El conjunto de documentos para este producto aspira al uso de un lenguaje no discriminatorio. A los fines de esta documentación, "no discriminatorio" se refiere al lenguaje que no implica discriminación por motivos de edad, discapacidad, género, identidad de raza, identidad étnica, orientación sexual, nivel socioeconómico e interseccionalidad. Puede haber excepciones en la documentación debido al lenguaje que se encuentra ya en las interfaces de usuario del software del producto, el lenguaje utilizado en función de la documentación de la RFP o el lenguaje utilizado por un producto de terceros al que se hace referencia. Obtenga más información sobre cómo Cisco utiliza el lenguaje inclusivo.
Cisco ha traducido este documento combinando la traducción automática y los recursos humanos a fin de ofrecer a nuestros usuarios en todo el mundo contenido en su propio idioma. Tenga en cuenta que incluso la mejor traducción automática podría no ser tan precisa como la proporcionada por un traductor profesional. Cisco Systems, Inc. no asume ninguna responsabilidad por la precisión de estas traducciones y recomienda remitirse siempre al documento original escrito en inglés (insertar vínculo URL).
Este documento describe las preguntas más frecuentes (FAQ) relacionadas con las plataformas FXOS (por ejemplo, Firepower 9300, Firepower 41xx, etc) también conocidas como plataformas de procesadores de servicios de seguridad (SSP). FXOS es el sistema operativo (OS) que administra el chasis.
A partir de la versión 2.8.x, el fprm se desaprobó. Por lo tanto, FXOS 2.8.x sólo admite chasis y servidores blade que muestran tecnología.
KSEC-FPR4115-2-1(local-mgmt)# show tech-support fprm detail WARNING: show tech-support fprm detail command is deprecated. Please use show tech-support chassis 1 detail command instead.
En las versiones anteriores a 2.8.x, FXOS proporciona 3 salidas show tech diferentes. El paquete FPRM contiene archivos de registro para Management Input/Output (MIO) (Supervisor Engine) y Service Manager)
Normalmente, genera los 3 paquetes. Utilice el detalle show tech-support <option> para generar los 3 paquetes de registro diferentes para el análisis del TAC:
FPR4140-A# connect local-mgmt FPR4140-A(local-mgmt)# show tech-support fprm detail FPR4140-A(local-mgmt)# show tech-support chassis 1 detail FPR4140-A(local-mgmt)# show tech-support module 1 detail
Para comprobar los nombres de archivo generados:
FPR4140-A(local-mgmt)# dir techsupport/ 1 15595520 Apr 09 17:29:10 2017 20170409172722_FPR4140_FPRM.tar 1 962560 Apr 09 17:32:20 2017 20170409172916_FPR4140_BC1_all.tar 1 7014400 Apr 09 18:06:25 2017 Firepower-Module1_04_09_2017_18_05_59.tar
Para exportar un paquete desde CLI:
FPR4140-A(local-mgmt)# copy workspace:///techsupport/20170409172722_FPR4140_FPRM.tar ftp|tftp|scp|sftp://username@192.168.0.1/
Nota: Además de los resultados de FXOS show tech, los dispositivos lógicos como ASA y/o FTD tienen su propia función show tech independiente. En el caso de Multi-Instance (MI), cada instancia también tiene su propio paquete show-tech independiente. Por último, los show-techs de MI no se soportan en FCM
A partir de FXOS 2.6, la generación y descarga del soporte técnico FXOS está disponible desde la interfaz de usuario de Firepower Chassis Manager (FCM) en Herramientas > Registros de solución de problemas
En FP9300:
En FP41xx:
Hay algunas maneras de verificar la configuración de la interfaz de administración:
FPR4115-2-1# show fabric-interconnect Fabric Interconnect: ID OOB IP Addr OOB Gateway OOB Netmask OOB IPv6 Address OOB IPv6 Gateway Prefix Operability Ingress VLAN Group Entry Count (Current/Max) Switch Forwarding Path Entry Count (Current/Max) ---- --------------- --------------- --------------- ---------------- ---------------- ------ ----------- -------------------------------------------- ------------------------------------------------ A 10.62.184.19 10.62.184.1 255.255.255.0 :: :: 64 Operable 0/500 14/1021
or
FPR4115-2-1# scope fabric-interconnect a FPR4115-2-1 /fabric-interconnect # show Fabric Interconnect: ID OOB IP Addr OOB Gateway OOB Netmask OOB IPv6 Address OOB IPv6 Gateway Prefix Operability Ingress VLAN Group Entry Count (Current/Max) Switch Forwarding Path Entry Count (Current/Max) ---- --------------- --------------- --------------- ---------------- ---------------- ------ ----------- -------------------------------------------- ------------------------------------------------ A 10.62.184.19 10.62.184.1 255.255.255.0 :: :: 64 Operable 0/500 14/1021 FPR4115-2-1 /fabric-interconnect # show detail Fabric Interconnect: ID: A Product Name: Cisco FPR-4115-SUP PID: FPR-4115-SUP VID: V01 Vendor: Cisco Systems, Inc. Serial (SN): JAD12345NY6 HW Revision: 0 Total Memory (MB): 8074 OOB IP Addr: 10.62.184.19 OOB Gateway: 10.62.184.1 OOB Netmask: 255.255.255.0 OOB IPv6 Address: :: OOB IPv6 Gateway: :: Prefix: 64 Operability: Operable Thermal Status: Ok Ingress VLAN Group Entry Count (Current/Max): 0/500 Switch Forwarding Path Entry Count (Current/Max): 14/1021 Current Task 1: Current Task 2: Current Task 3:
Para cambiar la configuración IP:
FPR4115-2-1# scope fabric-interconnect a FPR4115-2-1 /fabric-interconnect # set out-of-band gw Gw ip Ip netmask Netmask KSEC-FPR4115-2-1 /fabric-interconnect # set out-of-band ip 10.62.184.19 netmask 255.255.255.0 gw 10.62.184.1 KSEC-FPR4115-2-1 /fabric-interconnect* # commit-buffer
Nota: Acerca de la confirmación:
FPR4115-2-1 /fabric-interconnect # commit-buffer verify-only ! verify the change for error FPR4115-2-1 /fabric-interconnect # commit-buffer ! commit the change FPR4115-2-1 /fabric-interconnect # discard-buffer ! cancel the change
Para obtener más información, consulte:
Referencia de Comandos FXOS de Cisco Firepower 4100/9300
Navegue hasta el alcance de la CLI de administración local y utilice el comando ping:
FPR4115-2-1# connect local-mgmt FPR4115-2-1(local-mgmt)# ping 10.62.184.1 PING 10.62.184.1 (10.62.184.1) from 10.62.184.19 eth0: 56(84) bytes of data. 64 bytes from 10.62.184.1: icmp_seq=1 ttl=255 time=0.602 ms 64 bytes from 10.62.184.1: icmp_seq=2 ttl=255 time=0.591 ms 64 bytes from 10.62.184.1: icmp_seq=3 ttl=255 time=0.545 ms 64 bytes from 10.62.184.1: icmp_seq=4 ttl=255 time=0.552 ms
Navegue hasta el alcance de la CLI de administración local y utilice este comando:
FPR4115-2-1# connect local-mgmt FPR4115-2-1(local-mgmt)# show mgmt-ip-debug | begin eth0 eth0 Link encap:Ethernet HWaddr 78:bc:1a:e7:a4:11 inet addr:10.62.184.19 Bcast:10.62.184.255 Mask:255.255.255.0 inet6 addr: fe80::7abc:1aff:fee7:a411/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:3420589 errors:0 dropped:0 overruns:0 frame:0 TX packets:2551231 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:419362704 (399.9 MiB) TX bytes:1530147643 (1.4 GiB)
Además de Operable en scope fabric-interconnect a > show, puede utilizar este comando:
FPR4115-2-1# connect local-mgmt FPR4115-2-1(local-mgmt)# show mgmt-port eth0 Link encap:Ethernet HWaddr 78:bc:1a:e7:a4:11 inet addr:10.62.184.19 Bcast:10.62.184.255 Mask:255.255.255.0 inet6 addr: fe80::7abc:1aff:fee7:a411/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:3422158 errors:0 dropped:0 overruns:0 frame:0 TX packets:2552019 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:419611452 (400.1 MiB) TX bytes:1530247862 (1.4 GiB)
Alternativamente, puede utilizar este comando. La parte Ámbito muestra Link UP. Tenga en cuenta que la UP se muestra en la siguiente línea:
FPR4115-2-1# connect local-mgmt FPR4115-2-1(local-mgmt)# show mgmt-ip-debug | begin eth0 eth0 Link encap:Ethernet HWaddr 78:bc:1a:e7:a4:11 inet addr:10.62.184.19 Bcast:10.62.184.255 Mask:255.255.255.0 inet6 addr: fe80::7abc:1aff:fee7:a411/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:3420589 errors:0 dropped:0 overruns:0 frame:0 TX packets:2551231 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:419362704 (399.9 MiB) TX bytes:1530147643 (1.4 GiB)
Nota: El estado UP es el estado de administración de la interfaz. El estado permanece ACTIVO incluso si desconecta el cable físico o el módulo SFP. Otro punto importante es el estado RUNNING, lo que significa que el link está operativo (el protocolo de línea está activo).
