Firepower FMC delete stuck deployments from CLI

 Sometimes you get a deployment running for hours and you cannot clear the state even with an FMC reload.

Login to FMC CLI and perform the following

expert

sudo su

Now check that the task is actual there using the following command

OmniQuery.pl -db mdb -e "select status,category,hex(uuid),body from notification where status=7;"

Use the following command to clear the pending deployment

OmniQuery.pl -db mdb -e "update notification set status=13 where status=7;"

If you want to delete the task use the following command, replacing the uuid value with the one that you want to delete

OmniQuery.pl -db mdb -e 'delete from notification where uuid=unhex("bb0bba970b4c4423927b8f7d237edd0b");'

Firepower check Security Intelligence feed contents

You can view the list of Security Intelligence IP addresses from the CLI of the Defense Center. You'll want to issue the following commands after logging in:

1. sudo su

2. cd /var/sf/iprep_download

In this directory, there is a file called rep_dd.yaml. You can view this text file to find the UUID associated with each category, such as "attackers".

There should be a file in the /var/sf/iprep_download directory named for that UUID, for example 5a0b6d6b-e2c3-436f-b4a1-48248b330a26. You can view this file using the "less" command in order to see the IP addresses that are currently included for that particular category.

Firepower VPN Filter via Flexconfig

The following information provided as is with not guaranties  that it works and support will not be provided! Test in a lab before deploying in production.

If you don't know what you're doing hire a trained engineer!



VPN filter for Site to site VPN is not supported from GUI in Firepower. see CSCvj86972


You have to create a new policy and attach it to tunnel-group.
Create your VPN configuration and save it.

Assuming that Remote VPN peer IP = 10.10.10.10

Do the following:


1) Under objects create an extended access list to be used as VPN Filter with the name VPN_FILTER, this ACL is your actual VPN filter and will be attached to your VPN tunnel.



2) On the same page under Flexconfig-> Text Object Create a new text object for your tunnel group IP as Single and assign a value of 10.10.10.10 (replace with your peer IP)


3) Under Flexconfig Object create a new object with Deployment: "Everytime" and Type: "Append"


4) Insert a new policy object -> Extended ACL object and choose your created ACL

5) Insert a new policy object -> Text Object and choose your previously created "TUNNEL_GROUP"


6) Copy and paste the following to flex config window
    Note: adjust any vpn attributes here except the vpn-filter value

group-policy VPN_FILTER_POL internal
group-policy VPN_FILTER_POL attributes
 vpn-idle-timeout 30
 vpn-idle-timeout alert-interval 1
 vpn-session-timeout none
 vpn-session-timeout alert-interval 1
 vpn-filter value $VPN_ACL
 vpn-tunnel-protocol ikev1 ikev2

tunnel-group $VPN_TUNNEL general-attributes
 default-group-policy VPN_FILTER_POL

Your config should look like this






7) Now attached the configured policy to you flex config for the specific device under Devices -> FlexConfig (If you dont have a policy create a new one, assign it to the proper device and insert the FLEX_VPN_FILTER found in user defined policies).


8) Save and deploy!

Change FTD management default gateway

Use the following in expert mode to disable gateway via data interfaces:
vi /etc/sysconfig/network-scripts/ifcfg-internal-route and changed the INTERNAL_ROUTE_ENABLED=1 to INTERNAL_ROUTE_ENABLED=0

Exit Expert mode.  Then issue a configure network ipv4 manual 1.1.1.2 255.255.255.0 1.1.1.1 to reconfigure the management IP.

The show network command now shows the gateway.

Cisco FMC FTD user to IP mapping troubleshooting

To check whether user to IP mapping works correctly, SSH to FMC and FTD and run the following commands in order to check if the entries are there

expert
user_map_query.pl -i 10.10.10.10 (to check for IP to user mapping)
user_map_query.pl -u bob (to check user to IP mapping)
If results display "For policy = 1" then this is set to propagate to FTD


Another approach
expert
u2dump /var/sf/user_enforcement/user_ip_map.* > /var/tmp/user-ip-map.dump
vi /var/tmp/user-ip-map.dump 


Credit for some of the above goes to dependencyhell.net blog.

FTD policy configuration delpoy failed

Make sure that FlexConfig is proper.
Remove all policies (NAT/ FlexConfig/ Access etc). and create empty ones and assign them to the device, then push the policy, if this works try to enabled original policies one by one to pinpoint the issue.

FTD Configuration Reset

I recently run into an issue that I needed to clear the configuration on a FTD 2100 series .

The steps followed are

1. Remove the FTD from FMC
2. SSH to FTD 
3. configure manager delete
4. You will be prompted to reset the configuration, choose yes
5.  configure firewall transparent
6.  Check configuration is clear and..
7. configure firewall routed

Now you have a FTD with clear configuration.


Another way is to connect to FTD and run the following

1. connect local-mgmt
2. erase configuration

This will reset the configuration and you have to go through the setup again after you reboot the device. Keep in mind that FTD instance will be reinstalled after that.