Troubleshoot Basic Configuration in FXOS
Available Languages
Contents
Introduction
This document describes the steps to help confirm the Cisco Secure Firewall eXtensible Operating (FXOS) basic state and configuration is correct.
Prerequisites
Requirements
Cisco recommended you have knowledge on:
- Cisco Secure Firewall eXtensible Operating (FXOS)
- Cisco Secure Firewall Threat Defense (FTD)
Components Used
The information in this document was created from the devices in a specific lab environment. All the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
- Cisco Secure Firewall eXtensible Operating 4110, version 2.10.(1.179)
- Cisco Secure Firewall Threat Defense, version 7.0.5
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Background Information
The Cisco Secure Firewall chassis is a next-generation platform for network and contact security solutions. A logical device lets you run an application instance, either ASA or Cisco Secure Firewall Threat Defense (FTD).
Depending on the logical device you add, application instance type and version are defined.
Chassis Information
This commands helps to get an overall information of your chassis (whether or not everything is operable) which information collect to TAC in order to troubleshoot the chassis error.
Serial Number
The serial number is used as an identifier of the chassis. It is needed in case of an RMA of the entire chassis
FPR4110-04-A# scope chassis 1
FPR4110-04-A /chassis # show inventory
Chassis PID Vendor Serial (SN) HW Revision
------- ----------- ----------------- ----------- -----------
1 FPR-4110-K9 Cisco Systems Inc JMX2136L03W 0
FXOS Version
FPR4110-04-A# show version
Version: 2.10(1.179)
Startup-Vers: 2.10(1.179)There are two ways to know the FXOS Version, this one includes the firmware.
FPR4110-04-A# show fabric-interconnect firmware
Fabric Interconnect A:
Running-Kern-Vers: 5.0(3)N2(4.101.103)
Running-Sys-Vers: 5.0(3)N2(4.101.103)
Package-Vers: 2.10(1.179)
Startup-Kern-Vers: 5.0(3)N2(4.101.103)
Startup-Sys-Vers: 5.0(3)N2(4.101.103)
Act-Kern-Status: Ready
Act-Sys-Status: Ready
Bootloader-Vers:Bootloader Version
FPR4110-04-A# scope chassis 1
FPR4110-04-A /chassis # scope server 1
FPR4110-04-A /chassis/server # scope adapter 1
FPR4110-04-A /chassis/server/adapter # show version detail
Adapter 1:
Running-Vers: 5.10(1.53)
Package-Vers: 2.10(1.179)
Update-Status: Ready
Activate-Status: Ready
Bootloader-Update-Status: Ready
Startup-Vers: 5.10(1.53)
Backup-Vers: 5.10(1.57)
Bootloader-Vers: 4.0(1.62)
Check Up Time
FPR4110-04-A# connect fxos
FPR4110-04-A(fxos)# show system uptime
System start time: Mon Oct 23 16:45:36 2023
System uptime: 98 days, 1 hours, 49 minutes, 36 seconds
Kernel uptime: 98 days, 1 hours, 40 minutes, 19 seconds
Active supervisor uptime: 98 days, 1 hours, 49 minutes, 36 second
Show Clock
FPR4110-04-A# show clock
Tue Jan 30 17:07:50 EST 2024 Check Ntp-server
FPR4110-04-A# scope system
FPR4110-04-A /system # scope services
FPR4110-04-A /system/services # show ntp-server
NTP server hostname:
Name Time Sync Status
-------------- ----------------
172.16.254.131 Time Synchronized
Monitoring Chassis Health
These are some commands to help troubleshoot the status of the chassis hardware.
