Firepower FMC delete stuck deployments from CLI

 Sometimes you get a deployment running for hours and you cannot clear the state even with an FMC reload.

Login to FMC CLI and perform the following

expert

sudo su

Now check that the task is actual there using the following command

OmniQuery.pl -db mdb -e "select status,category,hex(uuid),body from notification where status=7;"

Use the following command to clear the pending deployment

OmniQuery.pl -db mdb -e "update notification set status=13 where status=7;"

If you want to delete the task use the following command, replacing the uuid value with the one that you want to delete

OmniQuery.pl -db mdb -e 'delete from notification where uuid=unhex("bb0bba970b4c4423927b8f7d237edd0b");'

Firepower check Security Intelligence feed contents

You can view the list of Security Intelligence IP addresses from the CLI of the Defense Center. You'll want to issue the following commands after logging in:

1. sudo su

2. cd /var/sf/iprep_download

In this directory, there is a file called rep_dd.yaml. You can view this text file to find the UUID associated with each category, such as "attackers".

There should be a file in the /var/sf/iprep_download directory named for that UUID, for example 5a0b6d6b-e2c3-436f-b4a1-48248b330a26. You can view this file using the "less" command in order to see the IP addresses that are currently included for that particular category.

FTD RA VPN with Microsoft NPS server

 ORIGINAL POST FROM Jatin Katyal  (Thanks)

Introduction
Steps needs to be followed on the Microsoft Radius server to configure group-lock and tunnel-group-lock
Configuration Steps

    Go to Remote Access Policies.
    Go to the remote access policy/network policy, make a right click on the policy and click on the "Properties"
    Click on Edit Profile.
    Click on Advanced Tab settings and add ( For IAS)
    Click on settings (For NPS)
    Scroll down to "Vendor-Specific" Radius attribute.
    Select it, from scroll down use custom and click on Add.
    Make sure Attribute Number is set to 26.
    Click on Add.
    Enter Vendor Code: 3076.
    Select radio button : Yes. It confirms.
    Click on Configure Attributes.
    Vendor-Assigned attribute number: 25 (group-lock) and 085 (tunnel-group-lock)
    Attribute format: String.
    Attribute Value: <group-policy-name> or <tunnel-group name>
    Apply.

In order to troubleshoot any issues look at event-viewer logs on Radius server.
Configure NPS Event Logging
NPS Events and Event Viewer

Finally, this document with ASA AAA configuration documentation could be useful too:
http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/aaa_radius.pdf

Cisco FMC FTD user to IP mapping troubleshooting

To check whether user to IP mapping works correctly, SSH to FMC and FTD and run the following commands in order to check if the entries are there

expert
user_map_query.pl -i 10.10.10.10 (to check for IP to user mapping)
user_map_query.pl -u bob (to check user to IP mapping)
If results display "For policy = 1" then this is set to propagate to FTD


Another approach
expert
u2dump /var/sf/user_enforcement/user_ip_map.* > /var/tmp/user-ip-map.dump
vi /var/tmp/user-ip-map.dump 


Credit for some of the above goes to dependencyhell.net blog.

FTD policy configuration delpoy failed

Make sure that FlexConfig is proper.
Remove all policies (NAT/ FlexConfig/ Access etc). and create empty ones and assign them to the device, then push the policy, if this works try to enabled original policies one by one to pinpoint the issue.

FTD Configuration Reset

I recently run into an issue that I needed to clear the configuration on a FTD 2100 series .

The steps followed are

1. Remove the FTD from FMC
2. SSH to FTD 
3. configure manager delete
4. You will be prompted to reset the configuration, choose yes
5.  configure firewall transparent
6.  Check configuration is clear and..
7. configure firewall routed

Now you have a FTD with clear configuration.


Another way is to connect to FTD and run the following

1. connect local-mgmt
2. erase configuration

This will reset the configuration and you have to go through the setup again after you reboot the device. Keep in mind that FTD instance will be reinstalled after that.