Security Module/Engine Management

About FXOS Security Modules/Security Engine

From the Security Modules/Security Engine page of the Firepower Chassis Manager, you can view the status of a security module/engine and can perform various functions on the security module/engine:

The Security Modules/Security Engine page provides the following information:

  • Hardware State—Shows the state of the security module/engine hardware.

    • Up—The security module/engine has powered up successfully and is not showing any hardware faults, even if the security module/engine does not have a logical device associated with it.

    • Booting Up—The security module/engine is in the process of powering up.

    • Restart—The security module/engine is in the process of being restarted.

    • Down—The security module/engine is not powered on or a hardware fault is preventing the security module/engine from starting successfully.

    • Mismatch—The security module has been decommissioned or a new security module was installed into the slot. Use the Recommission or Acknowledge function to return the security module to a functioning state.

  • Service State—Shows the state of the software on the security module/engine:

    • Not-available—The security module has been removed from the chassis slot. Reinstall the security module to return it to its normal operational state.

    • Online—The security module/engine is installed and is in normal operation mode.

    • Not Responding—The security module/engine is unresponsive.

    • Token Mismatch—Indicates that a security module other than the one previously configured has been installed into the chassis slot. This could also be caused by a software installation error. Use the Reinitialize function to return the security module to a functioning state.

    • Fault—The security module/engine is in a fault state. Review the system fault listing for more information about what might be causing the fault state.

  • Power—Shows the power status of the security module/engine:

    • On—Use the Power off/on function to toggle the power status for the security module/engine.

    • Off—Use the Power off/on function to toggle the power status for the security module/engine.

  • Application—Shows the logical device type that is installed on the security module/engine.

From the Security Modules/Security Engine page of the Firepower Chassis Manager, you can perform the following functions on a security module/engine:

  • Decommission (security modules only)—Decommissioning a security module places the security module into maintenance mode. You can also decommission and then acknowledge a security module in order to correct certain fault states. See Decommissioning a Security Module.

  • Acknowledge—Brings newly installed security modules online. See Acknowledge a Security Module/Engine.

  • Power Cycle—Restarts the security module/engine. See Power-Cycling a Security Module/Engine.

  • Reinitialize—Reformats the security module/engine hard disk, removing all deployed applications and configurations from the security module/engine, and then restarts the system. After reinitialization is complete, if a logical device is configured for the security module/engine, the Firepower eXtensible Operating System will reinstall the application software, redeploy the logical device, and auto start the application. See Reinitializing a Security Module/Engine.


    Warning

    All application data on the security module/engine is deleted during reinitialization. Please back up all application data before reinitializing a security module/engine.

  • Power off/on—Toggles the power state for the security module/engine. See Power-Cycling a Security Module/Engine.

Decommissioning a Security Module

When you decommission a security module, the security module object is deleted from the configuration and the security module becomes unmanaged. Any logical devices or software running on the security module will become inactive.

You can decommission a security module if you want to temporarily discontinue use of the security module.

Procedure

Step 1

Choose Security Modules to open the Security Modules page.

Step 2

To decommission a security module, click Decommission for that security module.

Step 3

Click Yes to verify that you want to decommission the specified security module.

Acknowledge a Security Module/Engine

When a new security module is installed into the chassis, you must acknowledge the security module before you can begin using it.

If the security module is showing a status of “mismatch” or “token mismatch,” this is an indication that the security module installed in the slot has data on it that does not match what was previously installed in the slot. If the security module has existing data on it and you are sure you want to use it in the new slot (in other words, the security module wasn't inadvertently installed into the wrong slot), you must reinitialize the security module before you can deploy a logical device to it.

Procedure

Step 1

Choose Security Modules/Security Engine to open the Security Modules/Security Engine page.

Step 2

Click Acknowledge for the security module/engine that you want to acknowledge.

Step 3

Click Yes to verify that you want to acknowledge the specified security module/engine.

Power-Cycling a Security Module/Engine

Follow these steps to power-cycle a security module/engine.

Procedure

Step 1

Choose Security Modules/Security Engine to open the Security Modules/Security Engine page.

Step 2

Click Power Cycle for the security module/engine that you want to reboot.

Step 3

Do one of the following:

  • Click Safe Power Cycle to have the system wait for up to five minutes for the application running on the security module/engine to shut down before the system power-cycles the specified security module/engine.

  • Click Power Cycle Immediately to have the system power-cycle the specified security module/engine immediately.

Reinitializing a Security Module/Engine

When a security module/engine is reinitialized, the security module/engine hard disk is formatted and all installed application instances, configurations, and data are removed. After reinitialization has completed, if a logical device is configured for the security module/engine, FXOS will reinstall the application software, redeploy the logical device, and auto start the application.


Caution

All application data on the security module/engine is deleted during reinitialization. Back up all application data before reinitializing a security module/engine.

Procedure

Step 1

Choose Security Modules/Security Engine to open the Security Modules/Security Engine page.

Step 2

Click Reinitialize for the security module/engine that you want to reinitialize.

Step 3

Click Yes to verify that you want to reinitialize the specified security module/engine.

The security module/engine is restarted and all data on the security module is deleted. This process can take several minutes.