Check Environment
FPR4110-04-A# scope chassis 1
FPR4110-04-A /chassis # show environment expand detail
Chassis 1:
Overall Status: Power Problem
Operability: Operable
Power State: Redundancy Failed
Thermal Status: Ok
PSU 1:
Threshold Status: N/A
Overall Status: N/A
Operability: N/A
Power State: Off
Thermal Status: OK
Voltage Status: N/A
PSU 2:
Threshold Status: OK
Overall Status: Operable
Operability: Operable
Power State: On
Thermal Status: OK
Voltage Status: OK
Tray 1 Module 1:
Threshold Status: OK
Overall Status: Operable
Operability: Operable
Power State: On
Thermal Status: OK
Voltage Status: OK
Fan Module Stats:
Ambient Temp (C): 27.000000
Fan 1:
Threshold Status: OK
Overall Status: Operable
Operability: Operable
Power State: On
Thermal Status: OK
Voltage Status: OK
Fan 2:
Threshold Status: OK
Overall Status: Operable
Operability: Operable
Power State: On
Thermal Status: OK
Voltage Status: OK
...
Server 1:
Name:
User Label:
Overall Status: Ok
Operability: Operable
Oper Power: On
Adapter 1:
Threshold Status: N/A
Overall Status: Operable
Operability: Operable
Power State: On
Thermal Status: N/A
Voltage Status: N/A
Motherboard:
Threshold Status: OK
Overall Status: N/A
Operability: N/A
Oper Power: On
Power State: Ok
Thermal Status: OK
Voltage Status: OK
CMOS Battery Voltage Status: Ok
Mother Board Power Usage Status: Ok
Motherboard Temperature Statistics:
Motherboard Front Temperature (C): 19.000000
Motherboard Rear Temperature (C): 26.000000
Memory Array 1:
Threshold Status: N/A
Overall Status: N/A
Operability: N/A
Power State: N/A
Thermal Status: N/A
Voltage Status: N/A
DIMMs:
DIMM Threshold Status Overall Status Operability Power State Thermal Status Voltage Status
---- ---------------- --------------- ----------- ----------- --------------- --------------
1 N/A Operable N/A N/A OK N/A
2 N/A Removed N/A N/A N/A N/A
3 N/A Removed N/A N/A N/A N/A
4 N/A Operable N/A N/A OK N/A
5 N/A Removed N/A N/A N/A N/A
...
CPU 1:
Threshold Status: N/A
Overall Status: Operable
Operability: Operable
Power State: N/A
Thermal Status: OK
Voltage Status: N/A
Show Fault
The fault list shows any hardware problems identified on the Secure Firewall platforms, it helps to get a summary of the active faults as well as the already cleared.
The faults are shown in chronological order. The Severity reflects the importance of the fault, while the description provides a brief overview. The focus is mainly on the severity, the timestamp, and the description. The fault severity order from most severe to least severe is:
- Critical
- Major
- Minor
- Warning
- Info/Condition
- Cleared
FPR4110-04-A# show fault
Severity Code Last Transition Time ID Description
--------- ----- ----------------------- ------ -----------
Major F0276 2023-12-14T18:26:29.505 507308 ether port 2/2 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Major F0276 2023-11-13T14:07:37.720 221350 ether port 1/1 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Info F0279 2023-11-13T14:07:37.720 446504 ether port 1/7 on fabric interconnect A oper state: sfp-not-present
Major F0276 2023-11-07T08:10:50.143 434090 ether port 1/6 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Major F0276 2023-11-07T08:10:49.941 434081 ether port 1/5 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Major F0282 2023-07-31T17:52:04.764 201600 lan port-channel 7 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:51:03.325 201446 lan port-channel 4 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:49:00.451 201281 lan port-channel 2 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:42:34.236 200638 lan port-channel 1 on fabric interconnect A oper state: failed, reason: No operational members
Major F0909 2023-06-19T14:02:55.642 99113 default Keyring's certificate is invalid, reason: expired.
Warning F1781 2012-01-11T02:21:44.215 90296 The password encryption key has not been set.
Info F0461 2011-12-31T21:32:43.448 35793 Log capacity on Management Controller on server 1/1 is very-low
Major F0408 2011-12-31T21:32:32.787 35497 Power state on chassis 1 is redundancy-failed
Warning F0528 2011-12-31T21:32:32.787 35498 Power supply 1 in chassis 1 power: off
Minor F1437 2011-12-31T21:31:08.462 32663 Config backup may be outdated
FPR4110-04-A#
The faults can be filter based on cause, detail, severity or suppressed faults.
