System Administration. Cisco FXOS Firepower Chassis Manager
The FXOS Firepower Chassis Manager is a web interface that makes it easy to configure platform settings and interfaces, provision devices, and monitor system status. It is part of the Cisco Application Centric Infrastructure (ACI) Security Solution, providing an agile, open, and secure platform built for scalability, consistent control, and simplified management. The Firepower Security Appliance FXOS Firepower Chassis Manager provides modular chassis-based security, a graphical user interface for configuration and monitoring, a command-line interface (FXOS CLI), and a REST API for programmatic configuration and management.
Advertisement
Advertisement
C H A P T E R
7
System Administration
•
Changing the Management IP Address, page 53
•
Changing the Application Management IP, page 55
•
•
Rebooting the FXOS Chassis, page 59
•
Powering Off the FXOS Chassis, page 60
•
Install a Trusted Identity Certificate, page 60
•
Recovering from a Software Failure, page 65
•
Recovering from a Corrupted File System, page 69
Changing the Management IP Address
Before You Begin
You can change the management IP address on the FXOS chassis from the FXOS CLI.
Note
After changing the management IP address, you will need to reestablish any connections to Firepower
Chassis Manager or the FXOS CLI using the new address.
Procedure
Step 1
Connect to the FXOS CLI (see
Accessing the FXOS CLI, on page 8
).
Step 2
To configure an IPv4 management IP address: a) Set the scope for fabric-interconnect a:
Firepower-chassis#
scope fabric-interconnect a
b) To view the current management IP address, enter the following command:
Firepower-chassis /fabric-interconnect #
show
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
53
System Administration
Changing the Management IP Address
c) Enter the following command to configure a new management IP address and gateway:
Firepower-chassis /fabric-interconnect # set out-of-band ip ip_address netmask network_mask gw
gateway_ip_address
d) Commit the transaction to the system configuration:
Firepower-chassis /fabric-interconnect* #
commit-buffer
Step 3
To configure an IPv6 management IP address: a) Set the scope for fabric-interconnect a:
Firepower-chassis#
scope fabric-interconnect a
b) Set the scope for management IPv6 configuration:
Firepower-chassis /fabric-interconnect #
scope ipv6-config
c) To view the current management IPv6 address, enter the following command:
Firepower-chassis /fabric-interconnect/ipv6-config #
show ipv6-if
d) Enter the following command to configure a new management IP address and gateway:
Firepower-chassis /fabric-interconnect/ipv6-config # set out-of-band ipv6 ipv6_address ipv6-prefix
prefix_length ipv6-gw gateway_address e) Commit the transaction to the system configuration:
Firepower-chassis /fabric-interconnect/ipv6-config* #
commit-buffer
The following example configures an IPv4 management interface and gateway:
Firepower-chassis#
scope fabric-interconnect a
Firepower-chassis /fabric-interconnect #
show
Fabric Interconnect:
ID OOB IP Addr
Prefix Operability
OOB Gateway OOB Netmask OOB IPv6 Address OOB IPv6 Gateway
---- --------------- --------------- --------------- ---------------- ----------------
------ -----------
64
A 192.0.2.112
Operable
192.0.2.1
255.255.255.0
:: ::
Firepower-chassis /fabric-interconnect # set out-of-band ip 192.0.2.111 netmask 255.255.255.0
gw 192.0.2.1
Warning: When committed, this change may disconnect the current CLI session
Firepower-chassis /fabric-interconnect* #
commit-buffer
Firepower-chassis /fabric-interconnect #
The following example configures an IPv6 management interface and gateway:
Firepower-chassis#
scope fabric-interconnect a
Firepower-chassis /fabric-interconnect #
scope ipv6-config
Firepower-chassis /fabric-interconnect/ipv6-config #
show ipv6-if
Management IPv6 Interface:
IPv6 Address Prefix IPv6 Gateway
----------------------------------- ---------- ------------
2001::8998 64 2001::1
Firepower-chassis /fabric-interconnect/ipv6-config # set out-of-band ipv6 2001::8999 ipv6-prefix 64 ipv6-gw 2001::1
Firepower-chassis /fabric-interconnect/ipv6-config* #
commit-buffer
Firepower-chassis /fabric-interconnect/ipv6-config #
54
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
System Administration
Changing the Application Management IP
Changing the Application Management IP
You can change the management IP address on the application(s) attached to your FXOS chassis from the
FXOS CLI. To do so, you must first change the IP information at the FXOS platform level, then change the
IP information at the application level.
Note
Attempts to make these changes using the FXOS Chassis Manager may result in a service interruption.
To avoid any potential service interruptions, you must perform these changes using the FXOS CLI.
Procedure
Step 1
Connect to the FXOS CLI. (See
Accessing the FXOS CLI, on page 8
).
Step 2
Scope to the logical device:
scope ssa
scope logical-device logical_device_name
Step 3
Scope to the management bootstrap and configure the new management bootstrap parameters. Note that there are differences between deployments:
For standalone configuration of an ASA logical device: a)
scope mgmt-bootstrap asa
b)
scope ipv4_or_6 slot_number default c) IPv4 only:
set ip ipv4_address mask network_mask d) IPv6 only:
set ip ipv6_address prefix-length prefix_length_number e) set gateway gateway_ip_address f) Commit the configuration:
commit-buffer
For clustered configuration of ASA logical devices: a)
scope cluster-bootstrap
b) For IPv4 only:
set virtual ipv4 ipv_address masknetwork_mask c) For IPv6 only:
set virtual ipv6 ipv6_address prefix_lengthprefix_length_number d)
set ipv{4|6} pool start_ip end_ip e) set ipv{4|6} gateway gateway_ip_address f) Commit the configuration:
commit-buffer
For standalone and clustered configurations of FTD logical devices:
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
55
System Administration
Changing the Application Management IP
a)
scope mgmt-bootstrap ftd
b) scope ipv4_or_6 slot_number firepower c) IPv4 only:
set ip ip_address masknetwork_mask d) IPv6 only:
set ip ipv6_address prefix-lengthprefix_length_number e) set gateway gateway_ip_address f) Commit the configuration:
commit-buffer
Note
For a clustered configuration, you must repeat these steps for each application attached to the FXOS
Chassis. In the case of an inter-chassis cluster or HA configuration, you must repeat these steps for each application on both chassis.
Step 4
Scope back to ssa mode:
scope ssa
Step 5
Scope to the slot:
scope slot slot_number
Step 6
Scope to the application.
scope app-instance asa_or_ftd
Step 7
Clear the management bootstrap information.
clear mgmt-bootstrap commit-buffer
Note
For a clustered configuration, you must clear the management bootstrap information for each application attached to the FXOS Chassis. In the case of an inter-chassis cluster or HA configuration, you must repeat these steps for each application on both chassis.
Step 8
Disable the application: a) Scope back to ssa mode:
scope ssa
b) Scope to the slot:
scope slot slot_number c) Scope to the application:
scope app-instance asa_or_ftd d) Disable the application:
disable
e) Commit the configuration:
commit-buffer
Note
For a clustered configuration, you must disable each application attached to the FXOS Chassis. In the case of an inter-chassis cluster or HA configuration, you must repeat these steps for each application on both chassis.
Step 9
When the application is offline, and the slot comes back online, re-enable the application: a) Scope back to ssa mode:
scope ssa
56
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
System Administration
Pre-Login Banner
b) Scope to the slot:
scope slot slot_number c) Scope to the application:
scope app-instance asa_or_ftd d) Enable the application:
enable
e) Commit the configuration:
commit-buffer
Note
For a clustered configuration, you must repeat this step for each application attached to the FXOS
Chassis. In the case of an inter-chassis cluster or HA configuration, you must repeat these steps for each application on both chassis.
