C H A P T E R
11
Security Module/Engine Management
•
About FXOS Security Modules/Security Engine, page 153
•
Decommissioning/Recommissioning a Security Module, page 154
•
Acknowledging a Security Module/Engine, page 155
•
Resetting a Security Module/Engine, page 155
•
Reinitializing a Security Module/Engine, page 156
•
Powering On/Off a Security Module/Engine, page 156
About FXOS Security Modules/Security Engine
From the Security Modules/Security Engine page of the Firepower Chassis Manager, you can view the status of and can perform the following functions on a security module/engine:
• Decommission/Recommission (security modules only) — Decommissioning a security module places the security module into maintenance mode. You can also decommission and then recommission a security module in order to correct certain fault states. See
Decommissioning/Recommissioning a Security
Module, on page 154
.
• Acknowledge — Brings newly installed security modules online. See
Acknowledging a Security
Module/Engine, on page 155
.
•
Power Cycle
—
Restarts the security module/engine. See
Resetting a Security Module/Engine, on page
155 .
•
Reinitialize
—
Reformats the security module/engine hard disk, removing all deployed applications and configurations from the security module/engine, and then restarts the system. After reinitialization has completed, if a logical device is configured for the security module/engine, the Firepower eXtensible
Operating System will reinstall the application software, redeploy the logical device, and auto start the application. See
Reinitializing a Security Module/Engine, on page 156
.
Warning
All application data on the security module/engine is deleted during reinitialization.
Please back up all application data before reinitializing a security module/engine.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
153
Security Module/Engine Management
Decommissioning/Recommissioning a Security Module
• Power off/on — Toggles the power state for the security module/engine. See
Powering On/Off a Security
Module/Engine, on page 156
.
The Security Modules/Security Engine page provides the following information:
• Hardware State — Shows the state of the security module/engine hardware.
◦ Up — The security module/engine has powered up successfully and is not showing any hardware faults.
◦
Booting Up
—
The security module/engine is in the process of powering up.
◦
Down
—
The security module/engine is not powered on or a hardware fault is preventing the security module/engine from starting successfully.
◦ Unassociated — The security module/engine does not have a logical device associated with it.
◦ Mismatch — The security module has been decommissioned or a new security module was installed into the slot. Use the Recommission or Acknowledge function to return the security module to a functioning state.
• Service State — Shows the state of the software on the security module/engine:
◦ Not-available — The security module has been removed from the chassis slot. Reinstall the security module to return it to its normal operational state.
◦ Offline — The security module/engine is installed but has been decommissioned, has been powered off, or is still in the process of powering up.
◦
Online
—
The security module/engine is installed and is in normal operation mode.
◦
Not Responding
—
The security module/engine is unresponsive.
◦ Fault — The security module/engine is in a fault state. Review the system fault listing for more information about what might be causing the fault state.
◦
Token Mismatch
—
Indicates that a security module other than the one previously configured has been installed into the chassis slot. This could also be caused by a software installation error. Use the Reinitialize function to return the security module to a functioning state.
• Power — Shows the power status of the security module/engine:
◦ On — Use the Power off/on function to toggle the power status for the security module/engine.
◦
Off
—
Use the Power off/on function to toggle the power status for the security module/engine.
• Application — Shows the logical device type that is installed on the security module/engine.
Decommissioning/Recommissioning a Security Module
When you decommission a security module, the security module object is deleted from the configuration and the security module becomes unmanaged. Any logical devices or software running on the security module will become inactive.
You can decommission a security module if you want to temporarily discontinue use of the security module.
Also, if restarting a security module cannot correct an error condition, you can try decommissioning and then
154
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Security Module/Engine Management
Acknowledging a Security Module/Engine
recommissioning the security module to see if you can correct the error condition without having to reinitalize the security module.
Procedure
Step 1
Choose
Security Modules
to open the Security Modules page.
Step 2
To decommission a security module, click
Decommission
for that security module.
To recommission a security module, click
Recommission
for that security module.
Step 3
Click
Yes
to verify that you want to decommission or recommission the specified security module.
Acknowledging a Security Module/Engine
When a new security module is installed into the chassis, you must acknowledge the security module before you can begin using it.
If the security module is showing a status of "mismatch" or "token mismatch", this is an indication that the security module installed in the slot has data on it that does not match what was previously installed in the slot. If the security module has existing data on it and you are sure you want to use it in the new slot (in other words, the security module wasn't inadvertently installed into the wrong slot), you must reinitialize the security module before you can deploy a logical device to it.
Procedure
Step 1
Choose
Security Modules/Security Engine
to open the Security Modules/Security Engine page.
Step 2
Click
Acknowledge
for the security module/engine that you want to acknowledge.
Step 3
Click
Yes
to verify that you want to acknowledge the specified security module/engine.
Resetting a Security Module/Engine
Procedure
Step 1
Choose
Security Modules/Security Engine
to open the Security Modules/Security Engine page.
Step 2
Click
Power Cycle
for the security module/engine that you want to reset.
Step 3
Do one of the following:
• Click
Safe Power Cycle
to have the system wait for up to five minutes for the application running on the security module/engine to shut down before the system resets the specified security module/engine.
• Click
Power Cycle Immediately
to have the system reset the specified security module/engine immediately.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
155
Security Module/Engine Management
Reinitializing a Security Module/Engine
Reinitializing a Security Module/Engine
When a security module/engine is reinitialized, the security module/engine hard disk is formatted and all installed application instances and configurations are removed. After reinitialization has completed, if a logical device is configured for the security module/engine, the Firepower eXtensible Operating System will reinstall the application software, redeploy the logical device, and auto start the application.
Warning
All application data on the security module/engine is deleted during reinitialization. Please back up all application data before reinitializing a security module/engine.
Procedure
Step 1
Choose
Security Modules/Security Engine
to open the Security Modules/Security Engine page.
Step 2
Click
Reinitialize
for the security module/engine that you want to reinitialize.
Step 3
Click
Yes
to verify that you want to reinitialize the specified security module/engine.
The security module/engine is restarted and all data on the security module is deleted. This process can take several minutes.
Powering On/Off a Security Module/Engine
Procedure
Step 1
Choose
Security Modules/Security Engine
to open the Security Modules/Security Engine page.
Step 2
To power off a security module/engine: a) Click
Power off
for that security module/engine.
b) Do one of the following:
• Click
Safe Power Off
to have the system wait for up to five minutes for the application running on the security module/engine to shut down before the system powers down the specified security module/engine.
• Click
Power Off Immediately
to have the system power down the specified security module/engine immediately.
Step 3
To power on a security module/engine: a) Click
Power on
for that security module/engine.
b) Click
Yes
to verify that you want to power on the specified security module/engine.
156
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Security Module/Engine Management
Powering On/Off a Security Module/Engine
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
157
Powering On/Off a Security Module/Engine
Security Module/Engine Management
158
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
