Contents

Introduction

Prerequisites

Requirements

Components Used

Background Information

Chassis Information

Serial Number

FXOS Version

Bootloader Version

Check Up Time

Show Clock

Check Ntp-server

Monitoring Chassis Health

Check Environment

Show Fault

Power Supply Issues

Fan Issues

Show Event

Show System Reset-reason

Motherboard Power Issues

Logical Devices

Monitoring Instance

Show Server Status

Show Slot

Show Application Instance

Show Logical-device

Show App-instance

Show App-instance Detail

Show Resource Detail

Chassis Manager Access

Access to Local Web Server

Monitor Interfaces

Verify Chassis Management IP

Show Mgmt-port

Set Capture on Management Interface

Show Interface

Show Port-channel

Related Information

Introduction

This document describes the steps to help confirm the Cisco Secure Firewall eXtensible Operating (FXOS) basic state and configuration is correct.

Prerequisites

Requirements

Cisco recommended you have knowledge on:

- Cisco Secure Firewall eXtensible Operating (FXOS)

- Cisco Secure Firewall Threat Defense (FTD)

Components Used

The information in this document was created from the devices in a specific lab environment. All the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

- Cisco Secure Firewall eXtensible Operating 4110, version 2.10.(1.179)

- Cisco Secure Firewall Threat Defense, version 7.0.5

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

The Cisco Secure Firewall chassis is a next-generation platform for network and contact security solutions. A logical device lets you run an application instance, either ASA or Cisco Secure Firewall Threat Defense (FTD).

Depending on the logical device you add, application instance type and version are defined.

Chassis Information

This commands helps to get an overall information of your chassis (whether or not everything is operable) which information collect to TAC in order to troubleshoot the chassis error.

Serial Number

The serial number is used as an identifier of the chassis. It is needed in case of an RMA of the entire chassis

FPR4110-04-A# scope chassis 1

FPR4110-04-A /chassis # show inventory

Chassis     PID          Vendor            Serial (SN)  HW Revision

-------    -----------   ----------------- -----------  -----------

1          FPR-4110-K9   Cisco Systems Inc JMX2136L03W  0

FXOS Version

FPR4110-04-A# show version

Version: 2.10(1.179)

Startup-Vers: 2.10(1.179)

There are two ways to know the FXOS Version, this one includes the firmware.

FPR4110-04-A# show fabric-interconnect firmware

Fabric Interconnect A:

Running-Kern-Vers: 5.0(3)N2(4.101.103)

Running-Sys-Vers: 5.0(3)N2(4.101.103)

Package-Vers: 2.10(1.179)

Startup-Kern-Vers: 5.0(3)N2(4.101.103)

Startup-Sys-Vers: 5.0(3)N2(4.101.103)

Act-Kern-Status: Ready

Act-Sys-Status: Ready

Bootloader-Vers:

Bootloader Version

FPR4110-04-A# scope chassis 1

FPR4110-04-A /chassis # scope server 1

FPR4110-04-A /chassis/server # scope adapter 1

FPR4110-04-A /chassis/server/adapter # show version detail

Adapter 1:

Running-Vers: 5.10(1.53)

Package-Vers: 2.10(1.179)

Update-Status: Ready

Activate-Status: Ready

Bootloader-Update-Status: Ready

Startup-Vers: 5.10(1.53)

Backup-Vers: 5.10(1.57)

Bootloader-Vers: 4.0(1.62)

Check Up Time

FPR4110-04-A# connect fxos

FPR4110-04-A(fxos)# show system uptime

System start time: Mon Oct 23 16:45:36 2023

System uptime: 98 days, 1 hours, 49 minutes, 36 seconds

Kernel uptime: 98 days, 1 hours, 40 minutes, 19 seconds

Active supervisor uptime: 98 days, 1 hours, 49 minutes, 36 second

Show Clock

FPR4110-04-A# show clock

Tue Jan 30 17:07:50 EST 2024

Check Ntp-server

FPR4110-04-A# scope system

FPR4110-04-A /system # scope services

FPR4110-04-A /system/services # show ntp-server

NTP server hostname:

Name Time         Sync Status

--------------    ----------------

172.16.254.131    Time Synchronized

Monitoring Chassis Health

These are some commands to help troubleshoot the status of the chassis hardware.