Para desactivar el estado lógico de la interfaz:
FPR4100-3-A(local-mgmt)# mgmt-port shut FPR4100-3-A(local-mgmt)# show mgmt-ip-debug ifconfig | b eth0 eth0 Link encap:Ethernet HWaddr 58:97:BD:B9:76:EB inet addr:10.62.148.88 Bcast:10.62.148.127 Mask:255.255.255.128 BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:3685870 errors:0 dropped:0 overruns:0 frame:0 TX packets:7068372 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:295216623 (281.5 MiB) TX bytes:1049391193 (1000.7 MiB)
Para volver a aparecer:
FPR4100-3-A(local-mgmt)# mgmt-port no-shut FPR4100-3-A(local-mgmt)# show mgmt-ip-debug ifconfig | b eth0 eth0 Link encap:Ethernet HWaddr 58:97:BD:B9:76:EB inet addr:10.62.148.88 Bcast:10.62.148.127 Mask:255.255.255.128 inet6 addr: fe80::5a97:bdff:feb9:76eb/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:3685885 errors:0 dropped:0 overruns:0 frame:0 TX packets:7068374 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:295218130 (281.5 MiB) TX bytes:1049391353 (1000.7 MiB)
Nota: Hay un show interface brief y show interface mgmt 0 en el modo fxos que muestra la interfaz mgmt0 como down y Admin down respectivamente. No utilice esto como referencia de que está desactivado.
FPR-4110-A# connect fxos FPR-4110-A(fxos)# shpw interface brief | include mgmt0 mgmt0 -- down 172.16.171.83 -- 1500 FPR-4110-A(fxos)# show interface mgmt 0 mgmt0 is down (Administratively down) Hardware: GigabitEthernet, address: 5897.bdb9.212d (bia 5897.bdb9.212d) Internet Address is 172.16.171.83/24 MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA auto-duplex, auto-speed EtherType is 0x0000 1 minute input rate 3080 bits/sec 2 packets/sec 1 minute output rate 0 bits/sec 0 packets/sec Rx 977 unicast packets 12571 multicast packets 5229 broadcast packets 18777 input packets 2333662 bytes Tx 0 unicast packets 0 multicast packets 0 broadcast packets 0 output packets 0 bytes
Si hace un comando show run interface mgmt0 en el modo fxos, notará que shutdown force está en esa interfaz. De nuevo, no utilice esto como referencia de que está inactivo:
FPR4115-2-1(fxos)# show run interface mgmt0 !Command: show running-config interface mgmt0 !Time: Tue May 5 14:19:42 2020 version 5.0(3)N2(4.81) interface mgmt0 shutdown force ip address 10.62.184.19/24
La administración fuera de banda depende sólo del conjunto de gateway predeterminado. Por lo tanto, asegúrese de que el gateway predeterminado seleccionado permita la conexión a los clientes que requieran acceso al sistema.
Hay un show ip route vrf all en connect fxos, pero esto no se utiliza para la administración fuera de banda.
La tabla ARP está visible desde la CLI de FXOS. También puede utilizar la captura de paquetes en el modo fxos (ethanalyzer) para capturar ARP y/o verificar el tráfico hacia/desde la administración.
Este es un ejemplo para capturar paquetes ARP. Puede cambiar el filtro de captura a cualquier cosa. Ese filtro es similar al filtro tcpdump:
fp9300-A# connect fxos
fp9300-A(fxos)# ethanalyzer local interface mgmt capture-filter arp
Capturing on eth0
2016-10-14 18:04:57.551221 00:50:56:85:be:44 -> ff:ff:ff:ff:ff:ff ARP Who has 172.16.171.240? Tell 172.16.171.101
2016-10-14 18:04:57.935562 00:12:80:85:a5:49 -> ff:ff:ff:ff:ff:ff ARP Who has 172.16.171.112? Tell 172.16.171.1
2016-10-14 18:04:58.167029 00:50:56:85:78:4e -> ff:ff:ff:ff:ff:ff ARP Who has 172.16.171.205? Tell 172.16.171.100
2016-10-14 18:04:59.156000 00:50:56:9f:b1:43 -> ff:ff:ff:ff:ff:ff ARP Who has 172.16.171.1? Tell 172.16.171.151
2016-10-14 18:04:59.165701 00:50:56:9f:b1:43 -> ff:ff:ff:ff:ff:ff ARP Who has 172.16.171.1? Tell 172.16.171.151
2016-10-14 18:04:59.166925 00:50:56:85:78:4e -> ff:ff:ff:ff:ff:ff ARP Who has 172.16.171.205? Tell 172.16.171.100
2016-10-14 18:04:59.268168 00:50:56:9f:b1:43 -> ff:ff:ff:ff:ff:ff ARP Who has 172.16.171.151? Tell 0.0.0.0
2016-10-14 18:05:00.150217 00:50:56:85:78:4e -> ff:ff:ff:ff:ff:ff ARP Who has 172.16.171.204? Tell 172.16.171.100
2016-10-14 18:05:00.268369 00:50:56:9f:b1:43 -> ff:ff:ff:ff:ff:ff ARP Who has 172.16.171.151? Tell 0.0.0.0
2016-10-14 18:05:01.150243 00:50:56:85:78:4e -> ff:ff:ff:ff:ff:ff ARP Who has 172.16.171.204? Tell 172.16.171.100
10 packets captured
Program exited with status 0.