Pre-Login Banner
With a pre-login banner, when a user logs into Firepower Chassis Manager, the system displays the banner text and the user must click
OK
on the message screen before the system prompts for the username and password. If a pre-login banner is not configured, the system goes directly to the username and password prompt.
When a user logs into the FXOS CLI, the system displays the banner text, if configured, before it prompts for the password.
Creating the Pre-Login Banner
Procedure
Step 1
Connect to the FXOS CLI (see
Accessing the FXOS CLI, on page 8
).
Step 2
Enter security mode:
Firepower-chassis#
scope security
Step 3
Enter banner security mode:
Firepower-chassis /security #
scope banner
Step 4
Enter the following command to create a pre-login banner:
Firepower-chassis /security/banner #
create pre-login-banner
Step 5
Specify the message that FXOS should display to the user before they log into Firepower Chassis Manager or the FXOS CLI:
Firepower-chassis /security/banner/pre-login-banner* #
set message
Launches a dialog for entering the pre-login banner message text.
Step 6
At the prompt, type a pre-login banner message. You can enter any standard ASCII character in this field.
You can enter multiple lines of text with each line having up to 192 characters. Press
Enter
between lines.
On the line following your input, type ENDOFBUF and press
Enter
to finish.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
57
System Administration
Modifying the Pre-Login Banner
Press Ctrl and C to cancel out of the set message dialog.
Step 7
Commit the transaction to the system configuration:
Firepower-chassis /security/banner/pre-login-banner* #
commit-buffer
The following example creates the pre-login banner:
Firepower-chassis#
scope security
Firepower-chassis /security #
scope banner
Firepower-chassis /security/banner #
create pre-login-banner
Firepower-chassis /security/banner/pre-login-banner* #
set message
Enter lines one at a time. Enter ENDOFBUF to finish. Press ^C to abort.
Enter prelogin banner:
>Welcome to the Firepower Security Appliance
>**Unauthorized use is prohibited**
>ENDOFBUF
Firepower-chassis /security/banner/pre-login-banner* #
commit-buffer
Firepower-chassis /security/banner/pre-login-banner #
Modifying the Pre-Login Banner
Procedure
Step 1
Connect to the FXOS CLI (see
Accessing the FXOS CLI, on page 8
).
Step 2
Enter security mode:
Firepower-chassis#
scope security
Step 3
Enter banner security mode:
Firepower-chassis /security #
scope banner
Step 4
Enter pre-login-banner banner security mode:
Firepower-chassis /security/banner #
scope pre-login-banner
Step 5
Specify the message that FXOS should display to the user before they log into Firepower Chassis Manager or the FXOS CLI:
Firepower-chassis /security/banner/pre-login-banner #
set message
Launches a dialog for entering the pre-login banner message text.
Step 6
At the prompt, type a pre-login banner message. You can enter any standard ASCII character in this field.
You can enter multiple lines of text with each line having up to 192 characters. Press
Enter
between lines.
On the line following your input, type ENDOFBUF and press
Enter
to finish.
Press Ctrl and C to cancel out of the set message dialog.
Step 7
Commit the transaction to the system configuration:
Firepower-chassis /security/banner/pre-login-banner* #
commit-buffer
The following example modifies the pre-login banner:
Firepower-chassis#
scope security
Firepower-chassis /security #
scope banner
Firepower-chassis /security/banner #
scope pre-login-banner
Firepower-chassis /security/banner/pre-login-banner #
set message
58
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
System Administration
Deleting the Pre-Login Banner
Enter lines one at a time. Enter ENDOFBUF to finish. Press ^C to abort.
Enter prelogin banner:
>Welcome to the Firepower Security Appliance
>**Unauthorized use is prohibited**
>ENDOFBUF
Firepower-chassis /security/banner/pre-login-banner* #
commit-buffer
Firepower-chassis /security/banner/pre-login-banner #
Deleting the Pre-Login Banner
Procedure
Step 1
Connect to the FXOS CLI (see
Accessing the FXOS CLI, on page 8
).
Step 2
Enter security mode:
Firepower-chassis#
scope security
Step 3
Enter banner security mode:
Firepower-chassis /security #
scope banner
Step 4
Delete the pre-login banner from the system:
Firepower-chassis /security/banner #
delete pre-login-banner
Step 5
Commit the transaction to the system configuration:
Firepower-chassis /security/banner* #
commit-buffer
The following example deletes the pre-login banner:
Firepower-chassis#
scope security
Firepower-chassis /security #
scope banner
Firepower-chassis /security/banner #
delete pre-login-banner
Firepower-chassis /security/banner* #
commit-buffer
Firepower-chassis /security/banner #
Rebooting the FXOS Chassis
Procedure
Step 1
Choose
Overview
to open the Overview page.
Step 2
Click
Reboot
next to the Chassis Uptime in the upper-right corner of the Overview page.
Step 3
Click
Yes
to verify that you want to power off the FXOS chassis.
The system will gracefully shut down any logical devices configured on the system and then power down each security module/engine before finally powering down and then restarting the FXOS chassis. This process takes approximately 15-20 minutes.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
59
System Administration
Powering Off the FXOS Chassis
Powering Off the FXOS Chassis
Procedure
Step 1
Choose
Overview
to open the Overview page.
Step 2
Click
Shutdown
next to the Chassis Uptime in the upper-right corner of the Overview page.
Step 3
Click
Yes
to verify that you want to power off the FXOS chassis.
The system will gracefully shut down any logical devices configured on the system and then power down each security module/engine before finally powering down the FXOS chassis.
Install a Trusted Identity Certificate
After initial configuration, a self-signed SSL certificate is generated for use with the FXOS chassis web application. Because that certificate is self-signed, client browsers do not automatically trust it. The first time a new client browser accesses the FXOS chassis web interface, the browser will throw an SSL warning, requiring the user to accept the certificate before accessing the FXOS chassis. You can use the following procedure to generate a Certificate Signing Request (CSR) using the FXOS CLI and install the resulting identity certificate for use with the FXOS chassis. This identity certificate allows a client browser to trust the connection, and bring up the web interface with no warnings.
Procedure
Step 1
Connect to the FXOS CLI. (See
Accessing the FXOS CLI, on page 8
).
Step 2
Enter the security module:
scope security
Step 3
Create a keyring:
create keyring keyring_name
Step 4
Set a modulus size for the private key:
set modulus size
Step 5
Commit the configuration:
commit-buffer
Step 6
Configure the CSR fields. The certificate can be generated with basic options (for example, a subject-name), and optionally more advanced options that allow information like locale and organization to be embedded in the certificate. Note that when you configure the CSR fields, the system prompts for a certificate password.
create certreq certreq subject_name
password
set country country
set state state
set locality locality
60
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
System Administration
Install a Trusted Identity Certificate
set org-name organization_name
set org-unit-name organization_unit_name
set subject-name subject_name
Step 7
Commit the configuration:
commit-buffer
Step 8
Export the CSR to provide to your certificate authority.