Check Environment

FPR4110-04-A# scope chassis 1

FPR4110-04-A /chassis # show environment expand detail

Chassis 1:

Overall Status: Power Problem

Operability: Operable

Power State: Redundancy Failed

Thermal Status: Ok

PSU 1:

Threshold Status: N/A

Overall Status: N/A

Operability: N/A

Power State: Off

Thermal Status: OK

Voltage Status: N/A

PSU 2:

Threshold Status: OK

Overall Status: Operable

Operability: Operable

Power State: On

Thermal Status: OK

Voltage Status: OK

Tray 1 Module 1:

Threshold Status: OK

Overall Status: Operable

Operability: Operable

Power State: On

Thermal Status: OK

Voltage Status: OK

Fan Module Stats:

Ambient Temp (C): 27.000000

Fan 1:

Threshold Status: OK

Overall Status: Operable

Operability: Operable

Power State: On

Thermal Status: OK

Voltage Status: OK

Fan 2:

Threshold Status: OK

Overall Status: Operable

Operability: Operable

Power State: On

Thermal Status: OK

Voltage Status: OK

...

Server 1:

Name:

User Label:

Overall Status: Ok

Operability: Operable

Oper Power: On

Adapter 1:

Threshold Status: N/A

Overall Status: Operable

Operability: Operable

Power State: On

Thermal Status: N/A

Voltage Status: N/A

Motherboard:

Threshold Status: OK

Overall Status: N/A

Operability: N/A

Oper Power: On

Power State: Ok

Thermal Status: OK

Voltage Status: OK

CMOS Battery Voltage Status: Ok

Mother Board Power Usage Status: Ok

Motherboard Temperature Statistics:

Motherboard Front Temperature (C): 19.000000

Motherboard Rear Temperature (C): 26.000000

Memory Array 1:

Threshold Status: N/A

Overall Status: N/A

Operability: N/A

Power State: N/A

Thermal Status: N/A

Voltage Status: N/A

DIMMs:

DIMM Threshold Status Overall Status  Operability Power State Thermal Status  Voltage Status

---- ---------------- --------------- ----------- ----------- --------------- --------------

1    N/A              Operable        N/A         N/A         OK              N/A

2    N/A              Removed         N/A         N/A         N/A             N/A

3    N/A              Removed         N/A         N/A         N/A             N/A

4    N/A              Operable        N/A         N/A         OK              N/A

5    N/A              Removed         N/A         N/A         N/A             N/A

...

CPU 1:

Threshold Status: N/A

Overall Status: Operable

Operability: Operable

Power State: N/A

Thermal Status: OK

Voltage Status: N/A

Show Fault

The fault list shows any hardware problems identified on the Secure Firewall platforms, it helps to get a summary of the active faults as well as the already cleared.

The faults are shown in chronological order. The Severity reflects the importance of the fault, while the description provides a brief overview. The focus is mainly on the severity, the timestamp, and the description. The fault severity order from most severe to least severe is:

- Critical

- Major

- Minor

- Warning

- Info/Condition

- Cleared

FPR4110-04-A# show fault

Severity  Code   Last Transition Time     ID      Description

--------- -----  -----------------------  ------  -----------

Major     F0276  2023-12-14T18:26:29.505  507308  ether port 2/2 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected

Major     F0276  2023-11-13T14:07:37.720  221350  ether port 1/1 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected

Info      F0279  2023-11-13T14:07:37.720  446504  ether port 1/7 on fabric interconnect A oper state: sfp-not-present

Major     F0276  2023-11-07T08:10:50.143  434090  ether port 1/6 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected

Major     F0276  2023-11-07T08:10:49.941  434081  ether port 1/5 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected

Major     F0282  2023-07-31T17:52:04.764  201600  lan port-channel 7 on fabric interconnect A oper state: failed, reason: No operational members

Major     F0282  2023-07-31T17:51:03.325  201446  lan port-channel 4 on fabric interconnect A oper state: failed, reason: No operational members

Major     F0282  2023-07-31T17:49:00.451  201281  lan port-channel 2 on fabric interconnect A oper state: failed, reason: No operational members

Major     F0282  2023-07-31T17:42:34.236  200638  lan port-channel 1 on fabric interconnect A oper state: failed, reason: No operational members

Major     F0909  2023-06-19T14:02:55.642  99113   default Keyring's certificate is invalid, reason: expired.

Warning   F1781  2012-01-11T02:21:44.215  90296   The password encryption key has not been set.