fp9300-A(fxos)#
Además, puede guardar la captura en un archivo y exportarla a un servidor remoto:
FPR4140-A# connect fxos FPR4140-A(fxos)# ethanalyzer local interface mgmt capture-filter arp limit-captured-frames 0 write workspace:///ARP.pcap FPR4140-A# connect local-mgmt FPR4140-A(local-mgmt)# dir 1 23075 Jan 12 13:13:18 2020 ARP.pcap FPR4140-A(local-mgmt)# copy workspace:///ARP.pcap ftp://anonymous@10.48.40.70/ARP.pcap
Utilice el comando show failure:
FPR4115-2-1# show fault Severity Code Last Transition Time ID Description --------- -------- ------------------------ -------- ----------- Major F0909 2020-04-26T21:19:37.520 554924 default Keyring's certificate is invalid, reason: expired. Major F1769 2012-01-19T00:30:02.733 323268 The password encryption key has not been set. Minor F1437 2012-01-19T00:30:02.732 32358 Config backup may be outdated
También puede filtrar los fallos en función de la gravedad:
FPR4115-2-1# show fault ? 0-18446744073709551615 ID <CR> > Redirect it to a file >> Redirect it to a file in append mode cause Cause detail Detail severity Severity suppressed Fault Suppressed | Pipe command output to filter FPR4115-2-1# show fault severity major Severity Code Last Transition Time ID Description --------- -------- ------------------------ -------- ----------- Major F0909 2020-04-26T21:19:37.520 554924 default Keyring's certificate is invalid, reason: expired. Major F1769 2012-01-19T00:30:02.733 323268 The password encryption key has not been set.
Los mismos fallos también se pueden ver en el panel Descripción general de la interfaz de usuario de FXOS > FALLOS:
Usted utiliza el comando set name bajo el alcance del sistema:
KSEC-FPR4115-2-1# scope system KSEC-FPR4115-2-1 /system # set name new-name Warning: System name modification changes FC zone name and redeploys them non-disruptively KSEC-FPR4115-2-1 /system* # commit-buffer KSEC-FPR4115-2-1 /system # exit new-name#
Se debe reconocer y reinicializar un módulo de seguridad recién instalado para poder utilizarlo. Esto es cierto incluso cuando se reemplaza una unidad a través de RMA.
FPR9300# show server status
Server Slot Status Overall Status Discovery
------- --------------------------------- --------------------- ---------
1/1 Mismatch Compute Mismatch Complete
1/2 Equipped Ok Complete
1/3 Empty
FPR9300#
La discordancia de cálculo puede provocar este evento de error:
Service profile ssp-sprof-1 configuration failed due to compute-unavailable,insufficient-resources
El estado show service-profile muestra UnAssociated como si el módulo no estuviera allí.
Pasos a reconocer desde la CLI:
scope chassis 1
acknowledge slot <slot#>
commit-buffer
De manera alternativa, puede utilizar la interfaz de usuario del administrador de chasis para reconocer el módulo:
Esto indica que el módulo de seguridad aún no se ha reinicializado después de ser reconocido:
FPR9300# scope ssa FPR9300 /ssa # show slot Slot: Slot ID Log Level Admin State Operational State ---------- --------- ------------ ----------------- 1 Info Ok Token Mismatch 2 Info Ok Online 3 Info Ok Not Available FPR9300 /ssa #
Pasos para reinicializar a través de CLI:
scope ssa scope slot <#> reinitialize commit-buffer
En Firepower 41xx, esto también puede significar que falta la SSD o que es defectuosa. Verifique si la SSD aún existe a través de show inventario storage en el servidor de alcance 1/1:
FPR4140-A# scope ssa
FPR4140-A /ssa # show slot 1
Slot:
Slot ID Log Level Admin State Oper State
---------- --------- ------------ ----------
1 Info Ok Token Mismatch
FPR4140-A /ssa # show fault severity critical
Severity Code Last Transition Time ID Description
--------- -------- ------------------------ -------- -----------
Critical F1548 2018-03-11T01:22:59.916 38768 Blade swap detected on slot 1
FPR4140-A /ssa # scope server 1/1
FPR4140-A /chassis/server # show inventory storage
Server 1/1:
Name:
User Label:
Equipped PID: FPR4K-SM-36
Equipped VID: V01
Equipped Serial (SN): FLM12345KL6
Slot Status: Equipped
Acknowledged Product Name: Cisco Firepower 4100 Series Extreme Performance Security Engine
Acknowledged PID: FPR4K-SM-36
Acknowledged VID: V00
Acknowledged Serial (SN): FLM12345KL6
Acknowledged Memory (MB): 262144
Acknowledged Effective Memory (MB): 262144
Acknowledged Cores: 36
Acknowledged Adapters: 2
Motherboard:
Product Name: Cisco Firepower 4100 Series Extreme Performance Security Engine
PID: FPR4K-SM-36
VID: V01
Vendor: Cisco Systems Inc
Serial (SN): FLM12345KL6
HW Revision: 0
RAID Controller 1:
Type: SATA
Vendor: Cisco Systems Inc
Model: CHORLEYWOOD
Serial: FLM12345KL6
HW Revision:
PCI Addr: 00:31.2
Raid Support:
OOB Interface Supported: No
Rebuild Rate: N/A
Controller Status: Unknown
Local Disk 1:
Vendor:
Model:
Serial:
HW Rev: 0
Operability: N/A
Presence: Missing
Size (MB): Unknown
Drive State: Unknown
Power State: Unknown
Link Speed: Unknown
Device Type: Unspecified
Local Disk Config Definition:
Mode: No RAID
Description:
Protect Configuration: No
Esto se configura en la configuración de la plataforma FXOS. Siga las instrucciones de este documento: Configuración de la plataforma FXOS
Para verificar la configuración de hora del chasis:
KSEC-FPR4115-2-1# show clock Tue May 5 21:30:55 CEST 2020 KSEC-FPR4115-2-1# show ntp NTP Overall Time-Sync Status: Time Synchronized
Para reducir el tiempo del módulo/blade desde el módulo Boot CLI, utilice estos 3 comandos:
Firepower-module1>show ntp peerstatus remote local st poll reach delay offset disp ======================================================================= *203.0.113.126 203.0.113.1 2 64 377 0.00006 0.000018 0.02789 remote 203.0.113.126, local 203.0.113.1 hmode client, pmode mode#255, stratum 2, precision -20 leap 00, refid [171.68.38.65], rootdistance 0.19519, rootdispersion 0.17641 ppoll 6, hpoll 6, keyid 0, version 4, association 43834 reach 377, unreach 0, flash 0x0000, boffset 0.00006, ttl/mode 0 timer 0s, flags system_peer, config, bclient, prefer, burst reference time: dbef8823.8066c43a Mon, Dec 5 2016 8:30:59.501 originate timestamp: 00000000.00000000 Mon, Jan 1 1900 2:00:00.000 receive timestamp: dbefb27d.f914589d Mon, Dec 5 2016 11:31:41.972 transmit timestamp: dbefb27d.f914589d Mon, Dec 5 2016 11:31:41.972 filter delay: 0.00008 0.00006 0.00008 0.00009 0.00008 0.00008 0.00008 0.00009 filter offset: 0.000028 0.000018 0.000034 0.000036 0.000033 0.000036 0.000034 0.000041 filter order: 1 2 6 0 4 5 3 7 offset 0.000018, delay 0.00006, error bound 0.02789, filter error 0.00412
