FirePOWER6 FMC and FTD

Before posting something, READ the changelog, WATCH the videos, howto and provide following:
Your install is: Bare metal, ESXi, what CPU model, RAM, HD, what EVE version you have, output of the uname -a and any other info that might help us faster.

Moderator: mike

Post Reply
Felixsson1
Posts: 1
Joined: Sat Feb 11, 2023 9:23 pm

FirePOWER6 FMC and FTD

Post by Felixsson1 » Fri Aug 18, 2023 3:07 pm

Hi,

I would really appreciate someone's help. I spent too much time and having no clue what's wrong..

I have a setup of simple lab in EVE-NG. I've added a static IP to Firepower6 FMC (version 7.2.0) and works normally. I've tried adding a static IP and over DHCP to Firepower6 FTD (version 6.2.0) and it also works ok. Ping from PC to FTD and FMC goes through. In expert mode both of the devices can ping each other, PC, Google DNS.. But I got stuck with adding the FTD to the FMC. Always after 2min 6sec I get and error saying "FTD-1: Registration timed out. Please check connectivity and registration id".

Connectivity is ok, key is def ok. I've also tried adding a static route to the br1 interface pointing to the FMC but without success.

> show network
===============[ System Information ]===============
Hostname : ftd.local
DNS Servers : 8.8.8.8
4.2.2.2
Management port : 8305
IPv4 Default route
Gateway : 192.168.100.1

======================[ br1 ]=======================
State : Enabled
Channels : Management & Events
Mode : Non-Autonegotiation
MDI/MDIX : Auto/MDIX
MTU : 1500
MAC Address : 00:50:00:00:09:01
----------------------[ IPv4 ]----------------------
Configuration : Manual
Address : 192.168.100.101
Netmask : 255.255.255.0
Broadcast : 192.168.100.255
----------------------[ IPv6 ]----------------------
Configuration : Disabled

===============[ Proxy Information ]================
State : Disabled
Authentication : Disabled

> show interface ip brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 unassigned YES unset administratively down up
GigabitEthernet0/1 unassigned YES unset administratively down up
GigabitEthernet0/2 unassigned YES unset administratively down up
GigabitEthernet0/3 unassigned YES unset administratively down up
Internal-Control0/0 127.0.1.1 YES unset up up
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/1 169.254.1.1 YES unset up up
Management0/0 unassigned YES unset up up

admin@ftd-felix:~$ ifconfig br1
br1 Link encap:Ethernet HWaddr 00:50:00:00:09:01
inet addr:192.168.100.101 Bcast:192.168.100.255 Mask:255.255.255.0
inet6 addr: fe80::250:ff:fe00:901/64 Scope:Link
UP BROADCAST RUNNING MTU:1500 Metric:1
RX packets:1974 errors:0 dropped:0 overruns:0 frame:0
TX packets:1517 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:177519 (173.3 KiB) TX bytes:231782 (226.3 KiB)

I've also tried switching from QEMU Nic tpl(e1000) to e1000, vmxnet3 and few others but again without success. In some of them instead of br1 it's eth0 but still the same issue. What I'm doing wrong?

EDIT:
I've found out that FMC is not listening on management port 8305. The sftunnel is up and running but then again I saw that the sftunnel.conf file is corrupted.

root@fmc-felix:/Volume/home/admin# pmtool status | grep -i sftunnel
Required by: SFDataCorrelator,UIMP,TSS_Daemon,HostInput_Daemon,sfestreamer,estreamer-sftunnel,fpcollect,Syncd,expire-session,Pruner,fireamp,stunnel,ActionQueueScrape,PerlMessageHandler,update_snort_attrib_table,snapshot_manager,SFTop10Cacher,query_scheduler,VaultApp,HealthAlertServer,EventHandler
sftunnel (system) - Running 5377
Command: /usr/local/sf/bin/sftunnel -d -f /etc/sf/sftunnel.conf
PID File: /var/sf/run/sftunnel.pid
Enable File: /etc/sf/sftunnel.conf
Required by: sfmgr,sfmbservice,estreamer-sftunnel,sfipproxy
Command: /usr/local/sf/bin/sfmgr -d -f /etc/sf/sftunnel.conf
Enable File: /etc/sf/sftunnel.conf
Requires: sftunnel
Command: /usr/local/sf/bin/sfmbservice -d -f /etc/sf/sftunnel.conf
Enable File: /etc/sf/sftunnel.conf
Requires: sfmb,sftunnel
estreamer-sftunnel (normal) - Running 6040
Command: /usr/local/sf/bin/sfestreamer --nodaemon --sftunnel
PID File: /var/sf/run/estreamer-sftunnel.pid
Requires: mysqld,sftunnel
Requires: sftunnel

-rw-r--r-- 1 root root 1474 Aug 17 09:45 sftunnel.conf.CORRUPT

I've tried restarting the process but without help. I'm stuck with this issue for the last 2 days.. :!:

Uldis (UD)
Posts: 5086
Joined: Wed Mar 15, 2017 4:44 pm
Location: London
Contact:

Re: FirePOWER6 FMC and FTD

Post by Uldis (UD) » Sat Aug 19, 2023 7:18 pm

https://www.eve-ng.net/index.php/lab-li ... rity-labs/

The lab: Cisco Firepower Policies Lab
Has also a workbook, and it is proof of 100% working stuff of Firepower on the EVE-NG
Attached zipped pdf workbook of this lab
You do not have the required permissions to view the files attached to this post.

bernhardjami
Posts: 12
Joined: Tue Mar 07, 2023 4:31 am

Re: FirePOWER6 FMC and FTD

Post by bernhardjami » Wed Sep 06, 2023 9:49 am

Cisco Firepower Policies Laboratory.
Includes a guidebook and confirms that everything described in Firepower on EVE-NG actually works
Please find the lab's zipped pdf workbook attached. geometry dash

Post Reply