Info      F0461  2011-12-31T21:32:43.448  35793   Log capacity on Management Controller on server 1/1 is very-low

Major     F0408  2011-12-31T21:32:32.787  35497   Power state on chassis 1 is redundancy-failed

Warning   F0528  2011-12-31T21:32:32.787  35498   Power supply 1 in chassis 1 power: off

Minor     F1437  2011-12-31T21:31:08.462  32663   Config backup may be outdated

FPR4110-04-A#

The faults can be filter based on cause, detail, severity or suppressed faults.

FPR4110-04-A# show fault ?

0-18446744073709551615 ID

<CR>

> Redirect it to a file

>> Redirect it to a file in append mode

cause      Cause

detail     Detail

severity   Severity

suppressed Fault Suppressed

| Pipe command output to filter

FPR4110-04-A# show fault severity major

Severity  Code   Last Transition Time     ID     Description

--------- -----  -----------------------  ------ -----------

Major     F0276  2023-12-14T18:26:29.505  507308 ether port 2/2 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected

Major     F0276  2023-11-13T14:07:37.720  221350 ether port 1/1 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected

Major     F0276  2023-11-07T08:10:50.143  434090 ether port 1/6 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected

Major     F0276  2023-11-07T08:10:49.941  434081 ether port 1/5 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected

Major     F0282  2023-07-31T17:52:04.764  201600 lan port-channel 7 on fabric interconnect A oper state: failed, reason: No operational members

Major     F0282  2023-07-31T17:51:03.325  201446 lan port-channel 4 on fabric interconnect A oper state: failed, reason: No operational members

Major     F0282  2023-07-31T17:49:00.451  201281 lan port-channel 2 on fabric interconnect A oper state: failed, reason: No operational members

Major     F0282  2023-07-31T17:42:34.236  200638 lan port-channel 1 on fabric interconnect A oper state: failed, reason: No operational members

Major     F0282  2023-07-31T17:41:34.673  200660 lan port-channel 3 on fabric interconnect A oper state: failed, reason: No operational members

Major     F0408  2011-12-31T21:32:32.787  35497  Power state on chassis 1 is redundancy-faile

Power Supply Issues

For power supply issues, a status of Voltage Problem is the indicator of a problem.

FPR4110-04-A# scope chassis 1

FPR4110-04-A /chassis # show psu

PSU:

PSU Type Wattage (W) Overall Status

--- ---- ----------- --------------

1 DV   0           N/A

2 DV   1100        Operable

Fan Issues

If there are thermal faults, most likely they are either a legitimate hardware problem with cooling/fans or a false positive due to a software defect. If the fan status is Inoperable or degraded, contact TAC for further assistance.

FPR4110-04-A# scope chassis 1

FPR4110-04-A /chassis # show fan-module

Fan Module:

Tray Module  Overall   Status

-----------  --------- --------------

1            1         Operable

1            2         Operable

1            3         Operable

1            4         Operable

1            5         Operable

1            6         Operable

Show Event

It is important to check FXOS for application faults to see if the issue lies in the blade itself or if the application is unable to boot for a software-related problem.

FPR4110-04-A# scope chassis

FPR4110-04-A /chassis # scope server

FPR4110-04-A /chassis/server # scope fxos

FPR4110-04-A /chassis/server/fxos # show event

Creation                 Time ID Code     Description

-----------------------  ------- -------- -----------

2024-01-25T14:09:32.783  588408  E4197910 [FSM:STAGE:END]: Waiting for install license complete from blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:HostWaitForLicInstalledComplete)

2024-01-25T14:09:32.783  588409  E4197611 [FSM:STAGE:SKIP]: Reboot blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RebootHostAfterUpgrade)

2024-01-25T14:09:32.783  588410  E4197611 [FSM:STAGE:END]: Reboot blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RebootHostAfterUpgrade)

2024-01-25T14:09:32.783  588411  E4197612 [FSM:END]: Init OS on blade 1/1(FSM:sam:dme:OsControllerInitOS)

2024-01-25T14:09:32.783  588412  E4197612 [FSM:STAGE:END]: (FSM-STAGE:sam:dme:OsControllerInitOS:success)

2024-01-25T14:09:32.782  588405  E4197909 [FSM:STAGE:STALE-SUCCESS]: Request for upgrade to blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RequestToInstallLicense)

2024-01-25T14:09:32.782  588406  E4197909 [FSM:STAGE:END]: Request for upgrade to blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RequestToInstallLicense)