FPR4110-04-A# show fault ?
0-18446744073709551615 ID
<CR>
> Redirect it to a file
>> Redirect it to a file in append mode
cause Cause
detail Detail
severity Severity
suppressed Fault Suppressed
| Pipe command output to filter
FPR4110-04-A# show fault severity major
Severity Code Last Transition Time ID Description
--------- ----- ----------------------- ------ -----------
Major F0276 2023-12-14T18:26:29.505 507308 ether port 2/2 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Major F0276 2023-11-13T14:07:37.720 221350 ether port 1/1 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Major F0276 2023-11-07T08:10:50.143 434090 ether port 1/6 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Major F0276 2023-11-07T08:10:49.941 434081 ether port 1/5 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Major F0282 2023-07-31T17:52:04.764 201600 lan port-channel 7 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:51:03.325 201446 lan port-channel 4 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:49:00.451 201281 lan port-channel 2 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:42:34.236 200638 lan port-channel 1 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:41:34.673 200660 lan port-channel 3 on fabric interconnect A oper state: failed, reason: No operational members
Major F0408 2011-12-31T21:32:32.787 35497 Power state on chassis 1 is redundancy-faile
Power Supply Issues
For power supply issues, a status of Voltage Problem is the indicator of a problem.
FPR4110-04-A# scope chassis 1
FPR4110-04-A /chassis # show psu
PSU:
PSU Type Wattage (W) Overall Status
--- ---- ----------- --------------
1 DV 0 N/A
2 DV 1100 Operable
Fan Issues
If there are thermal faults, most likely they are either a legitimate hardware problem with cooling/fans or a false positive due to a software defect. If the fan status is Inoperable or degraded, contact TAC for further assistance.
FPR4110-04-A# scope chassis 1
FPR4110-04-A /chassis # show fan-module
Fan Module:
Tray Module Overall Status
----------- --------- --------------
1 1 Operable
1 2 Operable
1 3 Operable
1 4 Operable
1 5 Operable
1 6 Operable
Show Event
It is important to check FXOS for application faults to see if the issue lies in the blade itself or if the application is unable to boot for a software-related problem.
FPR4110-04-A# scope chassis
FPR4110-04-A /chassis # scope server
FPR4110-04-A /chassis/server # scope fxos
FPR4110-04-A /chassis/server/fxos # show event
Creation Time ID Code Description
----------------------- ------- -------- -----------
2024-01-25T14:09:32.783 588408 E4197910 [FSM:STAGE:END]: Waiting for install license complete from blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:HostWaitForLicInstalledComplete)
2024-01-25T14:09:32.783 588409 E4197611 [FSM:STAGE:SKIP]: Reboot blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RebootHostAfterUpgrade)
2024-01-25T14:09:32.783 588410 E4197611 [FSM:STAGE:END]: Reboot blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RebootHostAfterUpgrade)
2024-01-25T14:09:32.783 588411 E4197612 [FSM:END]: Init OS on blade 1/1(FSM:sam:dme:OsControllerInitOS)
2024-01-25T14:09:32.783 588412 E4197612 [FSM:STAGE:END]: (FSM-STAGE:sam:dme:OsControllerInitOS:success)
2024-01-25T14:09:32.782 588405 E4197909 [FSM:STAGE:STALE-SUCCESS]: Request for upgrade to blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RequestToInstallLicense)
2024-01-25T14:09:32.782 588406 E4197909 [FSM:STAGE:END]: Request for upgrade to blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RequestToInstallLicense)
2024-01-25T14:09:32.782 588407 E4197910 [FSM:STAGE:SKIP]: Waiting for install license complete from blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:HostWaitForLicInstalledComplete)
2024-01-25T14:09:32.773 588404 E4197909 [FSM:STAGE:ASYNC]: Request for upgrade to blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RequestToInstallLicense)
2024-01-25T14:09:32.768 588401 E4197609 [FSM:STAGE:END]: Request for upgrade to blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RequestToUpgrade)
2024-01-25T14:09:32.768 588402 E4197610 [FSM:STAGE:SKIP]: Waiting for upgrade complete from blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:HostWaitForUpgradeComplete)
2024-01-25T14:09:32.768 588403 E4197610 [FSM:STAGE:END]: Waiting for upgrade complete from blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:HostWaitForUpgradeComplete)
FPR4110-04-A /chassis/server/fxos #
Show System Reset-reason
For unexpected application/device reloads, verify that no cores exist for any processes (FTD) and check for ASA/Lina crashinfo using the show crash command. If those do not exist then the problem is likely FXOS-related and can be routed using the FXOS keyword.
