You can directly SSH to the Cisco FirePOWER Module IP address or issue the session sfr console from the ASA privileged EXEC mode. Below are some useful Cisco FirePOWER Module troubleshooting commands via the command line interface (CLI). These commands are also the same on the Firepower Threat Defense (FTD) device.
$ ssh -l admin 172.27.5.18
The authenticity of host '172.27.5.18 (172.27.5.18)' can't be established.
RSA key fingerprint is b7:d4:2e:76:c3:2a:1d:46:a5:a2:f0:7e:73:d1:12:34.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.27.5.18' (RSA) to the list of known hosts.
Password:
Last login: Thu Dec 21 04:15:09 2017
Copyright 2004-2017, Cisco and/or its affiliates. All rights reserved.
Cisco is a registered trademark of Cisco Systems, Inc.
All other trademarks are property of their respective owners.
Cisco Fire Linux OS v6.2.0 (build 42)
Cisco ASA5506H v6.2.0 (build 362)
>
ciscoasa# session ?
Available module ID(s):
sfr Module ID
ongc-11high-FW02# session sfr ?
console Login to console port on another module.
do Execute a command on another module.
ip Configure Module logging port ip addresses
<cr>
ciscoasa# session sfr console
Opening console session with module sfr.
Connected to module sfr. Escape character sequence is 'CTRL-^X'.
>
Displaying the Access Control Policy Details
You can use the show access-control-config command to view the access control policy configuration.
> show
access-control-config Show Current Access-Control Configuration
audit-cert Display audit_log cert if any
audit-log Show audit log
cpu Show CPU utilization
database Change to Show Database Mode
device-settings Show device settings
disk Show disk usage
disk-manager Display current status of local disk(s)
dns Show DNS configuration
hostname Show hostname
hosts Show hosts
ifconfig Show currently configured interfaces
interfaces Show interface configuration
kdump Display status of kernel crash dump feature
log-events-to-ramdisk Display Logging of Events to hard disk
log-ips-connection Display Logging of Connection Events setting
managers Show managing Defense Centers
memory Show available memory
model Show model
netstat Show network connections
network Show configuration of management interface
network-static-routes Show static routes for management interfaces
ntp Show NTP configuration
perfstats Show perfstats
process-tree Show processes in tree format
processes Show processes
route Show configured routes
serial-number Show serial number
ssl-policy-config Show Current SSL Policy Configuration
summary Show summary
syslog Show syslog <filter> <max lines per page>
time Show time
traffic-statistics Show traffic statistics
user Show specified users
users Show all users
version Show versions
Show> access-control-config
===========[ Default Allow All Traffic ]============
Description :
=================[ Default Action ]=================
Default Action : Fast-path
Logging Configuration
DC : Disabled
Beginning : Disabled
End : Disabled
Rule Hits : 0
Variable Set : Default-Set
===[ Security Intelligence - Network Whitelist ]====
Name : Global-Whitelist (List)
IP Count : 0
Zone : any
===[ Security Intelligence - Network Blacklist ]====
Logging Configuration : Enabled
DC : Enabled
---------------------[ Block ]----------------------
Name : Global-Blacklist (List)
IP Count : 0
Zone : any
=====[ Security Intelligence - URL Whitelist ]======
Name : Global-Whitelist-for-URL (List)
URL Count : 0
Zone : any
=====[ Security Intelligence - URL Blacklist ]======
Logging Configuration : Enabled
DC : Enabled
---------------------[ Block ]----------------------
Name : Global-Blacklist-for-URL (List)
URL Count : 0
Zone : any
=======[ Security Intelligence - DNS Policy ]=======
Name : Default DNS Policy
Logging Configuration : Enabled
DC : Enabled
======[ Rule Set: admin_category (Built-in) ]=======
=====[ Rule Set: standard_category (Built-in) ]=====
=======[ Rule Set: root_category (Built-in) ]=======
===============[ Advanced Settings ]================
General Settings
Maximum URL Length : 1024
Interactive Block Bypass Timeout : 600
Do not retry URL cache miss lookup : No
Inspect Traffic During Apply : Yes
Network Analysis and Intrusion Policies
Initial Intrusion Policy : No Rules Active
Initial Variable Set : Default-Set
Default Network Analysis Policy : Balanced Security and Connectivity
Files and Malware Settings
File Type Inspect Limit : 1460
Cloud Lookup Timeout : 2
Minimum File Capture Size : 6144
Maximum File Capture Size : 1048576
Min Dynamic Analysis Size : 15360
Max Dynamic Analysis Size : 2097152
Malware Detection Limit : 10485760
Transport/Network Layer Preprocessor Settings
Detection Settings
Ignore VLAN Tracking Connections : No
Maximum Active Responses : No Maximum
Minimum Response Seconds : No Minimum
Session Termination Log Threshold : 1048576
Detection Enhancement Settings
Adaptive Profile : Disabled
Performance Settings
Event Queue
Maximum Queued Events : 5
Disable Reassembled Content Checks: False
Performance Statistics
Sample time (seconds) : 300
Minimum number of packets : 10000
Summary : False
Log Session/Protocol Distribution : False
Regular Expression Limits
Match Recursion Limit : Default
Match Limit : Default
Rule Processing Configuration
Logged Events : 5
Maximum Queued Events : 8
Events Ordered By : Content Length
Intelligent Application Bypass Settings
State : Off
Bypassable Applications and Filters : 0 Applications/Filters
Latency-Based Performance Settings
Packet Handling : Disabled
=============[ Interactive Block HTML ]=============
HTTP/1.1 200 OK
Connection: close
Content-Length: 869
Content-Type: text/html; charset=UTF-8
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8" />
<title>Access Denied</title>
<style type="text/css">body {margin:0;font-family:verdana,sans-serif;} h1 {margin:0;padding:12px 25px;background-
color:#343434;color
:#ddd} p {margin:12px 25px;} strong {color:#E0042D;}</style>
</head>
<body>
<h1>Access Denied</h1>
<p>
<strong>You are attempting to access a forbidden site.</strong><br/><br/>
You may continue to the site by clicking on the button below.<br/>
<em>Note:</em> You must have cookies enabled in your browser to continue.</br><br/>
Consult your system administrator for details.<br/><br/>
<noscript><em>This page uses Javascript. Your browser either doesn't support Javascript or you have it turned off.<br/>
To continue to the site, please use a Javascript enabled browser.</em></noscript>
</p>
</body>
</html>
Displaying the Network Configuration
There are several ways to view the network configuration on a Cisco FirePOWER Module.