a) Show the full CSR:
show certreq
b) Copy the output starting with (and including) "-----BEGIN CERTIFICATE REQUEST-----", ending with
(and including) "-----END CERTIFICATE REQUEST-----":
Example:
-----BEGIN CERTIFICATE REQUEST-----
MIIC6zCCAdMCAQAwdzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWEx
ETAPBgNVBAcMCFNhbiBKb3NlMRYwFAYDVQQKDA1DaXNjbyBTeXN0ZW1zMQwwCgYD
VQQLDANUQUMxGjAYBgNVBAMMEWZwNDEyMC50ZXN0LmxvY2FsMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs0ON5gagkfZ2fi4JVEANG+7YGgcHbnUt7LpV yMChnKOPJjBwkUMNQA1mQsRQDcbJ232/sK0fMSnyqOL8JzC7itxeVEZRyz7/ax7W
GNveg/XP+zd03nt4GXM63FsrPcPmA7EwgqDSLoShtBEV10hhf4+Nw4pKCZ+eSSkS
JkTB1ZHaKV9bttYg3kf/UEUUgk/EyrVq3B+u2DsooPVq76mTm8BwYMqHbJEv4Pmu
RjWE88yEvVwH7JTEij9OvxbatjDjVSJHZBURtCanvyBvGuLP/Q/Nmv3Lo3G9ITbL
L5gIYZVatTxp6HTUezH2MIIzOavU6d1tB9rnyxgGth5dPV0dhQIDAQABoC8wLQYJ
KoZIhvcNAQkOMSAwHjAcBgNVHREEFTATghFmcDQxMjAudGVzdC5sb2NhbDANBgkq hkiG9w0BAQsFAAOCAQEAZUfCbwx9vt5aVDcL+tATu5xFE3LA310ck6GjlNv6W/6r jBNLxusYi1rZZcW+CgnvNs4ArqYGyNVBySOavJO/VvQ1KfyxxJ1OIkyx3RzEjgK0 zzyoyrG+EZXC5ShiraS8HuWvE2wFM2wwWNtHWtvcQy55+/hDPD2Bv8pQOC2Zng3I kLfG1dxWf1xAxLzf5J+AuIQ0CM5HzM9Zm8zREoWT+xHtLSqAqg/aCuomN9/vEwyU
OYfoJMvAqC6AZyUnMfUfCoyuLpLwgkxB0gyaRdnea5RhiGjYQ2lDXYDjEXp7rCx9
+6bvDl1n70JCegHdCWtP75SaNyaBEPkO0365rTckbw==
-----END CERTIFICATE REQUEST-----
Step 9
Exit the certreq mode:
exit
Step 10
Exit the keyring mode:
exit
Step 11
Note
All certificates must be in Base64 format to be imported into FXOS. If the certificate or chain received from the Certificate Authority is in a different format, you must first convert it with an SSL tool such as OpenSSL.
Create a new trustpoint to hold the certificate chain.
create trustpoint trustpoint_name
Step 12
Set the generated CSR in the trustpoint:
set certchain
Step 13
Note
For a Certificate Authority that uses intermediate certificates, the root and intermediate certificates must be combined. In a text file, paste the root certificate at the top, followed by each intermediate certificate in the chain, including all BEGIN CERTIFICATE and END CERTIFICATE flags. Copy and paste that entire text block into the trustpoint.
Enter the CSR output you copied in step 8, following the instructions on screen.
Example:
Enter lines one at a time. Enter ENDOFBUF to finish. Press ^C to abort.
Trustpoint Certificate Chain:
>
-----BEGIN CERTIFICATE-----
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
61
System Administration
Install a Trusted Identity Certificate
>
MIICDTCCAbOgAwIBAgIQYIutxPDPw6BOp3uKNgJHZDAKBggqhkjOPQQDAjBTMRUw
>
EwYKCZImiZPyLGQBGRYFbG9jYWwxGDAWBgoJkiaJk/IsZAEZFghuYWF1c3RpbjEg
>
MB4GA1UEAxMXbmFhdXN0aW4tTkFBVVNUSU4tUEMtQ0EwHhcNMTUwNzI4MTc1NjU2
>
WhcNMjAwNzI4MTgwNjU2WjBTMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxGDAWBgoJ
>
kiaJk/IsZAEZFghuYWF1c3RpbjEgMB4GA1UEAxMXbmFhdXN0aW4tTkFBVVNUSU4t
>
UEMtQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASvEA27V1Enq1gMtLkvJ6rx
>
GXRpXWIEyuiBM4eQRoqZKnkeJUkm1xmqlubaDHPJ5TMGfJQYszLBRJPq+mdrKcDl
>
o2kwZzATBgkrBgEEAYI3FAIEBh4EAEMAQTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0T
>
AQH/BAUwAwEB/zAdBgNVHQ4EFgQUyInbDHPrFwEEBcbxGSgQW7pOVIkwEAYJKwYB
>
BAGCNxUBBAMCAQAwCgYIKoZIzj0EAwIDSAAwRQIhAP++QJTUmniB/AxPDDN63Lqy
>
18odMDoFTkG4p3Tb/2yMAiAtMYhlsv1gCxsQVOw0xZVRugSdoOak6n7wCjTFX9jr
>
RA==
>
-----END CERTIFICATE-----
>
ENDOFBUF
Step 14
Commit the configuration:
commit-buffer
Step 15
Exit the trustpoint mode:
exit
Step 16
Enter the keyring mode:
scope keyring keyring_name
Step 17
Associate the trustpoint created in step 13 with the keyring that was created for the CSR:
set trustpoint trustpoint_name
Step 18
Import the signed identity certificate for the server.
set cert
Step 19
Paste the contents of the identity certificate provided by the Certificate authority:
Example:
Enter lines one at a time. Enter ENDOFBUF to finish. Press ^C to abort.
Keyring certificate:
>
-----BEGIN CERTIFICATE-----
>
MIIE8DCCBJagAwIBAgITRQAAAArehlUWgiTzvgAAAAAACjAKBggqhkjOPQQDAjBT
>
MRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxGDAWBgoJkiaJk/IsZAEZFghuYWF1c3Rp
>
bjEgMB4GA1UEAxMXbmFhdXN0aW4tTkFBVVNUSU4tUEMtQ0EwHhcNMTYwNDI4MTMw
>
OTU0WhcNMTgwNDI4MTMwOTU0WjB3MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2Fs
>
aWZvcm5pYTERMA8GA1UEBxMIU2FuIEpvc2UxFjAUBgNVBAoTDUNpc2NvIFN5c3Rl
>
bXMxDDAKBgNVBAsTA1RBQzEaMBgGA1UEAxMRZnA0MTIwLnRlc3QubG9jYWwwggEi
>
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCzQ43mBqCR9nZ+LglUQA0b7tga
>
BwdudS3sulXIwKGco48mMHCRQw1ADWZCxFANxsnbfb+wrR8xKfKo4vwnMLuK3F5U
>
RlHLPv9rHtYY296D9c/7N3Tee3gZczrcWys9w+YDsTCCoNIuhKG0ERXXSGF/j43D
>
ikoJn55JKRImRMHVkdopX1u21iDeR/9QRRSCT8TKtWrcH67YOyig9WrvqZObwHBg
>
yodskS/g+a5GNYTzzIS9XAfslMSKP06/Ftq2MONVIkdkFRG0Jqe/IG8a4s/9D82a
>
/cujcb0hNssvmAhhlVq1PGnodNR7MfYwgjM5q9Tp3W0H2ufLGAa2Hl09XR2FAgMB
>
AAGjggJYMIICVDAcBgNVHREEFTATghFmcDQxMjAudGVzdC5sb2NhbDAdBgNVHQ4E
>
FgQU/1WpstiEYExs8DlZWcuHZwPtu5QwHwYDVR0jBBgwFoAUyInbDHPrFwEEBcbx
>
GSgQW7pOVIkwgdwGA1UdHwSB1DCB0TCBzqCBy6CByIaBxWxkYXA6Ly8vQ049bmFh
>
dXN0aW4tTkFBVVNUSU4tUEMtQ0EsQ049bmFhdXN0aW4tcGMsQ049Q0RQLENOPVB1
>
YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRp
>
b24sREM9bmFhdXN0aW4sREM9bG9jYWw/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz
>
dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHMBggrBgEF
>
BQcBAQSBvzCBvDCBuQYIKwYBBQUHMAKGgaxsZGFwOi8vL0NOPW5hYXVzdGluLU5B
>
QVVTVElOLVBDLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxD
>
Tj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPW5hYXVzdGluLERDPWxvY2Fs
>
P2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0
>
aG9yaXR5MCEGCSsGAQQBgjcUAgQUHhIAVwBlAGIAUwBlAHIAdgBlAHIwDgYDVR0P
>
AQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAoGCCqGSM49BAMCA0gAMEUC
>
IFew7NcJirEtFRvyxjkQ4/dVo2oI6CRB308WQbYHNUu/AiEA7UdObiSJBG/PBZjm
>
sgoIK60akbjotOTvUdUd9b6K1Uw=
>
-----END CERTIFICATE-----
62
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