FPR4110-04-A# connect fxos
FPR4110-04-A(fxos)# show system reset-reason
----- reset reason for Supervisor-module 1 (from Supervisor in slot 1) ---
1) No time
Reason: Unknown
Service:
Version: 5.0(3)N2(4.101)
2) No time
Reason: Unknown
Service:
Version: 5.0(3)N2(4.101)
...
Motherboard Power Issues
FPR4110-04-A# scope chassis 1
FPR4110-04-A /chassis # scope server 1/1
FPR4110-04-A /chassis/server # show fsm status
Slot: 1
Server: sys/chassis-1/blade-1
FSM 1:
Remote Result: Not Applicable
Remote Error Code: None
Remote Error Description:
Status: Nop
Previous Status: Turnup Success
Timestamp: 2023-10-23T16:48:19.299
Try: 0
Flags: 0
Progress (%): 100
Current Task:
FSM 2:
Status: Nop
Previous Status: Identify Success
Timestamp: 2023-10-23T16:47:33.592
Try: 0
Progress (%): 100
Current Task:
FSM 3:
Status: Nop
Previous Status: Configure Success
Timestamp: 2023-10-23T16:48:16.739
Try: 0
Flags: 0
Progress (%): 100
Current Task:
FPR4110-04-A /chassis/server # show fault
Severity Code Last Transition Time ID Description
--------- ------- ------------------------ -------- -----------
Info F0461 2011-12-31T21:32:43.448 35793 Log capacity on Management Controller on server 1/1 is very-low
Logical Devices
As stated in the background information, a logical device lets you run an application instance, either ASA or FTD.
These are some command to confirm the status of the application instance installed in the chassis.
Monitoring Instance
Show Server Status
View if the slot and the discovery status.
FPR4110-04-A# show server status
Server Slot Status Overall Status Discovery
------- ------------ ------- ---------
1/1 Equipped Ok Complete
Show Slot
View the Log level, the admin state and the operable state of the slot.
FPR4110-04-A# scope ssa
FPR4110-04-A /ssa # show slot
Slot:
Slot ID Log Level Admin State Oper State
------- --------- ------------ ----------
1 Info Ok Online
Show Application Instance
View the name, version, author, which deploy types are supported, the CSP type and if it is the default application used.
FPR4110-04-A# scope ssa
FPR4110-04-A /ssa # show app
Name Version Author Supported Deploy Types CSP Type Is Default App
---- -------- ------ ---------------------- ----------- --------------
ftd 7.0.4-55 cisco Native,Container Application No
ftd 7.0.5-72 cisco Native,Container Application Yes
Show Logical-device
FPR4110-04-A# scope ssa
FPR4110-04-A /ssa # show logical-device
Logical Device:
Name Description Slot ID Mode Oper State Template Name
---- ----------- ------- ---------- ---------- -------------
FTD1 1 Standalone Ok ftd
Show App-instance
View the full information of the operating state of the app instance use show app-instance under the slot scope.
This command helps particularly when you create or upgrade the application instance, as it shows in the operative state if it is Installing or Online and the running software version.