> show network
===============[ System Information ]===============
Hostname : firepower
Domains : example.net
Management port : 8305
IPv4 Default route
Gateway : 172.27.5.19
======================[ eth0 ]======================
State : Enabled
Channels : Management & Events
Mode : Non-Autonegotiation
MDI/MDIX : Auto/MDIX
MTU : 1500
MAC Address : 50:0F:80:80:AB:CD
----------------------[ IPv4 ]----------------------
Configuration : Manual
Address : 172.27.5.18
Netmask : 255.255.255.224
Broadcast : 172.27.5.19
----------------------[ IPv6 ]----------------------
Configuration : Disabled
===============[ Proxy Information ]================
State : Disabled
Authentication : Disabled
> show ifconfig // SIMILAR TO LINUX ifconfig COMMAND
cplane Link encap:Ethernet HWaddr 00:00:00:02:00:01
inet addr:127.0.2.1 Bcast:127.0.255.255 Mask:255.255.0.0
inet6 addr: fe80::200:ff:fe02:1/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:7593492 errors:0 dropped:3777883 overruns:0 frame:0
TX packets:1908174 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:478730921 (456.5 Mb) TX bytes:175547469 (167.4 Mb)
eth0 Link encap:Ethernet HWaddr 50:0F:80:80:AD:DC
inet addr:172.27.5.18 Bcast:172.27.5.19 Mask:255.255.255.0
inet6 addr: fe80::520f:80ff:fe80:addc/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:41729 errors:0 dropped:0 overruns:0 frame:0
TX packets:63173 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:5891158 (5.6 Mb) TX bytes:58229136 (55.5 Mb)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.255.255.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:355317 errors:0 dropped:0 overruns:0 frame:0
TX packets:355317 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:45879853 (43.7 Mb) TX bytes:45879853 (43.7 Mb)
tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:169.254.0.1 P-t-P:169.254.0.1 Mask:255.255.0.0
inet6 addr: fdcc::bd:0:ffff:a9fe:1/64 Scope:Global
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
> show interfaces
--------------------[ outside ]---------------------
Physical Interface : GigabitEthernet1/1
Type : ASA
Security Zone : None
Status : Enabled
Load Balancing Mode : N/A
---------------------[ inside ]---------------------
Physical Interface : GigabitEthernet1/2
Type : ASA
Security Zone : None
Status : Enabled
Load Balancing Mode : N/A
---------------------[ cplane ]---------------------
IPv4 Address : 127.0.2.1
----------------------[ eth0 ]----------------------
Physical Interface : eth0
Type : Management
Status : Enabled
MDI/MDIX : Auto
MTU : 1500
MAC Address : 50:0F:80:80:12:34
IPv4 Address : 172.27.5.18
----------------------[ tun1 ]----------------------
IPv6 Address : fdcc::bd:0:ffff:a9fe:1/64
---------------------[ tunl0 ]----------------------
----------------------------------------------------
Analyzing Running Processes
> show disk // TO CHECK DISK USAGE; SIMILAR TO LINUX df COMMAND
Filesystem Size Used Avail Use% Mounted on
/dev/root 3.7G 777M 2.8G 22% /
devtmpfs 1.1G 80K 1.1G 1% /dev
/dev/sda1 99M 6.1M 88M 7% /boot
/dev/vda7 38G 6.9G 29G 20% /var
none 1.1G 340K 1.1G 1% /dev/shm
tmpfs 1.1G 0 1.1G 0% /dev/cgroups
> show processes // SIMILAR TO LINUX ps COMMAND
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
23195 sfsnort 1 -19 815m 12m 3704 S 6 0.6 274:40.56 snort
3464 root 20 0 30124 788 736 S 2 0.0 1664:41 UEChanneld
3465 root 20 0 2055m 409m 1808 S 2 18.5 702:23.82 java
21094 root 20 0 2157m 56m 1432 S 2 2.6 24:02.67 SFDataCorrelato
31825 admin 20 0 17428 1332 976 R 2 0.1 0:00.02 top
1 root 20 0 4220 672 624 S 0 0.0 0:51.49 init
2 root 20 0 0 0 0 S 0 0.0 0:00.00 kthreadd
3 root 20 0 0 0 0 S 0 0.0 0:05.25 ksoftirqd/0
5 root 0 -20 0 0 0 S 0 0.0 0:00.00 kworker/0:0H
7 root RT 0 0 0 0 S 0 0.0 0:36.82 migration/0
8 root 20 0 0 0 0 S 0 0.0 15:14.21 rcu_preempt
9 root 20 0 0 0 0 S 0 0.0 0:00.00 rcu_bh
10 root 20 0 0 0 0 S 0 0.0 0:00.00 rcu_sched
<OUTPUT TRUNCATED>
> show process-tree // SIMILAR TO LINUX pstree COMMAND
init(1)-+-acpid(2369)
|-agetty(3418)
|-agetty(3419)
|-agetty(3420)
|-crond(1729)
|-login(22993)---clish(23050)---{clish}(23053)
|-nscd(20395)-+-{nscd}(20396)
| |-{nscd}(20397)
| |-{nscd}(20398)
| |-{nscd}(20399)
| |-{nscd}(20400)
| `-{nscd}(20401)
|-pm(3433)-+-ASAConfig.pl(3452)
| |-ActionQueueScra(3615)
| |-CloudAgent(3463)-+-{CloudAgent}(3529)
| | |-{CloudAgent}(3530)
| | |-{CloudAgent}(3531)
| | |-{CloudAgent}(3532)
| | `-{CloudAgent}(3533)
| |-Pruner.pl(3614)
| |-SFDataCorrelato(21094)-+-{SFDataCorrelato}(21103)
| | |-{SFDataCorrelato}(21104)
| | |-{SFDataCorrelato}(21105)
| | |-{SFDataCorrelato}(21107)
| | |-{SFDataCorrelato}(21108)
