Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About niko
01-18-2019
Stats
Member since
11-13-2015
57
Posts
49
Helpful
5
Solutions
12-07-2018
12:50 AM
It is VM indeed. Good to know, missed that recommendation indeed, thanks for noting!
... View more
12-07-2018
12:44 AM
Thanks, tried using 127.0.0.2, but still failed. This bug could be related to classic Firepower, as in case of FTD Platform Settings are for FXOS and not sure if it can use SFtunnel to sync time from FXOS.
Anyway, in the end added different NTP server instead of FMC and it synced successfully, It could be that NTP I used yesterday wasn't reachable or still some shady behavior. So right now this is good enough - time is in sync, using FMC is not mandatory in my case.
... View more
12-07-2018
12:11 AM
Yes.
As mentioned - it was working fine all the way till 6.2.3.5 -> 6.2.3.7 upgrade.
... View more
12-07-2018
12:02 AM
Given it has been 12+ hours since the update - time should have passed enough.
FMC is synced with NTP. I tried switching sync from FMC to NTP server via Platform setting configuration for FTD - made no difference, error re-appeared.
... View more
12-06-2018
12:33 PM
After doing upgrade from 6.2.3.5 to 6.2.3.7 for 2100 series FTP box failover pair new FXOS alarm showed up:
Severity: Major Code: F1329 Last Transition Time: 2018-12-06T17:20:52.586 ID: 555499 Status: None Description: Ntp Configuration failed, please check the error message in Ntp host Affected Object: sys/svc-ext/datetime-svc Name: Comm Date Time Comm Ntp Configuration Failed Cause: Ntp Config Failed Type: Configuration Acknowledged: No Occurrences: 3 Creation Time: 2018-12-06T16:43:12.893 Original Severity: Major Previous Severity: Cleared Highest Severity: Major
At the same time NTP configuration is indeed failing:
FTD# show ntp-overall-status
NTP Overall Time-Sync Status: Ntp Config Failed
NTP config is pushed via FMC Platform settings configuration and NTP time is taken from FMC (which synced with NTP further). Tried using external NTP server for Platform settings - same result.
Given this showed up for both HA boxes and it wasn't there - I guess it's a new "feature" in 6.2.3.7. Have anyone seen this?
... View more
Labels:
07-06-2018
12:50 AM
From the description it sounds like FTD is doing proxy-ARP for that network.
Check your NAT rules and see if that could be the case - it can be seen under Advanced tab for the NAT rule.
https://www.cisco.com/c/en/us/td/docs/security/firepower/610/fdm/fptd-fdm-config-guide-610/fptd-fdm-nat.html
... View more
11-23-2017
11:15 PM
Yes, VPN is not migrated and that is expected - NAT and ACL are converted with exception of some specific cases.
More information: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/asa2ftd-migration/asa2ftd-migration-guide-620/asa2ftd_intro.html#id_30945
... View more
11-17-2017
12:25 AM
Can you elaborate what you require? Is there a new secondary device attached to the HA pair?
Anyway, if you have existing HA pair, you can push all configuration to secondary device by doing #write standby.
... View more
Created by
niko
in Cisco Bug Discussions
in Cisco Bug Discussions
10-10-2017
06:06 AM
10-10-2017
06:06 AM
I see the bug is marked as fixed - how is the fix provided?
... View more
Created by
niko
in Security Management
in Security Management
09-29-2017
06:45 AM
09-29-2017
06:45 AM
Class-map with ACL has been created and that's the one I'm clicking on. Anyway, that's a bug. When trying it on 7.8(2) - failing. When trying on 7.6(2) - showing properly. Nothing changed in configuration, just ASDM version.
... View more
Created by
niko
in Security Management
in Security Management
09-28-2017
01:49 AM
09-28-2017
01:49 AM
5525-X, 9.6(3)14 & ASDM 7.8(2) Trying to understand if I've missed up the configuration ir there's something wrong. Basically, I cannot change SFR redirection status via ASDM for that class-map within service policy. Configuration seems pretty basic: policy-map global_policy class inspection_default <default-inspections> class CLASS-SFR sfr fail-open monitor-only # class-map CLASS-SFR match access-list ACL-SFR ... and ACL contains some permit rules to forward traffic for SFR. That stuff works and I can, for example, enable/disable monitor-only via CLI. When trying to do it via ASDM I get the following message and I'm not able to change anything: But I DON'T have default inspection enabled that policy rule. But I've seen this on two devices, so is there really something wrong with the configuration?
... View more
Labels:
Created by
niko
in Security Management
in Security Management
09-28-2017
01:47 AM
09-28-2017
01:47 AM
Unintentional double post - moderators, please delete.
... View more
Labels:
09-19-2017
11:42 AM
You can connect that branch FP module to your existing FMC. Depends on bandwidth and connection type, but I think generally it will give you better experience than managing FP via ASDM. If you are willing to be pretty much a beta tester, you can go with Firepower Threat Defense image and have a local management via Firepower Device Manager. It is Java-free management for unified image - depending on features you need that may be an option. But be warned - IMHO there's still a lot to do to have a mature product. Some information on FTD and FDM: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/fdm/fptd-fdm-config-guide-620/fptd-fdm-use-cases.html
... View more
09-19-2017
11:22 AM
I'd start by debugging and see why IKE/IPSec SA are not coming up. Information on debug commands: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html#pix_dbgs Useful article about IKE/IPSec on the ASAs and how everything ties together: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113574-tg-asa-ipsec-ike-debugs-main-00.html
... View more
09-19-2017
05:46 AM
You may do this without a restart. I'm assuming the primary firewall is in failed state and secondary is an active one. 1) Disable service module monitoring, save config (do it on the active firewall as usual); 2) Check if the primary firewall is standby ready; 3) If everything looks good, do #no failover active on the secondary/active firewall. 4) Primary should be the active one now, secondary should be standby ready and failover should be in a proper state.
... View more
12-07-2018
Thanks, tried using 127.0.0.2, but still failed. This bug could be
related to classic Firepower, as ...
12-07-2018
Given it has been 12+ hours since the update - time should have passed
enough. FMC is synced with NT...
12-06-2018
After doing upgrade from 6.2.3.5 to 6.2.3.7 for 2100 series FTP box
failover pair new FXOS alarm sho...
07-06-2018
From the description it sounds like FTD is doing proxy-ARP for that
network. Check your NAT rules an...
06-08-2018
Hi, I'm getting an error about expired certificate from FXOS: #show
fault Major F0853 2018-06-02T13:...
11-23-2017
Yes, VPN is not migrated and that is expected - NAT and ACL are
converted with exception of some spe...
11-17-2017
Can you elaborate what you require? Is there a new secondary device
attached to the HA pair? Anyway,...
09-29-2017
Class-map with ACL has been created and that's the one I'm clicking
on.Anyway, that's a bug. When tr...
09-28-2017
5525-X, 9.6(3)14 & ASDM 7.8(2)Trying to understand if I've missed up the
configuration ir there's so...
09-19-2017
You can connect that branch FP module to your existing FMC. Depends on
bandwidth and connection type...
Public Statistics
| Date Registered | 11-13-2015 06:37 AM |
| Date Last Visited | 01-18-2019 07:17 AM |
| Total Messages Posted | 57 |
| Total Helpful Votes Received | 49 |
.jpg "Hall of Fame Master"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 9 | |
| 10 |