FPR4110-04-A# scope ssa
FPR4110-04-A /ssa # scope slot 1
FPR4110-04-A /ssa/slot # show app-instance
Application Instance:
App Name Identifier Admin State Oper State Running Version Startup Version Deploy Type Turbo Mode Profile Name Cluster State Cluster Role
-------- ---------- ----------- ---------- --------------- --------------- ----------- ---------- ------------ -------------- ------------
ftd FTD1 Enabled Online 7.0.5-72 7.0.5-72 Native No Not Applicable None
Show App-instance Detail
FPR4110-04-A# scope ssa
FPR4110-04-A /ssa # show app-instance detail
App Name: ftd
Identifier: FTD1
Slot ID: 1
Admin State: Enabled
Oper State: Online
Running Version: 7.0.5-72
Startup Version: 7.0.5-72
Deploy Type: Native
Profile Name:
Cluster State: Not Applicable
Cluster Role: None
Current Job Type: Start
Current Job Progress: 100
Current Job State: Succeeded
Clear Log Data: Available
Error Msg:
Hotfixes:
Externally Upgraded: No
FPR4110-04-A /ssa #
Show Resource Detail
View resource allocation for the application instance.
FPR4110-04-A# scope ssa
FPR4110-04-A /ssa # scope slot 1
FPR4110-04-A /ssa/slot # enter app-instance ftd FTD1
FPR4110-04-A /ssa/slot/app-instance # show resource detail
Resource:
Allocated Core NR: 22
Allocated RAM (MB): 52096
Allocated Data Disk (MB): 128685
Allocated Binary Disk (MB): 3907
Allocated Secondary Disk (MB): 0
Chassis Manager Access
Access to Local Web Server
By default, the Secure Firewall Threat Defense 4100/9300 chassis denies all access to the local web server. You must configure your IP Access List with a list of allowed services for each of your IP blocks.
The IP Access List supports protocols:
-
HTTPS
-
SNMP
-
SSH
FPR4110-04-A# scope system
FPR4110-04-A /system # scope services
FPR4110-04-A /system/services # show ip-block
Permitted IP Block:
IP Address Prefix Length Protocol
---------- ------------- --------
0.0.0.0 0 https
0.0.0.0 0 snmp
The command enter is for configuring a new entry.
FPR4110-04-A /system/services # enter ?
dns Domain Name Server hostname
ip-block Permitted IP Block
ipv6-block Permitted IPv6 Block
ntp-server NTP server hostname
ssh-host SSH Server public keys
FPR4110-04-A /system/services # enter ip-block ?
a.b.c.d IP Address
FPR4110-04-A /system/services # enter ip-block 0.0.0.0 ?
0-32 Prefix Length
FPR4110-04-A /system/services # enter ip-block 0.0.0.0 0 ?
https Https
snmp Snmp
ssh Ssh
FPR4110-04-A /system/services/ # enter ip-block 0.0.0.0 0 ssh
FPR4110-04-A /system/services/ip-block* # commit-buffer
FPR4110-04-A /system/services/ip-block # up
FPR4110-04-A /system/services # show ip-block
Permitted IP Block:
IP Address Prefix Length Protocol
---------- ------------- --------
0.0.0.0 0 https
0.0.0.0 0 snmp
0.0.0.0 0 ssh
Monitor Interfaces
Verify Chassis Management IP
FPR4110-04-A# show fabric-interconnect
Fabric Interconnect:
ID OOB IP Addr OOB Gateway OOB Netmask OOB IPv6 Address OOB IPv6 Gateway Prefix Operability Ingress VLAN Group Entry Count (Current/Max) Switch Forwarding Path Entry Count (Current/Max)
--- ------------ ------------ --------------- ---------------- ---------------- ------ ----------- -------------------------------------------- ------------------------------------------------
A 172.16.244.72 172.16.244.65 255.255.255.192 :: :: 64 Operable 0/500 53/102
Show Mgmt-port
Determine the status of the management interface.
FPR4110-04-A# connect local-mgmt
FPR4110-04-A(local-mgmt)#
FPR4110-04-A(local-mgmt)# show mgmt-port
eth0 Link encap:Ethernet HWaddr 50:0f:80:8e:a5:cd
inet addr:172.16.244.72 Bcast:172.16.244.127 Mask:255.255.255.192
inet6 addr: fe80::520f:80ff:fe8e:a5cd/64 Scope:Link
inet6 addr: fe80::520f:80ff:fe8e:a5cd/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:7359566 errors:0 dropped:0 overruns:0 frame:0
TX packets:1147585 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1735874306 (1.6 GiB) TX bytes:360530127 (343.8 MiB)
Ping can be use to test connectivity.