| | |-{SFDataCorrelato}(21109)
| | |-{SFDataCorrelato}(21110)
| | |-{SFDataCorrelato}(21111)
| | |-{SFDataCorrelato}(21112)
| | |-{SFDataCorrelato}(21113)
| | |-{SFDataCorrelato}(21134)
| | |-{SFDataCorrelato}(21137)
| | |-{SFDataCorrelato}(21138)
| | |-{SFDataCorrelato}(21140)
| | |-{SFDataCorrelato}(21141)
| | |-{SFDataCorrelato}(21142)
| | |-{SFDataCorrelato}(21143)
| | |-{SFDataCorrelato}(21144)
| | |-{SFDataCorrelato}(21145)
| | |-{SFDataCorrelato}(21146)
| | |-{SFDataCorrelato}(21147)
| | |-{SFDataCorrelato}(21148)
| | |-{SFDataCorrelato}(21149)
| | |-{SFDataCorrelato}(21150)
| | |-{SFDataCorrelato}(21152)
| | |-{SFDataCorrelato}(21156)
| | |-{SFDataCorrelato}(21157)
| | |-{SFDataCorrelato}(21158)
| | |-{SFDataCorrelato}(21160)
| | `-{SFDataCorrelato}(23205)
<OUTPUT TRUNCATED>
Using the System Log (Syslog)
> expert // GO TO EXPERT MODE
admin@firepower:~$ cd / // CHANGE TO ROOT DIRECTORY
admin@firepower:/$ ls
DBCheck.log Volume bin boot cisco dev etc home lib lib64 lost+found mnt proc root sbin sys tmp usr var
admin@firepower:/$ cd /var/log
admin@firepower:/var/log$ ls
action_queue.log firstboot.S50install-remediation-modules process_stdout.log
action_queue.log.1.gz firstboot.S51install_health_policy.pl process_stdout.log.1.gz
action_queue.log.2.gz firstboot.S52install_system_policy.pl process_stdout.log.2.gz
action_queue.log.3.gz firstboot.S53change_reconciliation_baseline.pl process_stdout.log.3.gz
action_queue.log.4.gz firstboot.S53createcsds.pl process_stdout.log.4.gz
asacx_init.log firstboot.S70remove_casuser.pl pruner.log
audit firstboot.S70update_sensor_objects.sh pruner.log.1.gz
btmp firstboot.S85patch_history-init pruner.log.2.gz
cc-integrity.log firstboot.S90banner-init pruner.log.3.gz
cisco firstboot.S95copy-crontab pruner.log.4.gz
configure-model.log firstboot.S96grow_var.sh query_engine.log
configure.log firstboot.S96install_sf_whitelist query_engine.log.1.gz
configure.log.old firstboot.S96install_vmware_tools.pl query_engine.log.2.gz
cron firstboot.S96localize-templates query_engine.log.3.gz
cron.1.gz firstboot.S96ovf-data.pl query_engine.log.4.gz
cron.2.gz firstboot.S97compress-client-resources reconfigure.45update-sensor.pl
cron.3.gz firstboot.S97create_platinum_forms.pl reconfigure.55recalculate_arc.pl
cron.4.gz firstboot.S97install_cas remove_old_var.log
diskmanager.log firstboot.S97install_cloud_support.pl removed_packages
dmesg firstboot.S97install_geolocation.pl removed_scripts
eth0.down.log firstboot.S97install_ssl_inspection.pl sa
eth0.down.log.old firstboot.S97update_modprobe.pl sam.log
eth0.up.log firstboot.S98check-db-integrity.sh sam.log.1.gz
eth0.up.log.old firstboot.S98htaccess-init sam.log.2.gz
eth1.down.log firstboot.S98is-sru-finished.sh sam.log.3.gz
eth1.down.log.old firstboot.S99_z_cc-integrity.sh sam.log.4.gz
eth1.up.log firstboot.S99correct_ipmi.pl scripts
eth1.up.log.old firstboot.S99start-system seshat
faillog firstboot.S99z_db_restore setup
firesight-query.log firstboot.control sf
firesight-query.log.1.gz httpd snapshot_manager.log
firesight-query.log.2.gz ifup-static-route.log syncd.log
firesight-query.log.3.gz init_cgroups.log syncd.log.1.gz
firesight-query.log.4.gz initialize.log syncd.log.2.gz
firstboot.S01reset_failopen_if lastlog syncd.log.3.gz
firstboot.S01virtual-machine-reconfigure lo.down.log syncd.log.4.gz
firstboot.S02aws-pull-cfg lo.down.log.old time_series.log
firstboot.S04fix-httpd.sh lo.up.log time_series.log.1.gz
firstboot.S05set-default-ipv4.pl lo.up.log.old time_series.log.2.gz
firstboot.S05set-mgmnt-port messages time_series.log.3.gz
firstboot.S06addusers messages.1.gz time_series.log.4.gz
firstboot.S07uuid-init messages.2.gz top.log
firstboot.S08configure_mysql messages.3.gz top.log.1.gz
firstboot.S09database-init messages.4.gz top.log.10.gz
firstboot.S10database.15vulndb-init.log model_info_log top.log.11.gz
firstboot.S11database-populate mojo top.log.12.gz
firstboot.S12install_infodb myisamchk.log top.log.13.gz
firstboot.S15set-locale.sh nscd.log top.log.14.gz
firstboot.S16update-sensor.pl nscd.log.1.gz top.log.2.gz
firstboot.S19cert-tun-init nscd.log.2.gz top.log.3.gz
firstboot.S20cert-init nscd.log.3.gz top.log.4.gz
firstboot.S21disable_estreamer nscd.log.4.gz top.log.5.gz
firstboot.S25create_default_des.pl ntp.log top.log.6.gz
firstboot.S30init_lights_out_mgmt.pl openssl-selftest.log top.log.7.gz
firstboot.S40install_default_filters.pl packages top.log.8.gz
firstboot.S42install_default_dashboards.pl process_stderr.log top.log.9.gz
firstboot.S43install_default_report_templates.pl process_stderr.log.1.gz umpd_stderr.log