Firepower-module1>show ntp association remote refid st t when poll reach delay offset jitter ============================================================================== *203.0.113.126 171.68.38.65 2 u 37 64 377 0.062 0.018 0.017 ind assid status conf reach auth condition last_event cnt =========================================================== 1 43834 961d yes yes none sys.peer 1 associd=43834 status=961d conf, reach, sel_sys.peer, 1 event, popcorn, srcadr=203.0.113.126, srcport=123, dstadr=203.0.113.1, dstport=123, leap=00, stratum=2, precision=-20, rootdelay=195.190, rootdisp=176.407, refid=171.68.38.65, reftime=dbef8823.8066c43a Mon, Dec 5 2016 8:30:59.501, rec=dbefb27d.f91541fc Mon, Dec 5 2016 11:31:41.972, reach=377, unreach=0, hmode=3, pmode=4, hpoll=6, ppoll=6, headway=22, flash=00 ok, keyid=0, offset=0.018, delay=0.062, dispersion=0.778, jitter=0.017, xleave=0.011, filtdelay= 0.08 0.06 0.08 0.10 0.08 0.09 0.08 0.10, filtoffset= 0.03 0.02 0.03 0.04 0.03 0.04 0.03 0.04, filtdisp= 0.00 0.03 1.04 1.07 2.06 2.09 3.09 3.12
Firepower-module1>show ntp sysinfo associd=0 status=0618 leap_none, sync_ntp, 1 event, no_sys_peer, version="ntpd 4.2.6p5@1.2349-o Fri Oct 7 17:08:03 UTC 2016 (2)", processor="x86_64", system="Linux/3.10.62-ltsi-WR6.0.0.27_standard", leap=00, stratum=3, precision=-23, rootdelay=195.271, rootdisp=276.641, refid=203.0.113.126, reftime=dbefb238.f914779b Mon, Dec 5 2016 11:30:32.972, clock=dbefb2a7.575931d7 Mon, Dec 5 2016 11:32:23.341, peer=43834, tc=6, mintc=3, offset=0.035, frequency=25.476, sys_jitter=0.003, clk_jitter=0.015, clk_wander=0.011 system peer: 203.0.113.126 system peer mode: client leap indicator: 00 stratum: 3 precision: -23 root distance: 0.19527 s root dispersion: 0.27663 s reference ID: [203.0.113.126] reference time: dbefb238.f914779b Mon, Dec 5 2016 11:30:32.972 system flags: auth monitor ntp kernel stats jitter: 0.000000 s stability: 0.000 ppm broadcastdelay: 0.000000 s authdelay: 0.000000 s time since restart: 1630112 time since reset: 1630112 packets received: 157339 packets processed: 48340 current version: 48346 previous version: 0 declined: 0 access denied: 0 bad length or format: 0 bad authentication: 0 rate exceeded: 0 Firepower-module1>
Para obtener más detalles sobre la verificación de NTP y la resolución de problemas, consulte este documento: Configuración, verificación y resolución de problemas de los parámetros del protocolo de tiempo de red (NTP) en los dispositivos Firepower FXOS
En el caso del dispositivo lógico ASA, se necesita una licencia inteligente en el chasis FXOS. Consulte este documento para obtener más información: Administración de licencias para ASA
A continuación se muestra un ejemplo de salida del estado de la licencia
FPR4115-2-1# scope license FPR4115-2-1 /license # show license all Smart Licensing Status ====================== Smart Licensing is ENABLED Registration: Status: REGISTERED Smart Account: BU Production Test Virtual Account: TAC-BETA Export-Controlled Functionality: Not Allowed Initial Registration: SUCCEEDED on Dec 15 14:41:55 2015 PST Last Renewal Attempt: SUCCEEDED on Dec 23 09:26:05 2015 PST Next Renewal Attempt: Jun 21 07:00:21 2016 PST Registration Expires: Dec 23 06:54:19 2016 PST License Authorization: Status: AUTHORIZED on Apr 07 15:44:26 2016 PST Last Communication Attempt: SUCCEEDED on Apr 07 15:44:26 2016 PST Next Communication Attempt: May 07 15:44:25 2016 PST Communication Deadline: Jul 06 15:38:24 2016 PST License Usage ============== No licenses in use Product Information =================== UDI: PID:FPR9K-SUP,SN:JAD123456AB Agent Version ============= Smart Agent for Licensing: 1.4.1_rel/31
o, alternativamente:
fp9300-A# conn local-mgmt
fp9300-A(local-mgmt)# show license all
Smart Licensing Status
======================
Smart Licensing is ENABLED
Registration:
Status: REGISTERED
Smart Account: Cisco Internal
Virtual Account: Escalations
Export-Controlled Functionality: Allowed
Initial Registration: SUCCEEDED on Feb 10 18:55:08 2016 CST
Last Renewal Attempt: SUCCEEDED on Oct 09 15:07:25 2016 CST
Next Renewal Attempt: Apr 07 15:16:32 2017 CST
Registration Expires: Oct 09 15:10:31 2017 CST
License Authorization:
Status: AUTHORIZED on Sep 20 07:29:06 2016 CST
Last Communication Attempt: SUCCESS on Sep 20 07:29:06 2016 CST
Next Communication Attempt: None Communication Deadline: None
Licensing HA configuration error:
No Reservation Ha config error
License Usage
==============
No licenses in use
Product Information
===================
UDI: PID:FPR9K-SUP,SN:JAD190800VU
Agent Version
=============
Smart Agent for Licensing: 1.6.7_rel/95
Verifique estos documentos:
Verifique este documento: Configuración de SNMP en dispositivos Firepower NGFW
Siga este documento: Instalación de un certificado de confianza para el administrador de chasis FXOS
Verifique estos documentos:
Para las plataformas FP41xx y FP93xx, utilice cualquiera de estos comandos:
FPR4115-2-1# connect fxos FPR4115-2-1(fxos)# show l2-table Ingress MAC Vlan Class VlanGrp Status Dst Eth1/1 78bc.1ae7.a45e 101 1 0 present 1 Veth776 78bc.1ae7.a45e 101 1 0 present 1 Po1 0100.5e00.0005 1001 1 0 present 1 Po1 0100.5e00.0006 1001 1 0 present 1 Po1 78bc.1ae7.a44e 1001 1 0 present 1 Po1 ffff.ffff.ffff 1001 63 0 present 1
FPR4115-2-1(fxos)# show mac address-table Legend: * - primary entry, G - Gateway MAC, (R) - Routed MAC, O - Overlay MAC age - seconds since first seen,+ - primary entry using vPC Peer-Link VLAN MAC Address Type age Secure NTFY Ports/SWID.SSID.LID ---------+-----------------+--------+---------+------+----+------------------ * 1001 0100.5e00.0005 static 0 F F Eth1/1 * 1001 0100.5e00.0006 static 0 F F Eth1/1 * 1001 78bc.1ae7.a44e static 0 F F Eth1/1 * 1001 ffff.ffff.ffff static 0 F F Eth1/1 * 101 78bc.1ae7.a45e static 0 F F Eth1/1 * 101 78bc.1ae7.a46f static 0 F F Veth776 * 4047 0015.a501.0100 static 0 F F Veth864 * 4047 0015.a501.0101 static 0 F F Veth1015 * 4043 78bc.1ae7.b000 static 0 F F Eth1/10 * 4043 78bc.1ae7.b00c static 0 F F Eth1/9 * 1 0015.a500.001f static 0 F F Veth887 * 1 0015.a500.002f static 0 F F Veth1018 * 1 0015.a500.01bf static 0 F F Veth905 * 1 0015.a500.01ef static 0 F F Veth1019
Utilice este comando:
