FirePOWER: ‘No Authentication Required’ No Usernames
KB ID 0001460 Problem When attempting to track Users with FirePOWER, the FMC would not show any usernames? Solution Theres a lot of reasons this might not work, let’s take a look at a few of them. Firstly make sure the server running the ‘user agent’ is listed under System >Integration > Identity Sources > User Agent. It probably goes without saying, but over on server running the user agent, make sure it...
Updating FirePOWER Module (From ASDM)
KB ID 0001348 Problem Normally I don’t like upgrading the SFR this way. But then I tend to install new firewalls set them up and walk away, so its easier (and a LOT quicker) to simply image the module to the latest version and then set it up. Like So; Re-Image and Update the Cisco FirePOWER Services Module This week I had an existing customer, who has an ASA5508-X but wasn’t using his FirePOWER, I’d installed the...
FirePOWER – ‘DataPlaneInterface0’ is not receiving and packets
KB ID 0001344 Problem While replacing a FirePOWER Management console, I got this error; Interface Status Interface ‘DataPlaneInterface0’ is not receiving any packets Solution A look a the health monitor showed me the same thing; Firstly, common sense dictates, that this is a live firewall and traffic is actually flowing though it? In my case the traffic simply needed to be ‘sent though’ the module. Execute...
Cisco FirePOWER User Agent – Use With the FirePOWER Management Console
KB ID 0001179 Problem FirePOWER Management Center, will give you a wealth of information on traffic/threats etc. Usually it will tell you what IP the offenders are on, but if you want to know what a USER is doing, then that means you have to look though logs see who had what IP, at what time etc. So you can install the FirePOWER User Agent on a machine, (this can be a client machine, though I usually put it on a member server). You...
FirePOWER Agent – Real-Time Status ‘Unavailable’
KB ID 0001323 D Problem I was deploying a Cisco FirePOWER user agent last week, but once setup, the agent reported that the Real-Time status for SOME of the domain controllers was permanently ‘Unavailable’. Now I know you have to be patient with these things so I went and had a coffee. Still it refused to ‘go green’. Solution I addition to all the other rights and firewall rules that you normally have to check....
Cisco FirePOWER Management Center Appliance – Allowing Domain Authentication
KB ID 0001117 Problem Once deployed, authentication is handled by the appliances own internal user database, in larger organisations this is a little impractical. So the ability to create an Active Directory Group, and delegate access to Firesight to members of that group is a little more versatile. Solution I’m making the assumption that the appliance does not already have external authentication setup at all, so I’ll...
Deploy Cisco FirePOWER Management Center (Appliance)
KB ID 0001263 Problem You have been able to manage your firewalls Internal SFR module for while using the ASDM Setup FirePOWER Services (for ASDM) For most people that’s fine, but if you have a lot of FirePOWER devices to manage that does not scale well. In those cases you should use theFMC (FirePOWER Management Center). Here ‘Im going to use the Vmware virtual appliance, (at time of writing there is no Hyper-V version)....
Cisco Add FirePOWER Module to FirePOWER Management Center
KB ID 0001178 Problem If you only have one FirePOWER service module you can now manage it from the ASDM; ASA 5505-X / 5508-X Setup FirePOWER Services (for ASDM) But if you have got more than one, and you can manage them centrally with the FirePOWER Management Center, (formally SourceFIRE Defence Center). WARNING: If you are going to use FMC DON’T register your licences in the ASDM, they all need to be registered in the FMC. ...
Cisco Firepower Services – Change IP and DNS Addresses
KB ID 0001173 Problem If you change your internal LAN addresses its easy to re-ip the firewall but what about the FirePOWER module? If you manage your SFR from the ASDM it will tell you what the IP is, but it won’t let you change it? Solution Change the FirePOWER Module IP Address Log into the firewall, then open a session with the SFR module. find the physical address of the module (usually eth0, but check). Petes-ASA#...
Cisco FirePOWER – Update Fails ‘Peer Registration Failed: Registration in Progress’
KB ID 0001162 Problem If you attempt to perform an update on the FirePOWER services module in your firewall, you may see the following error; Error Installation Failed: Peer registration in progress. Please retry in a few moments I found myself in this situation because I’d attempted to register the firewall in the FirePOWER Management Center Appliance, and the process failed, (because the versions were different). So when I...