firstboot.S44install_default_app_filters.pl process_stderr.log.2.gz urldb_log
firstboot.S45install_default_realms.pl process_stderr.log.3.gz wtmp
firstboot.S47install_default_sandbox_EO.pl process_stderr.log.4.gz wtmp.1
admin@firepower:/var/log$ cat eth0.down.log // USE cat TO VIEW DETAILED LOGS
Clearing static routes
Unconfiguring default route
Ignoring -device
Ignoring eth0
(5) No device specified
Command [clear_default_route -device eth0 -4] succeeded!
Unconfiguring address on eth0
Unconfiguring IPv4 on eth0
Command [/sbin/ip -4 addr flush dev eth0] succeeded!
Successfully unconfigure eth0 for IPv4
Command [unconfigure_ip -4 -device eth0] succeeded!
Unconfiguring IPv6
Command [/usr/sbin/dhclient -6 -x eth0 -sf /etc/sysconfig/network-scripts/dhclient-script] succeeded!
Ignoring -device
Ignoring eth0
Command [/sbin/ip -6 route delete default dev eth0] succeeded!
Unconfiguring IPv6 on eth0
Stoping ipv6
Command [/sbin/ip -6 addr flush dev eth0 scope global] succeeded!
Command [/sbin/ip -6 addr flush dev eth0 scope global] succeeded!
Successfully unconfigure eth0 for IPv6
Command [/sbin/ip -6 addr flush dev eth0 scope global] succeeded!
Command [total_unconfigure -device eth0 -6] succeeded!
Downing interface
Command [/sbin/ip link set dev eth0 down] succeeded!
Command [down_interface -device eth0] succeeded!
Generating Advanced Troubleshooting Logs
> system generate-troubleshoot
system generate-troubleshoot options ...
Run troubleshoot
options ... Selectable Troubleshoot Options
> system generate-troubleshoot
One or more subset options required. Displaying list of options:
ALL - Run ALL Of The Following Options
SNT - Snort Performance and Configuration
PER - Hardware Performance and Logs
SYS - System Configuration, Policy, and Logs
DES - Detection Configuration, Policy, and Logs
NET - Interface and Network Related Data
VDB - Discovery, Awareness, VDB Data, and Logs
UPG - Upgrade Data and Logs
DBO - All Database Data
LOG - All Log Data
NMP - Network Map Information
> system generate-troubleshoot all // TAKE SEVERAL MINUTES TO FINISH; CISCO TAC WILL USUALLY ASK YOU TO RUN AND SEND THE OUTPUT TO THEM FOR FURTHER ANALYSIS
> system support
application-identification-debug Generate application identification debug messages
bootloader Display bootloader information
capture-traffic Display traffic or save to specified file
debug-DAQ Debug for DAQ functionality
debug-DAQ-reset Reset DAQ debug configuration file
dump-table Dump specified database tables to common file repository
eotool Change to Enterprise Object Tool Mode
file-malware-debug Generate file malware debug messages
firewall-engine-debug Generate firewall debug messages
firewall-engine-dump-user-identity-data Generate a file containing the current state of user identity within the firewall
firewall-httpmod-debug Generate http_mod preprocessor debug messages
fstab Display the file systems table
iptables Display IP packet filter rules
network-options Display network options
nslookup Look up an IP address or host name with the DNS servers
ntp Show NTP configuration
partitions Display partition information
pigtail Tail log files for debugging (pigtail)
ping Ping a host to check reachability
platform Display platform information
pmtool Change to PMTool Mode
repair-table Repair specified database tables
rpms Display RPM information
run-rule-profiling Run Rule Profiling
scsi Show SCSI device information
set-arc-mode Set the Automatic Resource Configuration optimization mode
sftunnel-status Show sftunnel status
show-arc-mode Show the Automatic Resource Configuration optimization mode value
silo-drain Assists with Disk Management
ssl-client-hello-display Display SSL Client Hello configuration settings
ssl-client-hello-enabled SSL Client Hello Enabled Settings
ssl-client-hello-force-reset Reset SSL Client Hello configuration file without user confirmation
ssl-client-hello-reset Reset SSL Client Hello configuration file
ssl-client-hello-tuning SSL Client Hello Detailed Tuning
ssl-debug Debugging for SSL functionality
ssl-debug-reset Reset SSL Debug configuration file
ssl-tuning Tune aspects of SSL functionality
ssl-tuning-reset Reset SSL Tuning configuration file
swap Display swap information
tail-logs Tails the logs selected by the user
trace Generate debug trace messages for packets
traceroute Find route to remote network
utilization Display current system utilization
view-files View files in the system
> system support firewall-engine-debug // DEBUG ACCESS CONTROL RULE IN REAL TIME
$ ssh -l admin 172.27.5.18
The authenticity of host '172.27.5.18 (172.27.5.18)' can't be established.
