Troubleshoot a Secure Firewall ASA device

Open a terminal window and connect to the ASA using SSH.

Enter global configuration mode.

At the hostname (config)# prompt, enter this command:

Open a console window on a computer that can reach the SDC.

Connect to your SDC using SSH. You can log in as a regular user such as Security Cloud Control or SDC or some other user you created. You don't need to be logged in as root.

At the command prompt enter: openssl s_client -showcerts -connect ASA_IP_Address:443

Look for these lines in the command output.

New, TLSV1/SSLv3, Cipher is DES-CB3-SHA 
or 
SSL-Session:
            Protocol: TLSv1.2 
            Cipher: DES-CB3-SHA

Connect to the ASA using SSH.

Once connected to the ASA, elevate your privileges to global configuration mode. Your prompt should look like this: asaname(config)#

At the prompt, enter a command similar to this:

ssl cipher tlsv1.2 custom "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-GCM-SHA384 DHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 DHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA256 DHE-RSA-AES256-SHA256"

After you submit the command, enter write memory at the prompt to save the local configuration. For example: asaname(config)#write memory

In the left pane, click Security Devices.

Click the appropriate device type tab and select the device for which you want to view real-time data.

Click Troubleshoot .

(Optional) Before clicking View Real-time Log, you can define a filter in the left pane to refine the results of your logging search.

Click View Real-time Log. Security Cloud Control retrieves the real-time logging data based on your filterin criteria and displays it.

To see an additional 20 seconds of logged data or the last 10 KB of logged data. click View Real-Time Log again.

In the left pane, click Security Devices.

Select your ASA and view troubleshooting details in the Troubleshooting pane.

In the pane, select the interface and packet type you want to send virtually through your ASA.

(Optional) If you want to trace a packet where the security group tag value is embedded in the Layer 2 CMD header (Trustsec), check SGT number and enter the security group tag number, 0-65535.

Specify the source and destination. You can specify IPv4 or IPv6 addresses, fully-qualified domain names (FQDN), or security group names or tags if you use Cisco Trustsec. For the source address, you can also specify a username in the format Domain\username.

Specify other protocol characteristics:

Click Run Packet Tracer.

Continue with Analyze Packet Tracer Results.

From the Security Cloud Control Home page, click Firewall.

In the left pane, click Policies > ASA > Access Policies.

Select a policy that is associated with your ASA.

Select a rule in the network policy to troubleshoot and click Troubleshoot in the details pane. Notice that in the values panel of the troubleshoot page, many of the fields are pre-populated with the attributes of the rule you chose.

Enter information in the remaining required fields. Once you have completed all the required fields the Run Packet Tracer button becomes active.

Click Run Packet Tracer.

Continue with Analyze Packet Tracer Results.

In the left pane, click Security Devices and then click the ASA tab.

Select your ASA, and click View NAT Rules in the Action pane.

Select the rule from the NAT Rules table that you want to troubleshoot and click Troubleshoot in the details pane. Notice that in the values panel of the Troubleshoot page, many of the fields are pre-populated with the attributes of the rule you chose.

Enter information in the remaining required fields. Once you have completed all the required fields the Run Packet Tracer becomes active.

Click Run Packet Tracer.

Continue with Analyze Packet Tracer Results.

In left pane, click Security Devices.

Click the ASA tab, select your ASA, and click View NAT Rules in the Action pane.

Select the rule from the NAT Rules table that you want to troubleshoot and click Troubleshoot in the details pane. For a bi-directional Twice NAT rule, this opens a dropdown where you choose to troubleshoot the source packet translation or the destination packet translation.

Enter information in the remaining required fields. Once you have completed all the required fields the Run Packet Tracer becomes active.

Click Run Packet Tracer.

Configure a DNS server on each ASA that is affected.

Return to the advisory to determine which software patch you need.

See Upgrade ASA and ASDM images on a single ASA for topics that describe how to use Security Cloud Control to upgrade your ASAs to the fixed releases listed in the ASA advisory. Start with the upgrade prerequisites and then read about upgrading individual ASAs, upgrading ASAs in an active-standby configuration, or upgrading ASAs in bulk.

Access the ASA's command line interface in one of these ways:

At the prompt type copy running-config flash

When prompted for the Source filename, don't type anything and press <Enter>

When prompted for the destination filename, enter a name for the output file. After ASA copies the running configuration the file you specified, it returns you to the privileged EXEC prompt.

At the prompt, type show flash

Look in the length column. If your file is over 4718592 bytes, it is larger than 4.5 MB.

asa1# copy running-config flash
Source filename [running-config]? 
Destination filename [running-config]? running-config-output
Cryptochecksum: 725f4c1c 4adfb8a9 8b3e7a6d 49e3420d 
23648 bytes copied in 1.380 secs (23648 bytes/sec)
asa1# show flash
--#-- --length-- -----date/time------ path
 107 110325428 Feb 28 2019 15:41:42 asdm-8826067.bin
 122 5018592 Apr 30 2019 21:00:59 running-config-output
 111 102647808 Mar 12 2019 14:26:10 asa9-12-1-smp-k8.bin

Connect to your SDC host using SSH or the hypervisor console.

Check the version of your Docker service by running this command:

docker version

If you are running one of the latest virtual machines (VMs) you should see output like this:

 > docker version
Client:
     Version: 18.06.1-ce
     API version: 1.38
     Go version: go1.10.3
     Git commit: e68fc7a
     Built: Tue Aug 21 17:23:03 2018
     OS/Arch: linux/amd64
     Experimental: false

Run the following commands to update Docker and restart the service:

> sudo yum update docker-ce
> sudo service docker restart

Run the docker version command again. You should see this output:

> docker version
Client:
    Version: 18.09.2
    API version: 1.39
    Go version: go1.10.6
    Git commit: 6247962
    Built: Sun Feb XX 04:13:27 2019
    OS/Arch: linux/amd64
    Experimental: false

You are done. You have now upgraded to the latest, and patched, version of Docker.