System Administration
Install a Trusted Identity Certificate
>
ENDOFBUF
Step 20
Exit the keyring mode:
exit
Step 21
Exit the security mode:
exit
Step 22
Enter the system mode:
scope system
Step 23
Enter the services mode:
scope services
Step 24
Configure the FXOS web service to use the new certificate:
set https keyring keyring_name
Step 25
Commit the configuration:
commit-buffer
Step 26
Display the keyring associated with the HTTPS server. It should reflect the keyring name created in step 3 of this procedure. If the screen output displays the default keyring name, the HTTPS server has not yet been updated to use the new certificate:
show https
Example:
fp4120 /system/services #
show https
Name: https
Admin State: Enabled
Port: 443
Operational port: 443
Key Ring:
firepower_cert
Cipher suite mode: Medium Strength
Cipher suite: ALL:!ADH:!EXPORT40:!EXPORT56:!LOW:!RC4:!MD5:!IDEA:+HIGH:+MEDIUM:+EXP:+eNULL
Step 27
Display the contents of the imported certificate, and verify that the
Certificate Status
value displays as
Valid
:
scope security
show keyring keyring_name detail
Example:
fp4120 /security #
scope security
fp4120 /security #
show keyring firepower_cert detail
Keyring firepower_cert:
RSA key modulus: Mod2048
Trustpoint CA: firepower_chain
Certificate status: Valid
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
45:00:00:00:0a:de:86:55:16:82:24:f3:be:00:00:00:00:00:0a
Signature Algorithm: ecdsa-with-SHA256
Issuer: DC=local, DC=naaustin, CN=naaustin-NAAUSTIN-PC-CA
Validity
Not Before: Apr 28 13:09:54 2016 GMT
Not After : Apr 28 13:09:54 2018 GMT
Subject: C=US, ST=California, L=San Jose, O=Cisco Systems, OU=TAC,
CN=fp4120.test.local
Subject Public Key Info:
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
63
System Administration
Install a Trusted Identity Certificate
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:b3:43:8d:e6:06:a0:91:f6:76:7e:2e:09:54:40:
0d:1b:ee:d8:1a:07:07:6e:75:2d:ec:ba:55:c8:c0: a1:9c:a3:8f:26:30:70:91:43:0d:40:0d:66:42:c4:
50:0d:c6:c9:db:7d:bf:b0:ad:1f:31:29:f2:a8:e2: fc:27:30:bb:8a:dc:5e:54:46:51:cb:3e:ff:6b:1e: d6:18:db:de:83:f5:cf:fb:37:74:de:7b:78:19:73:
3a:dc:5b:2b:3d:c3:e6:03:b1:30:82:a0:d2:2e:84: a1:b4:11:15:d7:48:61:7f:8f:8d:c3:8a:4a:09:9f:
9e:49:29:12:26:44:c1:d5:91:da:29:5f:5b:b6:d6:
20:de:47:ff:50:45:14:82:4f:c4:ca:b5:6a:dc:1f: ae:d8:3b:28:a0:f5:6a:ef:a9:93:9b:c0:70:60:ca:
87:6c:91:2f:e0:f9:ae:46:35:84:f3:cc:84:bd:5c:
07:ec:94:c4:8a:3f:4e:bf:16:da:b6:30:e3:55:22:
47:64:15:11:b4:26:a7:bf:20:6f:1a:e2:cf:fd:0f: cd:9a:fd:cb:a3:71:bd:21:36:cb:2f:98:08:61:95:
5a:b5:3c:69:e8:74:d4:7b:31:f6:30:82:33:39:ab: d4:e9:dd:6d:07:da:e7:cb:18:06:b6:1e:5d:3d:5d:
1d:85
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:fp4120.test.local
X509v3 Subject Key Identifier:
FF:55:A9:B2:D8:84:60:4C:6C:F0:39:59:59:CB:87:67:03:ED:BB:94
X509v3 Authority Key Identifier: keyid:C8:89:DB:0C:73:EB:17:01:04:05:C6:F1:19:28:10:5B:BA:4E:54:89
X509v3 CRL Distribution Points:
Full Name:
URI:ldap:///CN=naaustin-NAAUSTIN-PC-CA,CN=naaustin-pc,CN=CDP,
CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=naaustin,
DC=local?certificateRevocationList?base?objectClass=cRLDistributionPoint
Authority Information Access:
CA Issuers - URI:ldap:///CN=naaustin-NAAUSTIN-PC-CA,CN=AIA,
CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=naaustin,
DC=local?cACertificate?base?objectClass=certificationAuthority
1.3.6.1.4.1.311.20.2:
...W.e.b.S.e.r.v.e.r
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication
Signature Algorithm: ecdsa-with-SHA256
30:45:02:20:57:b0:ec:d7:09:8a:b1:2d:15:1b:f2:c6:39:10: e3:f7:55:a3:6a:08:e8:24:41:df:4f:16:41:b6:07:35:4b:bf:
02:21:00:ed:47:4e:6e:24:89:04:6f:cf:05:98:e6:b2:0a:08:
2b:ad:1a:91:b8:e8:b4:e4:ef:51:d5:1d:f5:be:8a:d5:4c
-----BEGIN CERTIFICATE-----
MIIE8DCCBJagAwIBAgITRQAAAArehlUWgiTzvgAAAAAACjAKBggqhkjOPQQDAjBT
MRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxGDAWBgoJkiaJk/IsZAEZFghuYWF1c3Rp bjEgMB4GA1UEAxMXbmFhdXN0aW4tTkFBVVNUSU4tUEMtQ0EwHhcNMTYwNDI4MTMw
OTU0WhcNMTgwNDI4MTMwOTU0WjB3MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2Fs aWZvcm5pYTERMA8GA1UEBxMIU2FuIEpvc2UxFjAUBgNVBAoTDUNpc2NvIFN5c3Rl bXMxDDAKBgNVBAsTA1RBQzEaMBgGA1UEAxMRZnA0MTIwLnRlc3QubG9jYWwwggEi
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCzQ43mBqCR9nZ+LglUQA0b7tga
BwdudS3sulXIwKGco48mMHCRQw1ADWZCxFANxsnbfb+wrR8xKfKo4vwnMLuK3F5U
RlHLPv9rHtYY296D9c/7N3Tee3gZczrcWys9w+YDsTCCoNIuhKG0ERXXSGF/j43D ikoJn55JKRImRMHVkdopX1u21iDeR/9QRRSCT8TKtWrcH67YOyig9WrvqZObwHBg yodskS/g+a5GNYTzzIS9XAfslMSKP06/Ftq2MONVIkdkFRG0Jqe/IG8a4s/9D82a
/cujcb0hNssvmAhhlVq1PGnodNR7MfYwgjM5q9Tp3W0H2ufLGAa2Hl09XR2FAgMB
AAGjggJYMIICVDAcBgNVHREEFTATghFmcDQxMjAudGVzdC5sb2NhbDAdBgNVHQ4E
FgQU/1WpstiEYExs8DlZWcuHZwPtu5QwHwYDVR0jBBgwFoAUyInbDHPrFwEEBcbx
GSgQW7pOVIkwgdwGA1UdHwSB1DCB0TCBzqCBy6CByIaBxWxkYXA6Ly8vQ049bmFh dXN0aW4tTkFBVVNUSU4tUEMtQ0EsQ049bmFhdXN0aW4tcGMsQ049Q0RQLENOPVB1
YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRp b24sREM9bmFhdXN0aW4sREM9bG9jYWw/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHMBggrBgEF
BQcBAQSBvzCBvDCBuQYIKwYBBQUHMAKGgaxsZGFwOi8vL0NOPW5hYXVzdGluLU5B
QVVTVElOLVBDLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxD
64
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
System Administration
Recovering from a Software Failure
Tj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPW5hYXVzdGluLERDPWxvY2Fs
P2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0 aG9yaXR5MCEGCSsGAQQBgjcUAgQUHhIAVwBlAGIAUwBlAHIAdgBlAHIwDgYDVR0P
AQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAoGCCqGSM49BAMCA0gAMEUC
IFew7NcJirEtFRvyxjkQ4/dVo2oI6CRB308WQbYHNUu/AiEA7UdObiSJBG/PBZjm sgoIK60akbjotOTvUdUd9b6K1Uw=
-----END CERTIFICATE-----
Zeroized: No
What to Do Next
To verify that the new trusted certificate is presented, navigate to the Firepower Chassis Manager by entering
https://<FQDN_or_IP>/
in the address bar of a web browser.