2024-01-25T14:09:32.782  588407  E4197910 [FSM:STAGE:SKIP]: Waiting for install license complete from blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:HostWaitForLicInstalledComplete)

2024-01-25T14:09:32.773  588404  E4197909 [FSM:STAGE:ASYNC]: Request for upgrade to blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RequestToInstallLicense)

2024-01-25T14:09:32.768  588401  E4197609 [FSM:STAGE:END]: Request for upgrade to blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RequestToUpgrade)

2024-01-25T14:09:32.768  588402  E4197610 [FSM:STAGE:SKIP]: Waiting for upgrade complete from blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:HostWaitForUpgradeComplete)

2024-01-25T14:09:32.768  588403  E4197610 [FSM:STAGE:END]: Waiting for upgrade complete from blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:HostWaitForUpgradeComplete)

FPR4110-04-A /chassis/server/fxos #

Show System Reset-reason

For unexpected application/device reloads, verify that no cores exist for any processes (FTD) and check for ASA/Lina crashinfo using the show crash command. If those do not exist then the problem is likely FXOS-related and can be routed using the FXOS keyword.

FPR4110-04-A# connect fxos

FPR4110-04-A(fxos)# show system reset-reason

----- reset reason for Supervisor-module 1 (from Supervisor in slot 1) ---

1) No time

Reason: Unknown

Service:

Version: 5.0(3)N2(4.101)

2) No time

Reason: Unknown

Service:

Version: 5.0(3)N2(4.101)

...

Motherboard Power Issues

FPR4110-04-A# scope chassis 1

FPR4110-04-A /chassis # scope server 1/1

FPR4110-04-A /chassis/server # show fsm status

Slot: 1

Server: sys/chassis-1/blade-1

FSM 1:

Remote Result: Not Applicable

Remote Error Code: None

Remote Error Description:

Status: Nop

Previous Status: Turnup Success

Timestamp: 2023-10-23T16:48:19.299

Try: 0

Flags: 0

Progress (%): 100

Current Task:

FSM 2:

Status: Nop

Previous Status: Identify Success

Timestamp: 2023-10-23T16:47:33.592

Try: 0

Progress (%): 100

Current Task:

FSM 3:

Status: Nop

Previous Status: Configure Success

Timestamp: 2023-10-23T16:48:16.739

Try: 0

Flags: 0

Progress (%): 100

Current Task:

FPR4110-04-A /chassis/server # show fault

Severity  Code    Last Transition Time     ID       Description

--------- ------- ------------------------ -------- -----------

Info      F0461   2011-12-31T21:32:43.448  35793    Log capacity on Management Controller on server 1/1 is very-low

Logical Devices

As stated in the background information, a logical device lets you run an application instance, either ASA or FTD.

These are some command to confirm the status of the application instance installed in the chassis.

Monitoring Instance

Show Server Status

View if the slot and the discovery status.

FPR4110-04-A# show server status

Server   Slot Status  Overall  Status Discovery

-------  ------------ -------  ---------

1/1      Equipped     Ok       Complete

Show Slot

View the Log level, the admin state and the operable state of the slot.

FPR4110-04-A# scope ssa

FPR4110-04-A /ssa # show slot

Slot:

Slot ID Log Level Admin State  Oper State

------- --------- ------------ ----------

1       Info      Ok           Online

Show Application Instance

View the name, version, author, which deploy types are supported, the CSP type and if it is the default application used.

FPR4110-04-A# scope ssa

FPR4110-04-A /ssa # show app

Name Version  Author Supported Deploy Types CSP Type     Is Default App

---- -------- ------ ---------------------- -----------  --------------

ftd  7.0.4-55 cisco  Native,Container       Application  No

ftd  7.0.5-72 cisco  Native,Container       Application  Yes

Show Logical-device

FPR4110-04-A# scope ssa

FPR4110-04-A /ssa # show logical-device

Logical Device:

Name Description Slot ID Mode       Oper State Template Name

---- ----------- ------- ---------- ---------- -------------

FTD1             1       Standalone Ok         ftd

Show App-instance

View the full information of the operating state of the app instance use show app-instance under the slot scope.

This command helps particularly when you create or upgrade the application instance, as it shows in the operative state if it is Installing or Online and the running software version.

