepower 1000 runs only Appliance mode.

Martin L · ‎04-29-2020

thanks for sharing!