RSA key fingerprint is b7:d4:2e:76:c3:2a:1d:46:a5:a2:f0:7e:73:d1:12:34.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.27.5.18' (RSA) to the list of known hosts.
Password:
Last login: Thu Dec 21 04:15:09 2017
Copyright 2004-2017, Cisco and/or its affiliates. All rights reserved.
Cisco is a registered trademark of Cisco Systems, Inc.
All other trademarks are property of their respective owners.
Cisco Fire Linux OS v6.2.0 (build 42)
Cisco ASA5506H v6.2.0 (build 362)
>
ciscoasa# session ?
Available module ID(s):
sfr Module ID
ongc-11high-FW02# session sfr ?
console Login to console port on another module.
do Execute a command on another module.
ip Configure Module logging port ip addresses
<cr>
ciscoasa# session sfr console
Opening console session with module sfr.
Connected to module sfr. Escape character sequence is 'CTRL-^X'.
>
Displaying the Access Control Policy Details
You can use the show access-control-config command to view the access control policy configuration.
> show
access-control-config Show Current Access-Control Configuration
audit-cert Display audit_log cert if any
audit-log Show audit log
cpu Show CPU utilization
database Change to Show Database Mode
device-settings Show device settings
disk Show disk usage
disk-manager Display current status of local disk(s)
dns Show DNS configuration
hostname Show hostname
hosts Show hosts
ifconfig Show currently configured interfaces
interfaces Show interface configuration
kdump Display status of kernel crash dump feature
log-events-to-ramdisk Display Logging of Events to hard disk
log-ips-connection Display Logging of Connection Events setting
managers Show managing Defense Centers
memory Show available memory
model Show model
netstat Show network connections
network Show configuration of management interface
network-static-routes Show static routes for management interfaces
ntp Show NTP configuration
perfstats Show perfstats
process-tree Show processes in tree format
processes Show processes
route Show configured routes
serial-number Show serial number
ssl-policy-config Show Current SSL Policy Configuration
summary Show summary
syslog Show syslog <filter> <max lines per page>
time Show time
traffic-statistics Show traffic statistics
user Show specified users
users Show all users
version Show versions
Show> access-control-config
===========[ Default Allow All Traffic ]============
Description :
=================[ Default Action ]=================
Default Action : Fast-path
Logging Configuration
DC : Disabled
Beginning : Disabled
End : Disabled
Rule Hits : 0
Variable Set : Default-Set
===[ Security Intelligence - Network Whitelist ]====
Name : Global-Whitelist (List)
IP Count : 0
Zone : any
===[ Security Intelligence - Network Blacklist ]====
Logging Configuration : Enabled
DC : Enabled
---------------------[ Block ]----------------------
Name : Global-Blacklist (List)
IP Count : 0
Zone : any
=====[ Security Intelligence - URL Whitelist ]======
Name : Global-Whitelist-for-URL (List)
URL Count : 0
Zone : any
=====[ Security Intelligence - URL Blacklist ]======
Logging Configuration : Enabled
DC : Enabled
---------------------[ Block ]----------------------
Name : Global-Blacklist-for-URL (List)
URL Count : 0
Zone : any
=======[ Security Intelligence - DNS Policy ]=======
Name : Default DNS Policy
Logging Configuration : Enabled
DC : Enabled
======[ Rule Set: admin_category (Built-in) ]=======
=====[ Rule Set: standard_category (Built-in) ]=====
=======[ Rule Set: root_category (Built-in) ]=======
===============[ Advanced Settings ]================
General Settings
Maximum URL Length : 1024
Interactive Block Bypass Timeout : 600
Do not retry URL cache miss lookup : No
Inspect Traffic During Apply : Yes
Network Analysis and Intrusion Policies
Initial Intrusion Policy : No Rules Active
Initial Variable Set : Default-Set
Default Network Analysis Policy : Balanced Security and Connectivity
Files and Malware Settings
File Type Inspect Limit : 1460
Cloud Lookup Timeout : 2
Minimum File Capture Size : 6144
Maximum File Capture Size : 1048576
Min Dynamic Analysis Size : 15360
Max Dynamic Analysis Size : 2097152
Malware Detection Limit : 10485760
Transport/Network Layer Preprocessor Settings
Detection Settings
Ignore VLAN Tracking Connections : No
Maximum Active Responses : No Maximum
Minimum Response Seconds : No Minimum
Session Termination Log Threshold : 1048576
Detection Enhancement Settings
Adaptive Profile : Disabled
Performance Settings
Event Queue
Maximum Queued Events : 5
Disable Reassembled Content Checks: False
Performance Statistics
Sample time (seconds) : 300
Minimum number of packets : 10000
Summary : False
Log Session/Protocol Distribution : False
Regular Expression Limits
Match Recursion Limit : Default
Match Limit : Default
Rule Processing Configuration
Logged Events : 5
Maximum Queued Events : 8
Events Ordered By : Content Length
Intelligent Application Bypass Settings
State : Off
Bypassable Applications and Filters : 0 Applications/Filters
Latency-Based Performance Settings
Packet Handling : Disabled
=============[ Interactive Block HTML ]=============
HTTP/1.1 200 OK
Connection: close
Content-Length: 869
Content-Type: text/html; charset=UTF-8
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8" />
<title>Access Denied</title>
<style type="text/css">body {margin:0;font-family:verdana,sans-serif;} h1 {margin:0;padding:12px 25px;background-
color:#343434;color
:#ddd} p {margin:12px 25px;} strong {color:#E0042D;}</style>
</head>
<body>
<h1>Access Denied</h1>
<p>
<strong>You are attempting to access a forbidden site.</strong><br/><br/>
You may continue to the site by clicking on the button below.<br/>
<em>Note:</em> You must have cookies enabled in your browser to continue.</br><br/>
Consult your system administrator for details.<br/><br/>
<noscript><em>This page uses Javascript. Your browser either doesn't support Javascript or you have it turned off.<br/>
To continue to the site, please use a Javascript enabled browser.</em></noscript>
</p>
</body>
</html>
Displaying the Network Configuration
There are several ways to view the network configuration on a Cisco FirePOWER Module.