Note
Browsers also verify the subject-name of a certificate against the input in the address bar. If the certificate is issued to the fully qualified domain name, it must be accessed that way in the browser. If it is accessed via IP address, a different SSL error is thrown (Common Name Invalid) even if the trusted certificate is used.
Recovering from a Software Failure
Before You Begin
In the event of software failure that prevents the system from booting successfully, you can use the following procedure to boot a new version of software. To complete this process you need to TFTP boot a kickstart image, download new system and manager images, and then boot using the new images.
The recovery images for a specific FXOS version can be obtained from Cisco.com at one of the following locations:
•
Firepower 9300
— https://software.cisco.com/portal/pub/download/portal/ select.html?&mdfid=286287252&flowid=77282&softwareid=286287263
•
Firepower 4100 Series
— https://software.cisco.com/portal/pub/download/portal/ select.html?&mdfid=286305187&flowid=79423&softwareid=286287263
The recovery images include three separate files. For example, below are the current recovery images for
FXOS 2.1.1.64.
Recovery image (kickstart) for FX-OS 2.1.1.64.
fxos-k9-kickstart.5.0.3.N2.4.11.63.SPA
Recovery image (manager) for FX-OS 2.1.1.64.
fxos-k9-manager.4.1.1.63.SPA
Recovery image (system) for FX-OS 2.1.1.64.
fxos-k9-system.5.0.3.N2.4.11.63.SPA
Procedure
Step 1
Access ROMMON:
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
65
System Administration
Recovering from a Software Failure
a) Connect to the console port.
b) Reboot the system.
The system will start loading and during the process display a countdown timer.
c) Press the
Escape
key during the countdown to enter ROMMON mode.
Example:
Cisco System ROMMON, version 1.0.09, RELEASE SOFTWARE
Copright (c) 1994-2015 by Cisco Systems, Inc.
Compiled Sun 01/01/1999 23:59:59:59.99 by user
Current image running: Boot ROM0
Last reset cause: LocalSoft
DIMM Slot 0 : Present
DIMM Slot 1 : Present
No USB drive !!
Platform FPR9K-SUP with 16384 Mbytes of main memory
MAC Address aa:aa:aa:aa:aa:aa find the string ! boot bootflash:/installables/switch/fxos-k9-kickstart.5.0.3.N2.0.00.00.SPA
bootflash:/installables/switch/fxos-k9-system.5.0.3.N2.0.00.00.SPA
Use BREAK, ESC or CTRL+L to interrupt boot.
use SPACE to begin boot immediately.
Boot interrupted.
rommon 1 >
Step 2
TFTP boot a kickstart image: a) Verify that the management IP address, management netmask, and gateway IP address are set correctly.
You can see their values using the
set
command. You can test the connectivity to the TFTP server using the
ping
command.
rommon 1 >
set
ADDRESS=
NETMASK=
GATEWAY=
SERVER=
IMAGE=
PS1="ROMMON ! > " rommon > address <ip-address> rommon >
netmask <network-mask> rommon > gateway <default-gateway> b) Copy the kickstart image to a TFTP directory that is accessible from your FXOS chassis.
Note
The kickstart image version number will not match the bundle version number. Information showing the mapping between your FXOS version and the kickstart image can be found on the
Cisco.com software download page.
c) Boot the image from ROMMON using the boot command:
boot tftp://<IP address>/<path to image>
Note
You can also boot the kickstart from ROMMON using a USB media device inserted into the USB slot on the front panel of the FXOS chassis. If the USB device is inserted while the system is running, you will need to reboot the system before it will recognize the USB device.
The system will display a series of #'s indicating that the image is being received and will then load the kickstart image.
66
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
System Administration
Recovering from a Software Failure
Example:
rommon 1 >
set
ADDRESS=
NETMASK=
GATEWAY=
SERVER=
IMAGE=
PS1="ROMMON ! > " rommon 2 >
address 10.0.0.2
rommon 3 >
netmask 255.255.255.0
rommon 4 >
gateway 10.0.0.1
rommon 5 >
ping 10.0.0.2
..!!!!!!!!!!
Success rate is 100 percent (10/10) rommon 6 >
ping 192.168.1.2
..!!!!!!!!!!
Success rate is 100 percent (10/10) rommon 7 >
boot tftp://192.168.1.2/fxos-k9-kickstart.5.0.3.N2.1.11.1.SPA
ADDRESS: 10.0.0.2
NETMASK: 255.255.255.0
GATEWAY: 10.0.0.1
SERVER: 192.168.1.2
IMAGE: fxos-k9-kickstart.5.0.3.N2.1.11.1.SPA
TFTP_MACADDR: aa:aa:aa:aa:aa:aa
............................................................................
Receiving fxos-k9-kickstart.5.0.3.N2.1.11.1.SPA from 192.168.1.2
###############################################################################
###############################################################################
#############################################################################
File reception completed.
Step 3
Download the recovery system and manager images that match the kickstart image you just loaded to the
FXOS chassis: a) To download the recovery system and manager images you will need to set the management IP address and gateway. You cannot download these images via USB.
switch(boot)#
config terminal
switch(boot)(config)#
interface mgmt 0
switch(boot)(config-if)# ip address <ip address> <netmask> switch(boot)(config-if)#
no shutdown
switch(boot)(config-if)#
exit
switch(boot)(config)# ip default-gateway <gateway> switch(boot)(config)#
exit
b) Copy the recovery system and manager images from the remote server to the bootflash: switch(boot)#
copy URL bootflash:
Specify the URL for the file being imported using one of the following syntax:
•
ftp
://
username
@
hostname
/
path
/
image_name
•
scp
://
username
@
hostname
/
path
/
image_name
•
sftp
://
username
@
hostname
/
path
/
image_name
•
tftp
://
hostname
/
path
/
image_name
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
67
System Administration
Recovering from a Software Failure
Example:
switch(boot)#
copy scp://<username>@192.168.1.2/recovery_images/fxos-k9-system.5.0.3.N2.4.11.69.SPA
bootflash:
switch(boot)#
copy scp://<username>@192.168.1.2/recovery_images/fxos-k9-manager.4.1.1.69.SPA
bootflash:
c) After the images have been successfully copied to the FXOS chassis, make a symlink to the manager image from nuova-sim-mgmt-nsg.0.1.0.001.bin. This link tells the load mechanism which manager image to load. The symlink name should always be nuova-sim-mgmt-nsg.0.1.0.001.bin regardless of what image you are trying to load.
switch(boot)# copy bootflash:<manager-image>
bootflash:nuova-sim-mgmt-nsg.0.1.0.001.bin
Example:
switch(boot)#
config terminal
Enter configuration commands, one per line.