FPR4115-2-1# connect fxos FPR4115-2-1(fxos)# show interface mac-address -------------------------------------------------------------------------------- Interface Mac-Address Burn-in Mac-Address -------------------------------------------------------------------------------- Ethernet1/1 78bc.1ae7.a417 78bc.1ae7.a418 Ethernet1/2 78bc.1ae7.a417 78bc.1ae7.a419 Ethernet1/3 78bc.1ae7.a417 78bc.1ae7.a41a Ethernet1/4 78bc.1ae7.a417 78bc.1ae7.a41b Ethernet1/5 78bc.1ae7.a417 78bc.1ae7.a41c Ethernet1/6 78bc.1ae7.a417 78bc.1ae7.a41d Ethernet1/7 78bc.1ae7.a417 78bc.1ae7.a41e Ethernet1/8 78bc.1ae7.a417 78bc.1ae7.a41f Ethernet1/9 78bc.1ae7.a417 78bc.1ae7.a420 Ethernet1/10 78bc.1ae7.a417 78bc.1ae7.a421 Ethernet1/11 78bc.1ae7.a417 78bc.1ae7.a422 Ethernet1/12 78bc.1ae7.a417 78bc.1ae7.a423 port-channel1 78bc.1ae7.a417 78bc.1ae7.a41a port-channel48 78bc.1ae7.a417 0000.0000.0000 mgmt0 78bc.1ae7.a411 78bc.1ae7.a411 Vethernet690 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet691 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet692 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet693 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet694 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet695 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet696 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet697 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet698 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet699 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet700 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet774 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet775 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet776 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet777 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet778 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet779 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet861 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet862 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet863 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet864 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet887 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet905 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet906 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet1015 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet1018 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet1019 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet1020 78bc.1ae7.a417 78bc.1ae7.a417 Vethernet1021 78bc.1ae7.a417 78bc.1ae7.a417
Para los procedimientos de recuperación de contraseña en FP41xx y FP9300, siga este documento: Procedimiento De Recuperación De Contraseña Para Dispositivos Firepower Serie 9300/4100
Para restablecer la contraseña del dispositivo lógico, necesita arrancar de nuevo el dispositivo. Con el proceso de recuperación ante desastres de Bootstrap, puede cambiar cualquiera de estos elementos:
Nota: El proceso de recuperación de bootstrap debe ejecutarse en una ventana de mantenimiento (MW) porque requiere una recarga de dispositivo lógico
Ejemplo 1
Puede utilizar la interfaz de usuario de FXOS para editar la configuración de bootstrap de un dispositivo lógico. Vaya a la pestaña Dispositivos lógicos, Editar un dispositivo
Establezca la contraseña:
Una vez que guarde este mensaje aparece:
Ejemplo 2
Este es un ejemplo de ASA enable password change/recovery:
FP4110-A# scope ssa
FP4110-A /ssa # show logical-device
Logical Device:
Name Description Slot ID Mode Oper State Templa te Name
---------- ----------- ---------- ---------- ------------------------ ------ -------
asa 1 Standalone Ok asa
FP4110-A /ssa # scope logical-device asa
FP4110-A /ssa/logical-device # scope mgmt-bootstrap asa
FP4110-A /ssa/logical-device/mgmt-bootstrap # show config
enter mgmt-bootstrap asa
create bootstrap-key-secret PASSWORD
! set value
exit
enter ipv4 1 default
set gateway 172.16.171.1
set ip 172.16.171.226 mask 255.255.255.0
exit
exit
FP4110-A /ssa/logical-device/mgmt-bootstrap # enter bootstrap-key-secret PASSWORD
FP4110-A /ssa/logical-device/mgmt-bootstrap/bootstrap-key-secret # set value
Value:
Warning: Bootstrap changes are not automatically applied to app-instances. To apply the changes, please do clear-mgmt-bootstrap, and restart each app-instance.
FP4110-A /ssa/logical-device/mgmt-bootstrap/bootstrap-key-secret* # commit-buffer
FP4110-A /ssa/logical-device/mgmt-bootstrap/bootstrap-key-secret # top
FP4110-A# scope ssa
FP4110-A /ssa # scope slot 1
FP4110-A /ssa/slot # scope app-instance asa
FP4110-A /ssa/slot/app-instance # clear-mgmt-bootstrap
Warning: Clears the application management bootstrap. Application needs to be restarted for this action to be effective.
FP4110-A /ssa/slot/app-instance* # commit-buffer
FP4110-A /ssa/slot/app-instance # restart
FP4110-A /ssa/slot/app-instance* # commit-buffer
Compruebe si el ASA está en línea antes de conectarse a él y utilice la nueva contraseña de activación.
FP4110-A /ssa/slot/app-instance # show Application Instance: App Name Admin State Oper State Running Version Startup Version Profile Name Cluster State Cluster Role ---------- ----------- ---------------- --------------- --------------- ------------ --------------- ------------ asa Enabled Online 9.9.1.76 9.9.1.76 Not Applicable None FP4110-A /ssa/slot/app-instance #
Siga este procedimiento:
FP4110-1-A# scope security FP4110-1-A /security # show local-user User Name First Name Last name --------------- --------------- --------- admin FP4110-1-A /security # enter local-user admin FP4110-1-A /security/local-user # set password Enter a password: Confirm the password: FP4110-1-A /security/local-user* # commit-buffer FP4110-1-A /security/local-user #
La degradación de las imágenes FXOS no se soporta oficialmente. El único método compatible con Cisco para degradar una versión de imagen de FXOS es realizar una reimagen completa del dispositivo. Esto se documenta en la ruta de actualización de Firepower 4100/9300
Para actualizar o actualizar la versión de ASA a través del administrador de chasis: Actualización de la Versión de Imagen para un Dispositivo Lógico
Para cambiar a través de CLI, siga esta sección de la guía de configuración: Actualización de la Versión de Imagen para un Dispositivo Lógico
Nota: Tan pronto como se confirma-buffer en la CLI, se reinicia el módulo. De manera similar en el administrador de chasis, una vez que se pulsa ok, se reinicia el módulo. No es necesario reiniciar manualmente.