FPR4110-04-A# scope ssa

FPR4110-04-A /ssa # scope slot 1

FPR4110-04-A /ssa/slot # show app-instance

Application Instance:

App Name Identifier Admin State Oper State Running Version Startup Version Deploy Type Turbo Mode Profile Name Cluster State  Cluster Role

-------- ---------- ----------- ---------- --------------- --------------- ----------- ---------- ------------ -------------- ------------

ftd      FTD1       Enabled     Online     7.0.5-72        7.0.5-72        Native      No                      Not Applicable None

Show App-instance Detail

FPR4110-04-A# scope ssa

FPR4110-04-A /ssa # show app-instance detail

App Name: ftd

Identifier: FTD1

Slot ID: 1

Admin State: Enabled

Oper State: Online

Running Version: 7.0.5-72

Startup Version: 7.0.5-72

Deploy Type: Native

Profile Name:

Cluster State: Not Applicable

Cluster Role: None

Current Job Type: Start

Current Job Progress: 100

Current Job State: Succeeded

Clear Log Data: Available

Error Msg:

Hotfixes:

Externally Upgraded: No

FPR4110-04-A /ssa #

Show Resource Detail

View resource allocation for the application instance.

FPR4110-04-A# scope ssa

FPR4110-04-A /ssa # scope slot 1

FPR4110-04-A /ssa/slot # enter app-instance ftd FTD1

FPR4110-04-A /ssa/slot/app-instance # show resource detail

Resource:

Allocated Core NR: 22

Allocated RAM (MB): 52096

Allocated Data Disk (MB): 128685

Allocated Binary Disk (MB): 3907

Allocated Secondary Disk (MB): 0

Chassis Manager Access

Access to Local Web Server

By default, the Secure Firewall Threat Defense 4100/9300 chassis denies all access to the local web server. You must configure your IP Access List with a list of allowed services for each of your IP blocks.

The IP Access List supports protocols:

- HTTPS

- SNMP

- SSH

FPR4110-04-A# scope system

FPR4110-04-A /system # scope services

FPR4110-04-A /system/services # show ip-block

Permitted IP Block:

IP Address Prefix Length Protocol

---------- ------------- --------

0.0.0.0                0 https

0.0.0.0                0 snmp

The command enter is for configuring a new entry.

FPR4110-04-A /system/services # enter ?

dns        Domain Name Server hostname

ip-block   Permitted IP Block

ipv6-block Permitted IPv6 Block

ntp-server NTP server hostname

ssh-host   SSH Server public keys

FPR4110-04-A /system/services # enter ip-block ?

a.b.c.d IP Address

FPR4110-04-A /system/services # enter ip-block 0.0.0.0 ?

0-32 Prefix Length

FPR4110-04-A /system/services # enter ip-block 0.0.0.0 0 ?

https Https

snmp  Snmp

ssh   Ssh

FPR4110-04-A /system/services/ # enter ip-block 0.0.0.0 0 ssh

FPR4110-04-A /system/services/ip-block* # commit-buffer

FPR4110-04-A /system/services/ip-block # up

FPR4110-04-A /system/services # show ip-block

Permitted IP Block:

IP Address Prefix Length Protocol

---------- ------------- --------

0.0.0.0                0 https

0.0.0.0                0 snmp

0.0.0.0                0 ssh

Monitor Interfaces

Verify Chassis Management IP

FPR4110-04-A# show fabric-interconnect

Fabric Interconnect:

ID  OOB IP Addr   OOB Gateway  OOB Netmask     OOB IPv6 Address OOB IPv6 Gateway Prefix Operability Ingress VLAN Group Entry Count (Current/Max) Switch Forwarding Path Entry Count (Current/Max)

--- ------------  ------------ --------------- ---------------- ---------------- ------ ----------- -------------------------------------------- ------------------------------------------------

A   172.16.244.72  172.16.244.65 255.255.255.192 ::               ::               64     Operable    0/500                                        53/102

Show Mgmt-port

Determine the status of the management interface.

FPR4110-04-A# connect local-mgmt

FPR4110-04-A(local-mgmt)#

FPR4110-04-A(local-mgmt)# show mgmt-port

eth0 Link encap:Ethernet HWaddr 50:0f:80:8e:a5:cd

inet addr:172.16.244.72 Bcast:172.16.244.127 Mask:255.255.255.192

inet6 addr: fe80::520f:80ff:fe8e:a5cd/64 Scope:Link

inet6 addr: fe80::520f:80ff:fe8e:a5cd/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:7359566 errors:0 dropped:0 overruns:0 frame:0

TX packets:1147585 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:1735874306 (1.6 GiB) TX bytes:360530127 (343.8 MiB)

Ping can be use to test connectivity.