> show network
===============[ System Information ]===============
Hostname : firepower
Domains : example.net
Management port : 8305
IPv4 Default route
Gateway : 172.27.5.19
======================[ eth0 ]======================
State : Enabled
Channels : Management & Events
Mode : Non-Autonegotiation
MDI/MDIX : Auto/MDIX
MTU : 1500
MAC Address : 50:0F:80:80:AB:CD
----------------------[ IPv4 ]----------------------
Configuration : Manual
Address : 172.27.5.18
Netmask : 255.255.255.224
Broadcast : 172.27.5.19
----------------------[ IPv6 ]----------------------
Configuration : Disabled
===============[ Proxy Information ]================
State : Disabled
Authentication : Disabled
> show ifconfig // SIMILAR TO LINUX ifconfig COMMAND
cplane Link encap:Ethernet HWaddr 00:00:00:02:00:01
inet addr:127.0.2.1 Bcast:127.0.255.255 Mask:255.255.0.0
inet6 addr: fe80::200:ff:fe02:1/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:7593492 errors:0 dropped:3777883 overruns:0 frame:0
TX packets:1908174 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:478730921 (456.5 Mb) TX bytes:175547469 (167.4 Mb)
eth0 Link encap:Ethernet HWaddr 50:0F:80:80:AD:DC
inet addr:172.27.5.18 Bcast:172.27.5.19 Mask:255.255.255.0
inet6 addr: fe80::520f:80ff:fe80:addc/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:41729 errors:0 dropped:0 overruns:0 frame:0
TX packets:63173 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:5891158 (5.6 Mb) TX bytes:58229136 (55.5 Mb)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.255.255.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:355317 errors:0 dropped:0 overruns:0 frame:0
TX packets:355317 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:45879853 (43.7 Mb) TX bytes:45879853 (43.7 Mb)
tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:169.254.0.1 P-t-P:169.254.0.1 Mask:255.255.0.0
inet6 addr: fdcc::bd:0:ffff:a9fe:1/64 Scope:Global
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
> show interfaces
--------------------[ outside ]---------------------
Physical Interface : GigabitEthernet1/1
Type : ASA
Security Zone : None
Status : Enabled
Load Balancing Mode : N/A
---------------------[ inside ]---------------------
Physical Interface : GigabitEthernet1/2
Type : ASA
Security Zone : None
Status : Enabled
Load Balancing Mode : N/A
---------------------[ cplane ]---------------------
IPv4 Address : 127.0.2.1
----------------------[ eth0 ]----------------------
Physical Interface : eth0
Type : Management
Status : Enabled
MDI/MDIX : Auto
MTU : 1500
MAC Address : 50:0F:80:80:12:34
IPv4 Address : 172.27.5.18
----------------------[ tun1 ]----------------------
IPv6 Address : fdcc::bd:0:ffff:a9fe:1/64
---------------------[ tunl0 ]----------------------
----------------------------------------------------
Analyzing Running Processes
> show disk // TO CHECK DISK USAGE; SIMILAR TO LINUX df COMMAND
Filesystem Size Used Avail Use% Mounted on
/dev/root 3.7G 777M 2.8G 22% /
devtmpfs 1.1G 80K 1.1G 1% /dev
/dev/sda1 99M 6.1M 88M 7% /boot
/dev/vda7 38G 6.9G 29G 20% /var
none 1.1G 340K 1.1G 1% /dev/shm
tmpfs 1.1G 0 1.1G 0% /dev/cgroups
> show processes // SIMILAR TO LINUX ps COMMAND
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
23195 sfsnort 1 -19 815m 12m 3704 S 6 0.6 274:40.56 snort
3464 root 20 0 30124 788 736 S 2 0.0 1664:41 UEChanneld
3465 root 20 0 2055m 409m 1808 S 2 18.5 702:23.82 java
21094 root 20 0 2157m 56m 1432 S 2 2.6 24:02.67 SFDataCorrelato
31825 admin 20 0 17428 1332 976 R 2 0.1 0:00.02 top
1 root 20 0 4220 672 624 S 0 0.0 0:51.49 init
2 root 20 0 0 0 0 S 0 0.0 0:00.00 kthreadd
3 root 20 0 0 0 0 S 0 0.0 0:05.25 ksoftirqd/0
5 root 0 -20 0 0 0 S 0 0.0 0:00.00 kworker/0:0H
7 root RT 0 0 0 0 S 0 0.0 0:36.82 migration/0
8 root 20 0 0 0 0 S 0 0.0 15:14.21 rcu_preempt
9 root 20 0 0 0 0 S 0 0.0 0:00.00 rcu_bh
10 root 20 0 0 0 0 S 0 0.0 0:00.00 rcu_sched
<OUTPUT TRUNCATED>
> show process-tree // SIMILAR TO LINUX pstree COMMAND
init(1)-+-acpid(2369)
|-agetty(3418)
|-agetty(3419)
|-agetty(3420)
|-crond(1729)
|-login(22993)---clish(23050)---{clish}(23053)
|-nscd(20395)-+-{nscd}(20396)
| |-{nscd}(20397)
| |-{nscd}(20398)
| |-{nscd}(20399)
| |-{nscd}(20400)
| `-{nscd}(20401)
|-pm(3433)-+-ASAConfig.pl(3452)
| |-ActionQueueScra(3615)
| |-CloudAgent(3463)-+-{CloudAgent}(3529)
| | |-{CloudAgent}(3530)
| | |-{CloudAgent}(3531)
| | |-{CloudAgent}(3532)
| | `-{CloudAgent}(3533)
| |-Pruner.pl(3614)
| |-SFDataCorrelato(21094)-+-{SFDataCorrelato}(21103)
| | |-{SFDataCorrelato}(21104)
| | |-{SFDataCorrelato}(21105)
| | |-{SFDataCorrelato}(21107)
| | |-{SFDataCorrelato}(21108)
| | |-{SFDataCorrelato}(21109)
| | |-{SFDataCorrelato}(21110)
| | |-{SFDataCorrelato}(21111)
| | |-{SFDataCorrelato}(21112)
| | |-{SFDataCorrelato}(21113)
| | |-{SFDataCorrelato}(21134)
| | |-{SFDataCorrelato}(21137)