End with CNTL/Z.
switch(boot)(config)#
interface mgmt 0
switch(boot)(config-if)#
ip address 10.0.0.2 255.255.255.0
switch(boot)(config-if)#
no shutdown
switch(boot)(config-if)#
exit
switch(boot)(config)#
ip default-gateway 10.0.0.1
switch(boot)(config)#
exit
switch(boot)#
copy tftp://192.168.1.2/recovery_images/fxos-k9-system.5.0.3.N2.4.11.69.SPA
bootflash:
Trying to connect to tftp server......
Connection to server Established. Copying Started.....
/
TFTP get operation was successful
Copy complete, now saving to disk (please wait)...
switch(boot)#
copy tftp://192.168.1.2/recovery_images/fxos-k9-manager.4.1.1.69.SPA
bootflash:
Trying to connect to tftp server......
Connection to server Established. Copying Started.....
/
TFTP get operation was successful
Copy complete, now saving to disk (please wait)...
switch(boot)#
copy bootflash:fxos-k9-manager.4.1.1.69.SPA
bootflash:nuova-sim-mgmt-nsg.0.1.0.001.bin
Copy complete, now saving to disk (please wait)...
switch(boot)#
Step 4
Load the system image that you just downloaded: switch(boot)# load bootflash:<system-image>
Example:
switch(boot)# load bootflash:fxos-k9-system.5.0.3.N2.4.11.69.SPA
Uncompressing system image: bootflash:/fxos-k9-system.5.0.3.N2.4.11.69.SPA
Manager image digital signature verification successful
...
68
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
System Administration
Recovering from a Corrupted File System
System is coming up ... Please wait ...
Cisco FPR Series Security Appliance
FP9300-A login:
Step 5
After the recovery images have loaded, enter the following commands to prevent the system from trying to load the prior images:
Note
This step should be performed immediately after loading the recovery images.
FP9300-A#
scope org
FP9300-A /org #
scope fw-platform-pack default
FP9300-A /org/fw-platform-pack #
set platform-bundle-version ""
Warning: Set platform version to empty will result software/firmware incompatibility issue.
FP9300-A /org/fw-platform-pack* #
commit-buffer
Step 6
Download and install the Platform Bundle image that you want to use on your FXOS chassis. For more information, see
.
Example:
FP9300-A# scope firmware
FP9300-A /firmware # show download-task
Download task:
File Name Protocol Server Port Userid State
--------- -------- --------------- ---------- --------------- ----fxos-k9.2.1.1.73.SPA
Tftp 192.168.1.2
0 Downloaded
FP9300-A /firmware # show package fxos-k9.2.1.1.73.SPA detail
Firmware Package fxos-k9.2.1.1.73.SPA:
Version: 2.1(1.73)
Type: Platform Bundle
State: Active
Time Stamp: 2012-01-01T07:40:28.000
Build Date: 2017-02-28 13:51:08 UTC
FP9300-A /firmware #
Recovering from a Corrupted File System
Before You Begin
If the Supervisor ’ s onboard flash becomes corrupted and the system is no longer able to start successfully, you can use the following procedure to recover the system. To complete this process you need to TFTP boot a kickstart image, reformat the flash, download new system and manager images, and then boot using the new images.
Note
This procedure includes reformatting the system flash. As a result, you will need to completely reconfigure your system after it has been recovered.
The recovery images for a specific FXOS version can be obtained from Cisco.com at one of the following locations:
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
69
System Administration
Recovering from a Corrupted File System
• Firepower 9300 — https://software.cisco.com/portal/pub/download/portal/ select.html?&mdfid=286287252&flowid=77282&softwareid=286287263
• Firepower 4100 Series — https://software.cisco.com/portal/pub/download/portal/ select.html?&mdfid=286305187&flowid=79423&softwareid=286287263
The recovery images include three separate files. For example, below are the recovery images for FXOS
2.1.1.64.
Recovery image (kickstart) for FX-OS 2.1.1.64.
fxos-k9-kickstart.5.0.3.N2.4.11.63.SPA
Recovery image (manager) for FX-OS 2.1.1.64.
fxos-k9-manager.4.1.1.63.SPA
Recovery image (system) for FX-OS 2.1.1.64.
fxos-k9-system.5.0.3.N2.4.11.63.SPA
Procedure
Step 1
Access ROMMON: a) Connect to the console port.
b) Reboot the system.
The system will start loading and during the process display a countdown timer.
c) Press the
Escape
key during the countdown to enter ROMMON mode.
Example:
Cisco System ROMMON, version 1.0.09, RELEASE SOFTWARE
Copright (c) 1994-2015 by Cisco Systems, Inc.
Compiled Sun 01/01/1999 23:59:59:59.99 by user
Current image running: Boot ROM0
Last reset cause: LocalSoft
DIMM Slot 0 : Present
DIMM Slot 1 : Present
No USB drive !!
Platform FPR9K-SUP with 16384 Mbytes of main memory
MAC Address aa:aa:aa:aa:aa:aa find the string ! boot bootflash:/installables/switch/fxos-k9-kickstart.5.0.3.N2.0.00.00.SPA
bootflash:/installables/switch/fxos-k9-system.5.0.3.N2.0.00.00.SPA
Use BREAK, ESC or CTRL+L to interrupt boot.
use SPACE to begin boot immediately.
Boot interrupted.
rommon 1 >
Step 2
TFTP boot a kickstart image: a) Verify that the management IP address, management netmask, and gateway IP address are set correctly.
You can see their values using the
set
command. You can test the connectivity to the TFTP server using the
ping
command.
rommon 1 >
set
ADDRESS=
NETMASK=
GATEWAY=
SERVER=
70
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
System Administration
Recovering from a Corrupted File System
IMAGE=
PS1="ROMMON ! > " rommon > address <ip-address> rommon > netmask <network-mask> rommon >
gateway <default-gateway> b) Copy the kickstart image to a TFTP directory that is accessible from your FXOS chassis.
Note
The kickstart image version number will not match the bundle version number. Information showing the mapping between your FXOS version and the kickstart image can be found on the
Cisco.com software download page.
c) Boot the image from ROMMON using the boot command:
boot tftp://<IP address>/<path to image>
Note
You can also boot the kickstart from ROMMON using a USB media device inserted into the USB slot on the front panel of the FXOS chassis. If the USB device is inserted while the system is running, you will need to reboot the system before it will recognize the USB device.
The system will display a series of #'s indicating that the image is being received and will then load the kickstart image.
Example:
rommon 1 >
set
ADDRESS=
NETMASK=
GATEWAY=
SERVER=
IMAGE=
PS1="ROMMON ! > " rommon 2 >
address 10.0.0.2
rommon 3 >
netmask 255.255.255.0
rommon 4 >
gateway 10.0.0.1
rommon 5 >
ping 10.0.0.2
..!!!!!!!!!!
Success rate is 100 percent (10/10) rommon 6 >
ping 192.168.1.2
..!!!!!!!!!!