FPR4110-04-A(local-mgmt)# ping 172.16.244.65

PING 172.16.244.65 (172.16.244.65) from 172.16.244.72 eth0: 56(84) bytes of data.

64 bytes from 172.16.244.65: icmp_seq=1 ttl=254 time=1.15 ms

64 bytes from 172.16.244.65: icmp_seq=2 ttl=254 time=1.38 ms

^C

--- 172.16.244.65 ping statistics ---

6 packets transmitted, 6 received, 0% packet loss, time 12ms

rtt min/avg/max/mdev = 1.146/1.364/1.479/0.122 ms

FPR4110-04-A(local-mgmt)#

Set Capture on Management Interface

Enable capture on chassis (MIO) mgmt interface (this is only applicable on FP41xx/FP93xx). By default it only captures 10- packets.

FPR4110-04-A# connect fxos

FPR4110-04-A(fxos)# ethanalyzer local interface mgmt

Capturing on 'eth0'

1 2024-01-30 16:15:56.149887591 fe80::6a9e:bff:fed5:678c → ff02::2 ICMPv6 70 Router Solicitation from 68:9e:0b:d5:67:8c

2 2024-01-30 16:15:56.635897727 80:b7:09:32:f2:a0 → ff:ff:ff:ff:ff:ff ARP 60 Who has 172.16.244.65? Tell 172.16.244.106

3 2024-01-30 16:15:56.650081622 c4:72:95:76:df:97 → 01:80:c2:00:00:00 STP 60 RST. Root = 0/12/2c:31:24:b1:6b:00 Cost = 4 Port = 0x8017

4 2024-01-30 16:15:57.170356692 172.16.244.72 → 172.16.254.131 NTP 90 NTP Version 3, client

5 2024-01-30 16:15:57.234298977 172.16.254.131 → 172.16.244.72 NTP 90 NTP Version 3, server

6 2024-01-30 16:15:58.656444769 c4:72:95:76:df:97 → 01:80:c2:00:00:00 STP 60 RST. Root = 0/12/2c:31:24:b1:6b:00 Cost = 4 Port = 0x8017

7 2024-01-30 16:15:59.170382028 172.16.244.72 → 172.16.254.131 NTP 90 NTP Version 3, client

8 2024-01-30 16:15:59.233556065 172.16.254.131 → 172.16.244.72 NTP 90 NTP Version 3, server

9 2024-01-30 16:15:59.352654266 0.0.0.0 → 255.255.255.255 DHCP 368 DHCP Discover - Transaction ID 0x328ec1b7

10 2024-01-30 16:16:00.150684560 fe80::6a9e:bff:fed5:678c → ff02::2 ICMPv6 70 Router Solicitation from 68:9e:0b:d5:67:8c

10 packets captured

Program exited with status 0

Ethanalyzer can be used as well in the inbout interface. Options are high priority or low priority logs.

FPR4110-04-A(fxos)# ethanalyzer local interface ?

inbound-hi  Inbound(high priority) interface

inbound-low Inbound(low priority) interface

mgmt        Management interface

A filter can be used on the capture.

FPR4110-04-A(fxos)# ethanalyzer local interface ?

inbound-hi  Inbound(high priority) interface

inbound-low Inbound(low priority) interface

mgmt        Management interface

Show Interface

This command shows the list and current state of the interface in the chassis as a brief description of the reason of each operable state.

Note: Interfaces that act as ports in port channels do not appear in this list.

FPR4110-04-A# scope eth-uplink

FPR4110-04-A /eth-uplink # scope fabric a

FPR4110-04-A /eth-uplink/fabric # show interface

Interface:

Port Name   Port Type Admin State Oper State        Allowed Vlan State Reason

----------- --------- ----------- ----------        ------------ ------------

Ethernet1/1 Data      Enabled     Link Down         All          Link failure or not-connected

Ethernet1/2 Data      Disabled    Admin Down        All          Administratively down

Ethernet1/3 Data      Enabled     Up                All          Port is enabled and up

Ethernet1/4 Data      Enabled     Up                All          Port is enabled and up

Ethernet1/5 Data      Enabled     Link Down         All          Link failure or not-connected

Ethernet1/6 Data      Enabled     Link Down         All          Link failure or not-connected