FPR4110-04-A(local-mgmt)# ping 172.16.244.65
PING 172.16.244.65 (172.16.244.65) from 172.16.244.72 eth0: 56(84) bytes of data.
64 bytes from 172.16.244.65: icmp_seq=1 ttl=254 time=1.15 ms
64 bytes from 172.16.244.65: icmp_seq=2 ttl=254 time=1.38 ms
^C
--- 172.16.244.65 ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 12ms
rtt min/avg/max/mdev = 1.146/1.364/1.479/0.122 ms
FPR4110-04-A(local-mgmt)#
Set Capture on Management Interface
Enable capture on chassis (MIO) mgmt interface (this is only applicable on FP41xx/FP93xx). By default it only captures 10- packets.
FPR4110-04-A# connect fxos
FPR4110-04-A(fxos)# ethanalyzer local interface mgmt
Capturing on 'eth0'
1 2024-01-30 16:15:56.149887591 fe80::6a9e:bff:fed5:678c → ff02::2 ICMPv6 70 Router Solicitation from 68:9e:0b:d5:67:8c
2 2024-01-30 16:15:56.635897727 80:b7:09:32:f2:a0 → ff:ff:ff:ff:ff:ff ARP 60 Who has 172.16.244.65? Tell 172.16.244.106
3 2024-01-30 16:15:56.650081622 c4:72:95:76:df:97 → 01:80:c2:00:00:00 STP 60 RST. Root = 0/12/2c:31:24:b1:6b:00 Cost = 4 Port = 0x8017
4 2024-01-30 16:15:57.170356692 172.16.244.72 → 172.16.254.131 NTP 90 NTP Version 3, client
5 2024-01-30 16:15:57.234298977 172.16.254.131 → 172.16.244.72 NTP 90 NTP Version 3, server
6 2024-01-30 16:15:58.656444769 c4:72:95:76:df:97 → 01:80:c2:00:00:00 STP 60 RST. Root = 0/12/2c:31:24:b1:6b:00 Cost = 4 Port = 0x8017
7 2024-01-30 16:15:59.170382028 172.16.244.72 → 172.16.254.131 NTP 90 NTP Version 3, client
8 2024-01-30 16:15:59.233556065 172.16.254.131 → 172.16.244.72 NTP 90 NTP Version 3, server
9 2024-01-30 16:15:59.352654266 0.0.0.0 → 255.255.255.255 DHCP 368 DHCP Discover - Transaction ID 0x328ec1b7
10 2024-01-30 16:16:00.150684560 fe80::6a9e:bff:fed5:678c → ff02::2 ICMPv6 70 Router Solicitation from 68:9e:0b:d5:67:8c
10 packets captured
Program exited with status 0
Ethanalyzer can be used as well in the inbout interface. Options are high priority or low priority logs.
FPR4110-04-A(fxos)# ethanalyzer local interface ?
inbound-hi Inbound(high priority) interface
inbound-low Inbound(low priority) interface
mgmt Management interface
A filter can be used on the capture.
FPR4110-04-A(fxos)# ethanalyzer local interface ?
inbound-hi Inbound(high priority) interface
inbound-low Inbound(low priority) interface
mgmt Management interface
Show Interface
This command shows the list and current state of the interface in the chassis as a brief description of the reason of each operable state.
Note: Interfaces that act as ports in port channels do not appear in this list.