La actualización se completa una vez que todos los componentes pasan al estado Preparado:
FP9300# scope system
FP9300 /system # show firmware monitor
FPRM:
Package-Vers: 2.0(1.37)
Upgrade-Status: Ready
Fabric Interconnect A:
Package-Vers: 2.0(1.23)
Upgrade-Status: Upgrading
Chassis 1:
Server 1:
Package-Vers: 2.0(1.23)
Upgrade-Status: Ready
Server 2:
Package-Vers: 2.0(1.23)
Upgrade-Status: Upgrading
Otros comandos útiles
FP9300 /firmware/auto-install # show fsm status FP9300 /firmware/auto-install # show fsm status expand
La verificación del tiempo de actividad de FXOS es útil en caso de que haya una pista FXOS. Puede ver el FXOS desde la interfaz de usuario (FCM) o desde la CLI:
FPR9K-1-A# connect fxos FPR9K-1-A(fxos)# show system uptime System start time: Sun Sep 25 09:57:19 2016 System uptime: 28 days, 9 hours, 38 minutes, 14 seconds Kernel uptime: 28 days, 9 hours, 38 minutes, 41 seconds Active supervisor uptime: 28 days, 9 hours, 38 minutes, 14 seconds
Además, para determinar la última razón de recarga utilice este comando:
FPR9K-1-A(fxos)# show system reset-reason
----- reset reason for Supervisor-module 1 (from Supervisor in slot 1) ---
1) At 212883 usecs after Fri Oct 21 22:34:35 2016
Reason: Kernel Panic
Service:
Version: 5.0(3)N2(3.02)
2) At 106690 usecs after Thu May 26 16:07:38 2016
Reason: Reset Requested by CLI command reload
Service:
Version: 5.0(3)N2(3.02)
Para el tiempo de actividad FPR2100, haga lo siguiente:
1. Consiga el paquete show tech-support fprm detail
2. Extraer el contenido del paquete
3. Verifique el archivo tmp/inventory_manager.xml
Hay una entrada que muestra el tiempo de actividad en segundos:
tmp/inventory_manager.xml:
<uptime>151</uptime>
También denominado "espacio de trabajo":
FPR9K-1-A# connect local-mgmt FPR9K-1-A(local-mgmt)# dir 1 29 Sep 25 09:56:22 2016 blade_debug_plugin 1 19 Sep 25 09:56:22 2016 bladelog 1 16 Aug 05 15:41:05 2015 cores 1 2841476 Apr 26 14:13:12 2016 d 2 4096 Dec 01 10:09:11 2015 debug_plugin/ 1 31 Aug 05 15:41:05 2015 diagnostics 1 2842049 Feb 23 03:26:38 2016 dp 1 18053120 Feb 23 11:10:19 2016 fpr9k-1-0-sam_logs_all.tar 1 18176000 Feb 23 11:10:43 2016 fpr9k-1-1-sam_logs_all.tar 1 19302400 Feb 23 11:11:07 2016 fpr9k-1-2-sam_logs_all.tar 1 16312320 Feb 23 11:06:53 2016 fpr9k-1-3-sam_logs_all.tar 1 2841476 Feb 22 18:47:00 2016 fxos-dplug.5.0.3.N2.3.13.67g.gSSA 2 4096 Aug 05 15:38:58 2015 lost+found/ 1 25 Dec 01 11:11:50 2015 packet-capture 1 18493440 Feb 23 10:44:51 2016 sam_logs_all.tar 2 4096 Sep 14 11:23:11 2016 techsupport/ Usage for workspace:// 4032679936 bytes total 324337664 bytes used 3503489024 bytes free
FPR9K-1-A(local-mgmt)# dir volatile:/ 1 66 Oct 27 08:17:48 2016 xmlout_5816 Usage for volatile:// 251658240 bytes total 4096 bytes used 251654144 bytes free
Para verificar el espacio libre de la memoria flash de inicio. Tenga en cuenta que este resultado también muestra el tamaño y el uso del espacio de trabajo:
FPR9K-1-A# scope fabric-interconnect a FPR9K-1-A /fabric-interconnect # show storage Storage on local flash drive of fabric interconnect: Partition Size (MBytes) Used Percentage ---------------- ---------------- --------------- bootflash 106490 9 opt 3870 2 spare 5767 1 usbdrive Nothing Empty workspace 3845 9
Utilice este comando:
FPR9K-1-A# connect local-mgmt FPR9K-1-A(local-mgmt)# erase configuration
Nota: Esto reinicia el sistema y borra toda la configuración, incluida la dirección IP de administración. Por lo tanto, asegúrese de que una consola esté conectada. Una vez que se reinicie el sistema, se ejecutará la aplicación de configuración y podrá volver a introducir la información de configuración de administración.
Ejemplo:
FPR9K-1# connect local-mgmt FPR9K-1(local-mgmt)# erase configuration All configurations will be erased and system will reboot. Are you sure? (yes/no): yes Removing all the configuration. Please wait.... /bin/rm: cannot remove directory `/bootflash/sysdebug//tftpd_logs': Device or resource busy sudo: cannot get working directory sudo: cannot get working directory Configurations are cleaned up. Rebooting.... ... System is coming up ... Please wait ... System is coming up ... Please wait ... 2016 Oct 28 06:31:00 %$ VDC-1 %$ %USER-0-SYSTEM_MSG: Starting bcm_attach - bcm_usd System is coming up ... Please wait ... 2016 Oct 28 06:31:06 %$ VDC-1 %$ %USER-0-SYSTEM_MSG: Finished bcm_attach... - bcm_usd 2016 Oct 28 06:31:07 %$ VDC-1 %$ %USER-0-SYSTEM_MSG: Enabling Filter on CPU port - bcm_usd System is coming up ... Please wait ... 2016 Oct 28 06:31:11 switch %$ VDC-1 %$ %VDC_MGR-2-VDC_ONLINE: vdc 1 has come online System is coming up ... Please wait ... nohup: appending output to `nohup.out' ---- Basic System Configuration Dialog ---- This setup utility will guide you through the basic configuration of the system. Only minimal configuration including IP connectivity to the Fabric interconnect and its clustering mode is performed through these steps. Type Ctrl-C at any time to abort configuration and reboot system. To back track or make modifications to already entered values, complete input till end of section and answer no when prompted to apply configuration. You have chosen to setup a new Security Appliance. Continue? (y/n):
FPR4100-3-A# scope ssa FPR4100-3-A /ssa # show configuration scope ssa enter logical-device FTD4150-3 ftd 1 standalone enter external-port-link Ethernet16_ftd Ethernet1/6 ftd set decorator "" set description "" set port-name Ethernet1/6 exit enter external-port-link Ethernet17_ftd Ethernet1/7 ftd set decorator "" set description "" set port-name Ethernet1/7 exit enter external-port-link Ethernet18_ftd Ethernet1/8 ftd set decorator "" set description "" set port-name Ethernet1/8 exit enter mgmt-bootstrap ftd enter bootstrap-key DNS_SERVERS set value 173.38.200.100 exit enter bootstrap-key FIREPOWER_MANAGER_IP set value 10.62.148.57 exit enter bootstrap-key FIREWALL_MODE set value routed exit enter bootstrap-key FQDN set value FTD4150-3.lab.com exit enter bootstrap-key SEARCH_DOMAINS set value lab.com exit enter bootstrap-key-secret PASSWORD ! set value exit enter bootstrap-key-secret REGISTRATION_KEY ! set value exit enter ipv4 1 firepower set gateway 10.62.148.1 set ip 10.62.148.89 mask 255.255.255.128 exit exit set description "" set res-profile-name "" exit scope slot 1 enter app-instance ftd enable set startup-version 6.0.1.1213 exit set log-level info exit scope app asa 100.15.17.33 set-default exit scope app ftd 6.0.1.1213 accept-license-agreement set-default exit exit
Esto equivale a:
Nota: Si desea ver toda la configuración de FXOS, agregue la palabra clave 'all' (el resultado es de varias páginas):
FPR4100-3-A /ssa # show configuration all
FPR4100-3-A# scope eth-uplink
FPR4100-3-A /eth-uplink # scope fabric a
FPR4100-3-A /eth-uplink/fabric # show interface Interface: Port Name Port Type Admin State Oper State State Reason --------------- ------------------ ----------- ---------------- ------------ Ethernet1/1 Data Disabled Admin Down Administratively down Ethernet1/2 Data Disabled Admin Down Administratively down Ethernet1/3 Data Disabled Admin Down Administratively down Ethernet1/4 Data Disabled Sfp Not Present Unknown Ethernet1/5 Data Disabled Admin Down Administratively down Ethernet1/6 Data Enabled Up Ethernet1/7 Mgmt Enabled Up Ethernet1/8 Data Enabled Up FPR4100-3-A /eth-uplink/fabric #
Lo anterior equivale a:
FPR9K-2-A# connect fxos FPR9K-2-A(fxos)# show system resources Load average: 1 minute: 1.60 5 minutes: 1.30 15 minutes: 1.15 Processes : 967 total, 1 running CPU states : 1.8% user, 1.1% kernel, 97.1% idle Memory usage: 16326336K total, 4359740K used, 11966596K free
Nota: El total mostrado en la salida puede ser diferente incluso para 2 dispositivos que pertenecen al mismo modelo. Específicamente, el total se toma de la salida del comando free que a su vez se toma de /proc/meminfo.