| | |-{SFDataCorrelato}(21138)
| | |-{SFDataCorrelato}(21140)
| | |-{SFDataCorrelato}(21141)
| | |-{SFDataCorrelato}(21142)
| | |-{SFDataCorrelato}(21143)
| | |-{SFDataCorrelato}(21144)
| | |-{SFDataCorrelato}(21145)
| | |-{SFDataCorrelato}(21146)
| | |-{SFDataCorrelato}(21147)
| | |-{SFDataCorrelato}(21148)
| | |-{SFDataCorrelato}(21149)
| | |-{SFDataCorrelato}(21150)
| | |-{SFDataCorrelato}(21152)
| | |-{SFDataCorrelato}(21156)
| | |-{SFDataCorrelato}(21157)
| | |-{SFDataCorrelato}(21158)
| | |-{SFDataCorrelato}(21160)
| | `-{SFDataCorrelato}(23205)
<OUTPUT TRUNCATED>
Using the System Log (Syslog)
> expert // GO TO EXPERT MODE
admin@firepower:~$ cd / // CHANGE TO ROOT DIRECTORY
admin@firepower:/$ ls
DBCheck.log Volume bin boot cisco dev etc home lib lib64 lost+found mnt proc root sbin sys tmp usr var
admin@firepower:/$ cd /var/log
admin@firepower:/var/log$ ls
action_queue.log firstboot.S50install-remediation-modules process_stdout.log
action_queue.log.1.gz firstboot.S51install_health_policy.pl process_stdout.log.1.gz
action_queue.log.2.gz firstboot.S52install_system_policy.pl process_stdout.log.2.gz
action_queue.log.3.gz firstboot.S53change_reconciliation_baseline.pl process_stdout.log.3.gz
action_queue.log.4.gz firstboot.S53createcsds.pl process_stdout.log.4.gz
asacx_init.log firstboot.S70remove_casuser.pl pruner.log
audit firstboot.S70update_sensor_objects.sh pruner.log.1.gz
btmp firstboot.S85patch_history-init pruner.log.2.gz
cc-integrity.log firstboot.S90banner-init pruner.log.3.gz
cisco firstboot.S95copy-crontab pruner.log.4.gz
configure-model.log firstboot.S96grow_var.sh query_engine.log
configure.log firstboot.S96install_sf_whitelist query_engine.log.1.gz
configure.log.old firstboot.S96install_vmware_tools.pl query_engine.log.2.gz
cron firstboot.S96localize-templates query_engine.log.3.gz
cron.1.gz firstboot.S96ovf-data.pl query_engine.log.4.gz
cron.2.gz firstboot.S97compress-client-resources reconfigure.45update-sensor.pl
cron.3.gz firstboot.S97create_platinum_forms.pl reconfigure.55recalculate_arc.pl
cron.4.gz firstboot.S97install_cas remove_old_var.log
diskmanager.log firstboot.S97install_cloud_support.pl removed_packages
dmesg firstboot.S97install_geolocation.pl removed_scripts
eth0.down.log firstboot.S97install_ssl_inspection.pl sa
eth0.down.log.old firstboot.S97update_modprobe.pl sam.log
eth0.up.log firstboot.S98check-db-integrity.sh sam.log.1.gz
eth0.up.log.old firstboot.S98htaccess-init sam.log.2.gz
eth1.down.log firstboot.S98is-sru-finished.sh sam.log.3.gz
eth1.down.log.old firstboot.S99_z_cc-integrity.sh sam.log.4.gz
eth1.up.log firstboot.S99correct_ipmi.pl scripts
eth1.up.log.old firstboot.S99start-system seshat
faillog firstboot.S99z_db_restore setup
firesight-query.log firstboot.control sf
firesight-query.log.1.gz httpd snapshot_manager.log
firesight-query.log.2.gz ifup-static-route.log syncd.log
firesight-query.log.3.gz init_cgroups.log syncd.log.1.gz
firesight-query.log.4.gz initialize.log syncd.log.2.gz
firstboot.S01reset_failopen_if lastlog syncd.log.3.gz
firstboot.S01virtual-machine-reconfigure lo.down.log syncd.log.4.gz
firstboot.S02aws-pull-cfg lo.down.log.old time_series.log
firstboot.S04fix-httpd.sh lo.up.log time_series.log.1.gz
firstboot.S05set-default-ipv4.pl lo.up.log.old time_series.log.2.gz
firstboot.S05set-mgmnt-port messages time_series.log.3.gz
firstboot.S06addusers messages.1.gz time_series.log.4.gz
firstboot.S07uuid-init messages.2.gz top.log
firstboot.S08configure_mysql messages.3.gz top.log.1.gz
firstboot.S09database-init messages.4.gz top.log.10.gz
firstboot.S10database.15vulndb-init.log model_info_log top.log.11.gz
firstboot.S11database-populate mojo top.log.12.gz
firstboot.S12install_infodb myisamchk.log top.log.13.gz
firstboot.S15set-locale.sh nscd.log top.log.14.gz
firstboot.S16update-sensor.pl nscd.log.1.gz top.log.2.gz
firstboot.S19cert-tun-init nscd.log.2.gz top.log.3.gz
firstboot.S20cert-init nscd.log.3.gz top.log.4.gz
firstboot.S21disable_estreamer nscd.log.4.gz top.log.5.gz
firstboot.S25create_default_des.pl ntp.log top.log.6.gz
firstboot.S30init_lights_out_mgmt.pl openssl-selftest.log top.log.7.gz
firstboot.S40install_default_filters.pl packages top.log.8.gz
firstboot.S42install_default_dashboards.pl process_stderr.log top.log.9.gz
firstboot.S43install_default_report_templates.pl process_stderr.log.1.gz umpd_stderr.log
firstboot.S44install_default_app_filters.pl process_stderr.log.2.gz urldb_log
firstboot.S45install_default_realms.pl process_stderr.log.3.gz wtmp
firstboot.S47install_default_sandbox_EO.pl process_stderr.log.4.gz wtmp.1
admin@firepower:/var/log$ cat eth0.down.log // USE cat TO VIEW DETAILED LOGS
Clearing static routes
Unconfiguring default route
Ignoring -device
Ignoring eth0
(5) No device specified
Command [clear_default_route -device eth0 -4] succeeded!