Success rate is 100 percent (10/10) rommon 7 >
boot tftp://192.168.1.2/fxos-k9-kickstart.5.0.3.N2.1.11.1.SPA
ADDRESS: 10.0.0.2
NETMASK: 255.255.255.0
GATEWAY: 10.0.0.1
SERVER: 192.168.1.2
IMAGE: fxos-k9-kickstart.5.0.3.N2.1.11.1.SPA
TFTP_MACADDR: aa:aa:aa:aa:aa:aa
............................................................................
Receiving fxos-k9-kickstart.5.0.3.N2.1.11.1.SPA from 192.168.1.2
###############################################################################
###############################################################################
#############################################################################
File reception completed.
Step 3
After the kickstart image has loaded, reformat the flash using the
init system
command.
The
init system
command erases the contents of the flash including all software images downloaded to the system and all configurations on the system. The command takes approximately 20-30 minutes to complete.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
71
System Administration
Recovering from a Corrupted File System
Example:
switch(boot)# init system
This command is going to erase your startup-config, licenses as well as the contents of your bootflash:.
Do you want to continue? (y/n) [n] y
Detected 32GB flash...
Initializing the system mke2fs 1.35 (28-Feb-2004)
Checking for bad blocks (read-only test):
Initializing startup-config and licenses mke2fs 1.35 (28-Feb-2004)
Checking for bad blocks (read-only test): mke2fs 1.35 (28-Feb-2004)
Checking for bad blocks (read-only test): mke2fs 1.35 (28-Feb-2004)
Checking for bad blocks (read-only test):
Formatting bootflash: mke2fs 1.35 (28-Feb-2004)
Checking for bad blocks (read-only test):
Formatting SAM partition: mke2fs 1.35 (28-Feb-2004)
Checking for bad blocks (read-only test):
Formatting Workspace partition: mke2fs 1.35 (28-Feb-2004)
Checking for bad blocks (read-only test):
Formatting Sysdebug partition: mke2fs 1.35 (28-Feb-2004)
Checking for bad blocks (read-only test): done done done done done done done done
Step 4
Download the recovery images to the FXOS chassis: a) To download the recovery images you will need to set the management IP address and gateway. You cannot download these images via USB.
switch(boot)#
config terminal
switch(boot)(config)#
interface mgmt 0
switch(boot)(config-if)# ip address <ip address> <netmask> switch(boot)(config-if)#
no shutdown
switch(boot)(config-if)#
exit
switch(boot)(config)# ip default-gateway <gateway> switch(boot)(config)#
exit
b) Copy all three recovery images from the remote server to the bootflash: switch(boot)#
copy URL bootflash:
Specify the URL for the file being imported using one of the following syntax:
•
ftp
://
username
@
hostname
/
path
/
image_name
•
scp
://
username
@
hostname
/
path
/
image_name
•
sftp
://
username
@
hostname
/
path
/
image_name
•
tftp
://
hostname
/
path
/
image_name
Example:
switch(boot)#
copy scp://<username>@192.168.1.2/recovery_images/fxos-k9-kickstart.5.0.3.N2.4.11.69.SPA
bootflash:
72
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
System Administration
Recovering from a Corrupted File System
switch(boot)#
copy scp://<username>@192.168.1.2/recovery_images/fxos-k9-system.5.0.3.N2.4.11.69.SPA
bootflash:
switch(boot)#
copy scp://<username>@192.168.1.2/recovery_images/fxos-k9-manager.4.1.1.69.SPA
bootflash:
c) After the images have been successfully copied to the FXOS chassis, make a symlink to the manager image from nuova-sim-mgmt-nsg.0.1.0.001.bin. This link tells the load mechanism which manager image to load. The symlink name should always be nuova-sim-mgmt-nsg.0.1.0.001.bin regardless of what image you are trying to load.
switch(boot)#
copy bootflash:<manager-image>
bootflash:nuova-sim-mgmt-nsg.0.1.0.001.bin
Example:
switch(boot)#
config terminal
Enter configuration commands, one per line.
End with CNTL/Z.
switch(boot)(config)#
interface mgmt 0
switch(boot)(config-if)#
ip address 10.0.0.2 255.255.255.0
switch(boot)(config-if)#
no shutdown
switch(boot)(config-if)#
exit
switch(boot)(config)#
ip default-gateway 10.0.0.1
switch(boot)(config)#
exit
switch(boot)#
copy tftp://192.168.1.2/recovery_images/fxos-k9-kickstart.5.0.3.N2.4.11.69.SPA
bootflash:
Trying to connect to tftp server......
Connection to server Established. Copying Started.....
/
TFTP get operation was successful
Copy complete, now saving to disk (please wait)...
switch(boot)#
copy tftp://192.168.1.2/recovery_images/fxos-k9-system.5.0.3.N2.4.11.69.SPA
bootflash:
Trying to connect to tftp server......
Connection to server Established. Copying Started.....
/
TFTP get operation was successful
Copy complete, now saving to disk (please wait)...
switch(boot)#
copy tftp://192.168.1.2/recovery_images/fxos-k9-manager.4.1.1.69.SPA
bootflash:
Trying to connect to tftp server......
Connection to server Established. Copying Started.....
/
TFTP get operation was successful
Copy complete, now saving to disk (please wait)...
switch(boot)#
copy bootflash:fxos-k9-manager.4.1.1.69.SPA
bootflash:nuova-sim-mgmt-nsg.0.1.0.001.bin
Copy complete, now saving to disk (please wait)...
switch(boot)#
Step 5
Reload the switch: switch(boot)#
reload
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
73
System Administration
Recovering from a Corrupted File System
Example:
switch(boot)#
reload
This command will reboot this supervisor module. (y/n) ?
y
[ 1866.310313] Restarting system.
!!
Rommon image verified successfully !!
Cisco System ROMMON, Version 1.0.11, RELEASE SOFTWARE
Copyright (c) 1994-2016 by Cisco Systems, Inc.
Compiled Wed 11/23/2016 11:23:23.47 by builder
Current image running: Boot ROM1
Last reset cause: ResetRequest
DIMM Slot 0 : Present
DIMM Slot 1 : Present
No USB drive !!
BIOS has been locked !!
Platform FPR9K-SUP with 16384 Mbytes of main memory
MAC Address: bb:aa:77:aa:aa:bb autoboot: Can not find autoboot file 'menu.lst.local'
Or can not find correct boot string !!
rommon 1 >
Step 6
Boot from the kickstart and system images: rommon 1 > boot <kickstart-image> <system-image>
Note
You will likely see license manager failure messages while the system image is loading. These messages can be safely ignored.
Example:
rommon 1 > dir
Directory of: bootflash:\
01/01/12 12:33a <DIR>
01/01/12 12:33a <DIR>
01/01/12 12:16a <DIR>
01/01/12 12:27a
4,096 .
4,096 ..
16,384 lost+found
34,333,696 fxos-k9-kickstart.5.0.3.N2.4.11.69.SPA
01/01/12 12:29a
01/01/12 12:31a
330,646,465 fxos-k9-manager.4.1.1.69.SPA
250,643,172 fxos-k9-system.5.0.3.N2.4.11.69.SPA
01/01/12 12:34a 330,646,465 nuova-sim-mgmt-nsg.0.1.0.001.bin
4 File(s) 946,269,798 bytes
3 Dir(s) rommon 2 > boot fxos-k9-kickstart.5.0.3.N2.4.11.69.SPA fxos-k9-system.5.0.3.N2.4.11.69.SPA
!!
Kickstart Image verified successfully !!