FPR4110-04-A# scope eth-uplink
FPR4110-04-A /eth-uplink # scope fabric a
FPR4110-04-A /eth-uplink/fabric # show interface
Interface:
Port Name Port Type Admin State Oper State Allowed Vlan State Reason
----------- --------- ----------- ---------- ------------ ------------
Ethernet1/1 Data Enabled Link Down All Link failure or not-connected
Ethernet1/2 Data Disabled Admin Down All Administratively down
Ethernet1/3 Data Enabled Up All Port is enabled and up
Ethernet1/4 Data Enabled Up All Port is enabled and up
Ethernet1/5 Data Enabled Link Down All Link failure or not-connected
Ethernet1/6 Data Enabled Link Down All Link failure or not-connected
Ethernet1/7 Data Enabled Sfp Not Present All Unknown
Ethernet1/8 Mgmt Enabled Up All Port is enabled and up
Ethernet2/2 Data Enabled Link Down All Link failure or not-connected
Ethernet2/5 Data Disabled Sfp Not Present All Unknown
Ethernet2/6 Data Disabled Sfp Not Present All Unknown
Ethernet2/7 Data Disabled Sfp Not Present All Unknown
Ethernet2/8 Data Disabled Sfp Not Present All Unknow
As mentioned before, the faults indicate any hardware problems identified on the Secure Firewall platforms. You can check the faults in different scopes to narrow down the issues in each scope. This example shows the faults in the eth-uplink.
FPR4110-04-A# scope eth-uplink
FPR4110-04-A /eth-uplink # show fault
Severity Code Last Transition Time ID Description
--------- ------ ------------------------ ------- -----------
Major F0727 2024-01-29T20:31:54.282 597025 lan Member 2/3 of Port-Channel 1 on fabric interconnect A is down, membership: down
Major F0727 2024-01-29T20:31:54.282 597023 lan Member 2/4 of Port-Channel 1 on fabric interconnect A is down, membership: down
Major F0282 2023-07-31T17:52:04.764 201600 lan port-channel 7 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:51:03.325 201446 lan port-channel 4 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:49:00.451 201281 lan port-channel 2 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:42:34.236 200638 lan port-channel 1 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:41:34.673 200660 lan port-channel 3 on fabric interconnect A oper state: failed, reason: No operational member
Show Port-channel
This shows the number of port-channels configured in the chassis, as well as their general status.
You can move to an specific port-channel scope to get the members information.
If you see the port-channel as Failed, contact TAC for further assistance, as this is an example of a faulty port-channel.
FPR4110-04-A# scope eth-uplink
FPR4110-04-A /eth-uplink # scope fabric a
FPR4110-04-A /eth-uplink/fabric # show port-channel
Port Channel:
Port Channel Id Name Port Type Admin State Oper State Port Channel Mode Allowed Vlan State Reason
--------------- -------------- --------- ----------- ---------- ----------------- ------------ ------------
1 Port-channel1 Data Enabled Failed Active All No operational members
2 Port-channel2 Data Enabled Failed Active All No operational members
3 Port-channel3 Data Enabled Failed Active All No operational members
4 Port-channel4 Data Enabled Failed Active All No operational members
7 Port-channel7 Data Enabled Failed Active All No operational members
FPR4110-04-A /eth-uplink/fabric # scope port-channel 1
FPR4110-04-A /eth-uplink/fabric/port-channel # show member
Member Port:
Port Name Membership Oper State State Reason
----------- ---------- ---------------- ------------
Ethernet2/3 Down Sfp Not Present Unknown
Ethernet2/4 Down Sfp Not Present Unknown
Use command show port-channel summary to view all the port-channel on device as well as their members
FPR4110-04-A# connect fxos
FPR4110-04-A(fxos)# show port-channel summary
Flags:
D - Down
P - Up in port-channel (members)
I - Individual H - Hot-standby (LACP only)
s - Suspended r - Module-removed
S - Switched R - Routed
U - Up (port-channel)
M - Not in use. Min-links not met
--------------------------------------------------------------------------------
Group Port-Channel Type Protocol Member Ports
--------------------------------------------------------------------------------
1 Po1(SD) Eth LACP Eth2/3(D) Eth2/4(D)
2 Po2(SD) Eth NONE --
3 Po3(SD) Eth NONE --
4 Po4(SD) Eth NONE --
7 Po7(SD) Eth NONE --
Related Information
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
2.0 |
05-Apr-2024 |
Added Legal Disclaimer.
Updated Headings, Title Case, Spelling, and Formatting. |
1.0 |
08-Feb-2024 |
Initial Release |
Feedback