Para verificar la memoria:
FPR4100-8-A /fabric-interconnect # show detail Fabric Interconnect: ID: A Product Name: Cisco FPR-4140-SUP PID: FPR-4140-SUP VID: V02 Vendor: Cisco Systems, Inc. Serial (SN): FLM12345KL6 HW Revision: 0 Total Memory (MB): 8074 OOB IP Addr: 10.62.148.196 OOB Gateway: 10.62.148.129 OOB Netmask: 255.255.255.128 OOB IPv6 Address: :: OOB IPv6 Gateway: :: Prefix: 64 Operability: Operable Thermal Status: Ok Current Task 1: Current Task 2: Current Task 3:
Para verificar la comprobación de uso de memoria por proceso (RES = Memoria física):
FPR4100-2-A-A# connect local-mgmt FPR4100-2-A-A(local-mgmt)# show processes Cpu(s): 8.0%us, 4.2%sy, 3.9%ni, 83.8%id, 0.0%wa, 0.0%hi, 0.1%si, 0.0%st Mem: 8267648k total, 3866552k used, 4401096k free, 288k buffers Swap: 0k total, 0k used, 0k free, 1870528k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 5024 root -2 0 354m 114m 34m R 43 1.4 7976:51 /isan/bin/bcm_usd 1096 root 20 0 10352 3992 3332 S 0 0.0 0:00.28 sshd: admin@pts/1 1140 root 20 0 117m 78m 53m S 0 1.0 0:00.42 /isan/bin/ucssh --ucs-mgmt -p admin 1856 root 20 0 2404 632 512 S 0 0.0 2:29.32 /nuova/bin/cmcmon -f /etc/cmcmon.conf 1859 root 20 0 23804 1932 1532 S 0 0.0 1427:47 dmserver -F 1860 root 20 0 2244 472 404 S 0 0.0 0:00.01 /sbin/hotplug2 --persistent --set-rules-file /etc/automount.rules --set-worker /lib/worker_single.so 1861 root 20 0 57116 10m 6552 S 0 0.1 7:28.76 /isan/sbin/sysmgr -V 1864 root 20 0 14044 4136 1072 S 0 0.1 1:06.19 rsyslogd -c3 -i/var/run/rsyslogd.pid 4909 root 20 0 3568 1100 876 S 0 0.0 0:00.48 /isan/sbin/xinetd -syslog local7 -loop 250 -stayalive -reuse -dontfork 4911 root 20 0 58232 12m 6152 S 0 0.2 18:39.24 /isan/sbin/syslogd -d -n -m 0 -r 4912 root 20 0 20076 3532 2368 S 0 0.0 0:00.02 /isan/bin/sdwrapd 4913 root 21 1 2756 300 192 S 0 0.0 0:00.04 /usr/sbin/in.tftpd -l -c -s /bootflash 4914 root 20 0 58312 17m 8724 S 0 0.2 13:45.34 /isan/bin/pfm 4937 root 20 0 2208 332 272 S 0 0.0 0:00.01 /sbin/klogd -2 -x -c 1 4939 root 20 0 26692 4656 3620 S 0 0.1 0:24.01 /isan/bin/vshd
...
Consejo:
1. Recopile la salida de memoria show process
2. Pegue el resultado en un archivo en una máquina Linux (cat > top.log)
3. Ordenar el archivo según la columna RES
Esto le muestra los GBytes, por encima de los MBytes, etc.
mzafeiro@MZAFEIRO-JA2YS:$ cat top.log | sort -V -k 6 1954 root 20 0 1645m 1.6g 1372 S 0.0 20.7 793:32.99 dmserver 7556 root 20 0 207m 9.8m 6184 S 0.0 0.1 73:52.25 udld 5563 root 20 0 333m 9.8m 7032 S 0.0 0.1 5:08.65 cdpd 5523 root 20 0 327m 103m 28m S 0.0 1.3 0:12.38 afm 24040 daemon 23 3 592m 115m 33m S 0.0 1.5 74:56.57 httpd 5329 root -2 0 384m 132m 29m S 9.4 1.7 27130:09 bcm_usd 5317 root 20 0 401m 150m 35m S 0.0 1.9 33:19.05 fwm 5625 root 24 4 450m 179m 35m S 0.0 2.3 275:38.25 svc_sam_statsAG 5614 root 23 3 495m 247m 54m S 0.0 3.2 355:59.95 svc_sam_dme 21688 root 20 0 2672 1080 880 S 0.0 0.0 3:15.29 ntpd 8819 root 35 15 2408 1084 748 R 5.6 0.0 0:00.06 top
Utilice este comando:
FPR9K-2-A# connect fxos FPR9K-2-A(fxos)# show interface e1/3 transceiver details Ethernet1/3 transceiver is present type is 1000base-T name is CISCO-METHODE part number is SP7041-R revision is serial number is FLM12345KL6 nominal bitrate is 1300 MBit/sec Link length supported for copper is 100 m cisco id is -- cisco extended id number is 4 DOM is not supported FPR9K-2-A(fxos)#
En el caso de la fibra, la salida es:
FPR4100-1-A(fxos)# show interface e1/1 transceiver details Ethernet1/1 transceiver is present type is 10Gbase-SR name is CISCO-JDSU part number is PLRXPL-SC-S43-CS revision is 1 serial number is FLM12345KL6 nominal bitrate is 10300 MBit/sec Link length supported for 50/125um OM2 fiber is 82 m Link length supported for 62.5/125um fiber is 26 m Link length supported for 50/125um OM3 fiber is 300 m cisco id is -- cisco extended id number is 4 Calibration info not available
Este comando muestra la ID de producto (PID) y el número de serie (SN) del chasis y los módulos (Netmods)
FP4110-7-A# connect fxos
FP4110-7-A(fxos)# show inventory NAME: "Chassis", DESCR: "Firepower 41xx Security Appliance" PID: FPR-4110-SUP , VID: V02 , SN: FLM12345KL6 <--- Chassis SN NAME: "Module 1", DESCR: "Firepower 41xx Supervisor" PID: FPR-4110-SUP , VID: V02 , SN: FLM12345KL6 <--- Embedded module on FPR4100 NAME: "Module 3", DESCR: "Firepower 6x10G FTW SFP+ SR NM" PID: FPR-NM-6X10SR-F , VID: V00 , SN: FLM12345KL6 <--- FTW Netmode SN
FPR4110 tiene 2 ranuras para los módulos de red (2 y 3) y el dispositivo en el ejemplo tiene un Netmod FTW instalado en el slot 3.