Unconfiguring address on eth0
Unconfiguring IPv4 on eth0
Command [/sbin/ip -4 addr flush dev eth0] succeeded!
Successfully unconfigure eth0 for IPv4
Command [unconfigure_ip -4 -device eth0] succeeded!
Unconfiguring IPv6
Command [/usr/sbin/dhclient -6 -x eth0 -sf /etc/sysconfig/network-scripts/dhclient-script] succeeded!
Ignoring -device
Ignoring eth0
Command [/sbin/ip -6 route delete default dev eth0] succeeded!
Unconfiguring IPv6 on eth0
Stoping ipv6
Command [/sbin/ip -6 addr flush dev eth0 scope global] succeeded!
Command [/sbin/ip -6 addr flush dev eth0 scope global] succeeded!
Successfully unconfigure eth0 for IPv6
Command [/sbin/ip -6 addr flush dev eth0 scope global] succeeded!
Command [total_unconfigure -device eth0 -6] succeeded!
Downing interface
Command [/sbin/ip link set dev eth0 down] succeeded!
Command [down_interface -device eth0] succeeded!
Generating Advanced Troubleshooting Logs
> system generate-troubleshoot
system generate-troubleshoot options ...
Run troubleshoot
options ... Selectable Troubleshoot Options
> system generate-troubleshoot
One or more subset options required. Displaying list of options:
ALL - Run ALL Of The Following Options
SNT - Snort Performance and Configuration
PER - Hardware Performance and Logs
SYS - System Configuration, Policy, and Logs
DES - Detection Configuration, Policy, and Logs
NET - Interface and Network Related Data
VDB - Discovery, Awareness, VDB Data, and Logs
UPG - Upgrade Data and Logs
DBO - All Database Data
LOG - All Log Data
NMP - Network Map Information
> system generate-troubleshoot all // TAKE SEVERAL MINUTES TO FINISH; CISCO TAC WILL USUALLY ASK YOU TO RUN AND SEND THE OUTPUT TO THEM FOR FURTHER ANALYSIS
> system support
application-identification-debug Generate application identification debug messages
bootloader Display bootloader information
capture-traffic Display traffic or save to specified file
debug-DAQ Debug for DAQ functionality
debug-DAQ-reset Reset DAQ debug configuration file
dump-table Dump specified database tables to common file repository
eotool Change to Enterprise Object Tool Mode
file-malware-debug Generate file malware debug messages
firewall-engine-debug Generate firewall debug messages
firewall-engine-dump-user-identity-data Generate a file containing the current state of user identity within the firewall
firewall-httpmod-debug Generate http_mod preprocessor debug messages
fstab Display the file systems table
iptables Display IP packet filter rules
network-options Display network options
nslookup Look up an IP address or host name with the DNS servers
ntp Show NTP configuration
partitions Display partition information
pigtail Tail log files for debugging (pigtail)
ping Ping a host to check reachability
platform Display platform information
pmtool Change to PMTool Mode
repair-table Repair specified database tables
rpms Display RPM information
run-rule-profiling Run Rule Profiling
scsi Show SCSI device information
set-arc-mode Set the Automatic Resource Configuration optimization mode
sftunnel-status Show sftunnel status
show-arc-mode Show the Automatic Resource Configuration optimization mode value
silo-drain Assists with Disk Management
ssl-client-hello-display Display SSL Client Hello configuration settings
ssl-client-hello-enabled SSL Client Hello Enabled Settings
ssl-client-hello-force-reset Reset SSL Client Hello configuration file without user confirmation
ssl-client-hello-reset Reset SSL Client Hello configuration file
ssl-client-hello-tuning SSL Client Hello Detailed Tuning
ssl-debug Debugging for SSL functionality
ssl-debug-reset Reset SSL Debug configuration file
ssl-tuning Tune aspects of SSL functionality
ssl-tuning-reset Reset SSL Tuning configuration file
swap Display swap information
tail-logs Tails the logs selected by the user
trace Generate debug trace messages for packets
traceroute Find route to remote network
utilization Display current system utilization
view-files View files in the system
> system support firewall-engine-debug // DEBUG ACCESS CONTROL RULE IN REAL TIME