Ethernet1/7 Data      Enabled     Sfp Not Present   All          Unknown

Ethernet1/8 Mgmt      Enabled     Up                All          Port is enabled and up

Ethernet2/2 Data      Enabled     Link Down         All          Link failure or not-connected

Ethernet2/5 Data      Disabled    Sfp Not Present   All          Unknown

Ethernet2/6 Data      Disabled    Sfp Not Present   All          Unknown

Ethernet2/7 Data      Disabled    Sfp Not Present   All          Unknown

Ethernet2/8 Data      Disabled    Sfp Not Present   All          Unknow

As mentioned before, the faults indicate any hardware problems identified on the Secure Firewall platforms. You can check the faults in different scopes to narrow down the issues in each scope. This example shows the faults in the eth-uplink.

FPR4110-04-A# scope eth-uplink

FPR4110-04-A /eth-uplink # show fault

Severity  Code   Last Transition Time     ID      Description

--------- ------ ------------------------ ------- -----------

Major     F0727  2024-01-29T20:31:54.282  597025  lan Member 2/3 of Port-Channel 1 on fabric interconnect A is down, membership: down

Major     F0727  2024-01-29T20:31:54.282  597023  lan Member 2/4 of Port-Channel 1 on fabric interconnect A is down, membership: down

Major     F0282  2023-07-31T17:52:04.764  201600  lan port-channel 7 on fabric interconnect A oper state: failed, reason: No operational members

Major     F0282  2023-07-31T17:51:03.325  201446  lan port-channel 4 on fabric interconnect A oper state: failed, reason: No operational members

Major     F0282  2023-07-31T17:49:00.451  201281  lan port-channel 2 on fabric interconnect A oper state: failed, reason: No operational members

Major     F0282  2023-07-31T17:42:34.236  200638  lan port-channel 1 on fabric interconnect A oper state: failed, reason: No operational members

Major     F0282  2023-07-31T17:41:34.673  200660  lan port-channel 3 on fabric interconnect A oper state: failed, reason: No operational member

Show Port-channel

This shows the number of port-channels configured in the chassis, as well as their general status.

You can move to an specific port-channel scope to get the members information.

If you see the port-channel as Failed, contact TAC for further assistance, as this is an example of a faulty port-channel.

FPR4110-04-A# scope eth-uplink

FPR4110-04-A /eth-uplink # scope fabric a

FPR4110-04-A /eth-uplink/fabric # show port-channel

Port Channel:

Port Channel Id Name           Port Type  Admin State Oper State Port Channel Mode Allowed Vlan State Reason

--------------- -------------- ---------  ----------- ---------- ----------------- ------------ ------------

1               Port-channel1  Data       Enabled     Failed     Active            All          No operational members

2               Port-channel2  Data       Enabled     Failed     Active            All          No operational members

3               Port-channel3  Data       Enabled     Failed     Active            All          No operational members

4               Port-channel4  Data       Enabled     Failed     Active            All          No operational members

7               Port-channel7  Data       Enabled     Failed     Active            All          No operational members

FPR4110-04-A /eth-uplink/fabric # scope port-channel 1

FPR4110-04-A /eth-uplink/fabric/port-channel # show member

Member Port:

Port Name   Membership Oper State State Reason

----------- ---------- ---------------- ------------

Ethernet2/3 Down       Sfp Not Present  Unknown

Ethernet2/4 Down       Sfp Not Present  Unknown

Use command show port-channel summary to view all the port-channel on device as well as their members

FPR4110-04-A# connect fxos

FPR4110-04-A(fxos)# show port-channel summary

Flags:

D - Down

P - Up in port-channel (members)

I - Individual H - Hot-standby (LACP only)

s - Suspended r - Module-removed

S - Switched R - Routed

U - Up (port-channel)

M - Not in use. Min-links not met

--------------------------------------------------------------------------------

Group Port-Channel Type  Protocol    Member Ports

--------------------------------------------------------------------------------

1     Po1(SD)      Eth   LACP        Eth2/3(D) Eth2/4(D)

2     Po2(SD)      Eth   NONE        --

3     Po3(SD)      Eth   NONE        --

4     Po4(SD)      Eth   NONE        --

7     Po7(SD)      Eth   NONE        --

Related Information

- Generate FXOS Troubleshoot File

- Answer Firepower eXtensible Operating System (FXOS) FAQ

- Configure and Troubleshoot NTP Settings on Firepower Appliances

- Configure and Verify Port-Channel on Firepower Appliances