Linux version: 2.6.27.47 ([email protected]) #1 SMP Thu Nov 17 18:22:00 PST 2016
[ 0.000000] Fastboot Memory at 0c100000 of size 201326592
Usage: init 0123456SsQqAaBbCcUu
INIT: version 2.86 booting
POST INIT Starts at Sun Jan 1 00:27:32 UTC 2012
S10mount-ramfs.supnuovaca Mounting /isan 3000m
Mounted /isan
Creating /callhome..
Mounting /callhome..
Creating /callhome done.
Callhome spool file system init done.
Platform is BS or QP MIO: 30
FPGA Version 0x00010500 FPGA Min Version 0x00000600
Checking all filesystems..r.r..r done.
Warning: switch is starting up with default configuration
Checking NVRAM block device ... done
.
74
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
System Administration
Recovering from a Corrupted File System
FIPS power-on self-test passed
Unpack CMC Application software
Loading system software
Uncompressing system image: bootflash:/fxos-k9-system.5.0.3.N2.4.11.69.SPA
Manager image digital signature verification successful
...
System is coming up ... Please wait ...
nohup: appending output to `nohup.out'
---- Basic System Configuration Dialog ----
This setup utility will guide you through the basic configuration of the system. Only minimal configuration including IP connectivity to the Fabric interconnect and its clustering mode is performed through these steps.
Type Ctrl-C at any time to abort configuration and reboot system.
To back track or make modifications to already entered values, complete input till end of section and answer no when prompted to apply configuration.
You have chosen to setup a new Security Appliance. Continue? (y/n):
Step 7
After the images have loaded, the system will prompt you to enter initial configuration settings. For more information, see
Initial Configuration, on page 6
.
Step 8
Download the Platform Bundle image that you want to use on your FXOS chassis. The Platform Bundle image version should correspond with the images you used for recovering your system. For more information, see
.
Example:
FP9300-A# scope firmware
FP9300-A /firmware # show download-task
Download task:
File Name Protocol Server Port Userid State
--------- -------- --------------- ---------- --------------- ----fxos-k9.2.1.1.73.SPA
Downloaded Tftp 192.168.1.2
0
FP9300-A /firmware # show package fxos-k9.2.1.1.73.SPA detail
Firmware Package fxos-k9.2.1.1.73.SPA:
Version: 2.1(1.73)
Type: Platform Bundle
State: Active
Time Stamp: 2012-01-01T07:40:28.000
Build Date: 2017-02-28 13:51:08 UTC
FP9300-A /firmware #
Step 9
After the Platform Bundle has been successfully downloaded, you must manually activate the kickstart and system images so that they will be used when loading the system in the future. Automatic activation does not occur when using this procedure to recover from a corrupted file system because the running version matches the proposed startup version.
a) Set the scope for fabric-interconnect a:
FP9300-A#
scope fabric-interconnect a
b) Use the
show version
command to view the running kernel version and the running system version. You will use these strings to activate the images.
FP9300-A /fabric-interconnect #
show version
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
75
System Administration
Recovering from a Corrupted File System
c) Enter the following command to activate the images:
FP9300-A /fabric-interconnect #
activate firmware
kernel-version <running_kernel_version> system-version <running_system_version> commit-buffer
Note
The server status might change to "Disk Failed." You do not need to worry about this message and can continue with this procedure.
d) Use the
show version
command to verify that the startup versions have been set correctly and to monitor the activation status for the images.
Important
Do not proceed to the next step until the status changes from "Activating" to "Ready."
FP9300-A /fabric-interconnect #
show version
Example:
FP9300-A /firmware #
top
FP9300-A#
scope fabric-interconnect a
FP9300-A /fabric-interconnect #
show version
Fabric Interconnect A:
Running-Kern-Vers: 5.0(3)N2(4.11.69)
Running-Sys-Vers: 5.0(3)N2(4.11.69)
Package-Vers: 2.1(1.73)
Startup-Kern-Vers:
Startup-Sys-Vers:
Act-Kern-Status: Ready
Act-Sys-Status: Ready
Bootloader-Vers:
FP9300-A /fabric-interconnect #
activate firmware kernel-version
5.0(3)N2(4.11.69) system-version 5.0(3)N2(4.11.69)
Warning: When committed this command will reset the end-point
FP9300-A /fabric-interconnect* #
commit-buffer
FP9300-A /fabric-interconnect #
show version
Fabric Interconnect A:
Running-Kern-Vers: 5.0(3)N2(4.11.69)
Running-Sys-Vers: 5.0(3)N2(4.11.69)
Package-Vers: 2.1(1.73)
Startup-Kern-Vers: 5.0(3)N2(4.11.69)
Startup-Sys-Vers: 5.0(3)N2(4.11.69)
Act-Kern-Status: Activating
Act-Sys-Status: Activating
Bootloader-Vers:
FP9300-A /fabric-interconnect #
show version
Fabric Interconnect A:
Running-Kern-Vers: 5.0(3)N2(4.11.69)
Running-Sys-Vers: 5.0(3)N2(4.11.69)
Package-Vers: 2.1(1.73)
Startup-Kern-Vers: 5.0(3)N2(4.11.69)
Startup-Sys-Vers: 5.0(3)N2(4.11.69)
Act-Kern-Status: Ready
Act-Sys-Status: Ready
Bootloader-Vers:
Step 10
Reboot the system:
Example:
FP9300-A /fabric-interconnect #
top
FP9300-A#
scope chassis 1
FP9300-A /chassis #
reboot no-prompt
Starting chassis reboot. Monitor progress with the command "show fsm status"
FP9300-A /chassis #
76
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
System Administration
Recovering from a Corrupted File System
The system will power down each security module/engine before finally powering down and then restarting the FXOS chassis. This process takes approximately 5-10 minutes.
Step 11
Monitor the system status. The server status should go from "Discovery" to "Config" and then finally to "Ok".
Example:
FP9300-A#
show server status
Server Slot Status Overall Status Discovery
------- --------------------------------- --------------------- ---------
1/1
1/2
1/3
Equipped
Equipped
Empty
Discovery
Discovery
In Progress
In Progress
FP9300-A#
show server status
Server
1/2
1/3
Slot Status
Equipped
Empty
Overall Status Discovery
------- --------------------------------- --------------------- ---------
1/1 Equipped Config Complete
Config Complete
FP9300-A#
show server status
Server Slot Status Overall Status Discovery
------- --------------------------------- --------------------- ---------
1/1
1/2
1/3
Equipped
Equipped
Empty
Ok
Ok
Complete
Complete
When the Overall Status is "Ok" your system has been recovered. You must still reconfigure your security appliance (including license configuration) and re-create any logical devices. For more information:
• Firepower 9300 Quick Start Guides — http://www.cisco.com/go/firepower9300-quick
•
Firepower 9300 Configuration Guides
— http://www.cisco.com/go/firepower9300-config
•
Firepower 4100 Series Quick Start Guides
— http://www.cisco.com/go/firepower4100-quick
• Firepower 4100 Series Configuration Guides — http://www.cisco.com/go/firepower4100-config
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
77
Recovering from a Corrupted File System
System Administration
78
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
Modular chassis-based security system
Graphical user interface
FXOS CLI
FXOS REST API
Frequently asked questions
To log in, open a supported browser and enter the URL https://<chassis_mgmt_ip_address>, where <chassis_mgmt_ip_address> is the IP address or hostname of the FXOS chassis. Then, enter your username and password and click Login.
First, configure the FXOS chassis hardware. Then, complete the initial configuration, which includes setting the date and time, configuring a DNS server, registering your product license, configuring users, performing software updates, configuring platform settings, configuring interfaces, and creating logical devices.
The Overview page in the Firepower Chassis Manager provides a visual representation of the chassis, showing the installed components and their status. You can also view detailed status information about faults, interfaces, devices, licenses, and inventory.