FPR9K-1-A# scope chassis 1 FPR9K-1-A /chassis # show inventory server Chassis 1: Servers: Server 1/1: Equipped Product Name: Cisco Firepower 9000 Series High Performance Security Module Equipped PID: FPR9K-SM-36 Equipped VID: V01 Equipped Serial (SN): FLM12345KL6 Slot Status: Equipped Acknowledged Product Name: Cisco Firepower 9000 Series High Performance Security Module Acknowledged PID: FPR9K-SM-36 Acknowledged VID: V01 Acknowledged Serial (SN): FLM12345KL6 Acknowledged Memory (MB): 262144 Acknowledged Effective Memory (MB): 262144 Acknowledged Cores: 36 Acknowledged Adapters: 2 Server 1/2: Equipped Product Name: Cisco Firepower 9000 Series High Performance Security Module Equipped PID: FPR9K-SM-36 Equipped VID: V01 Equipped Serial (SN): FLM12345KL6 Slot Status: Equipped Acknowledged Product Name: Cisco Firepower 9000 Series High Performance Security Module Acknowledged PID: FPR9K-SM-36 Acknowledged VID: V01 Acknowledged Serial (SN): FLM12345KL6 Acknowledged Memory (MB): 262144 Acknowledged Effective Memory (MB): 262144 Acknowledged Cores: 36 Acknowledged Adapters: 2 Server 1/3: Equipped Product Name: Cisco Firepower 9000 Series High Performance Security Module Equipped PID: FPR9K-SM-36 Equipped VID: V01 Equipped Serial (SN): FLM12345KL6 Slot Status: Equipped Acknowledged Product Name: Cisco Firepower 9000 Series High Performance Security Module Acknowledged PID: FPR9K-SM-36 Acknowledged VID: V01 Acknowledged Serial (SN): FLM12345KL6 Acknowledged Memory (MB): 262144 Acknowledged Effective Memory (MB): 262144 Acknowledged Cores: 36 Acknowledged Adapters: 2
Servidor1/1 = módulo/blade 1
Servidor1/2 = módulo/blade 2
Servidor1/3 = módulo/blade 3
PID modelo FPR41xx:
También puede obtener otra información en scope server <chassis-id/blade-id>:
FP9300-A# scope server 1/1
FP9300-A /chassis/server # show inventory
<CR>
> Redirect it to a file
>> Redirect it to a file in append mode
adapter Adapter
bios Bios
board Board
cpu Cpu
detail Detail
expand Expand
memory Memory
mgmt Mgmt
storage Storage
| Pipe command output to filter
FP9300-A /chassis/server # show inventory storage
Server 1/1:
Name:
User Label:
Equipped PID: FPR9K-SM-36
Equipped VID: V01
Equipped Serial (SN): FLM12345PBD
Slot Status: Equipped
Acknowledged Product Name: Cisco Firepower 9000 Series High Performance Security Module
Acknowledged PID: FPR9K-SM-36
Acknowledged VID: 01
Acknowledged Serial (SN): FLM67890PBD
Acknowledged Memory (MB): 262144
Acknowledged Effective Memory (MB): 262144
Acknowledged Cores: 36
Acknowledged Adapters: 2
Motherboard:
Product Name: Cisco Firepower 9000 Series High Performance Security Module
PID: FPR9K-SM-36
VID: V01
Vendor: Cisco Systems Inc
Serial (SN): FLM12345KL6
HW Revision: 0
RAID Controller 1:
Type: SAS
Vendor: Cisco Systems Inc
Model: UCSB-MRAID12G
Serial: FLM12345KL6
HW Revision: C0
PCI Addr: 01:00.0
Raid Support: RAID0, RAID1
OOB Interface Supported: Yes
Rebuild Rate: 30
Controller Status: Optimal
Local Disk 1:
Product Name:
PID:
VID:
Vendor: TOSHIBA
Model: PX02SMF080
Vendor Description:
Serial: FLM12345KL6
HW Rev: 0
Block Size: 512
Blocks: 1560545280
Operability: Operable
Oper Qualifier Reason: N/A
Presence: Equipped
Size (MB): 761985
Drive State: Online
Power State: Active
Link Speed: 12 Gbps
Device Type: SSD
Local Disk 2:
Product Name:
PID:
VID:
Vendor: TOSHIBA
Model: PX02SMF080
Vendor Description:
Serial: FLM12345KL6
HW Rev: 0
Block Size: 512
Blocks: 1560545280
Operability: Operable
Oper Qualifier Reason: N/A
Presence: Equipped
Size (MB): 761985
Drive State: Online
Power State: Active
Link Speed: 12 Gbps
Device Type: SSD
Local Disk Config Definition:
Mode: RAID 1 Mirrored
Description:
Protect Configuration: Yes
Virtual Drive 0:
Type: RAID 1 Mirrored
Block Size: 512
Blocks: 1560545280
Operability: Operable
Presence: Equipped
Size (MB): 761985
Lifecycle: Allocated
Drive State: Optimal
Strip Size (KB): 64
Access Policy: Read Write
Read Policy: Normal
Configured Write Cache Policy: Write Through
Actual Write Cache Policy: Write Through
IO Policy: Direct
Drive Cache: No Change
Bootable: True
FP9300-A /chassis/server #
Tenga en cuenta que en las plataformas FP41xx, dado que no están usando RAID, el show Inventory Storage muestra el Estado del controlador como Desconocido. La razón principal por la que no son RAID es que la segunda SSD se utiliza para otras funciones como MSP (paquete de almacenamiento de malware) en un dispositivo lógico FTD.
Desde la GUI de FCM
Para eliminar de la GUI, navegue hasta System > Updates y elimine la imagen:
Desde FXOS CLI
FPR4100# scope ssa FPR4100 /ssa # show app Application: Name Version Description Author Deploy Type CSP Type Is Default App ------ ---------- ----------- ---------- ----------- ----------- -------------- asa 9.6.1 N/A cisco Native Application Yes ftd 6.0.1.1213 N/A cisco Native Application No ftd 6.1.0.330 N/A cisco Native Application Yes FPR4100 /ssa # delete app asa 9.6.1 FPR4100 /ssa* # commit FPR4100 /ssa # show app Application: Name Version Description Author Deploy Type CSP Type Is Default App ---------- ---------- ----------- ---------- ----------- ----------- -------------- ftd 6.0.1.1213 N/A cisco Native Application No ftd 6.1.0.330 N/A cisco Native Application Yes
Hay algunas maneras de hacerlo.
Vía 1
FPR4100# show fabric-interconnect firmware Fabric Interconnect A: Running-Kern-Vers: 5.0(3)N2(4.01.65) Running-Sys-Vers: 5.0(3)N2(4.01.65) Package-Vers: 2.0(1.86) Startup-Kern-Vers: 5.0(3)N2(4.01.65) Startup-Sys-Vers: 5.0(3)N2(4.01.65) Act-Kern-Status: Ready Act-Sys-Status: Ready Bootloader-Vers:
Esto es lo mismo que se puede ver en la GUI de FCM:
Vía 2
FP4145-1# show version Version: 2.6(1.192) Startup-Vers: 2.6(1.192)
El chasis Firepower 4100/9300 admite tramas gigantes habilitadas de forma predeterminada. Puede verificar la interfaz MTU con este comando:
FPR9K-1-A# connect fxos
FPR9K-1-A(fxos)# show hardware internal bcm-usd info phy-info all +-----------------+------------------------------------------------------------+ | port phy info | +-----------------+------------------------------------------------------------+ front-port : 1 asic-port : 125 sfp installed : yes enable : ena speed : 1G autoneg : on interface : (10)XFI duplex: half linkscan : sw pause_tx : 0x0 pause_rx : 0x0 max frame : 9216 local_advert : 0x20 remote_advert : 0x420 port_40g_enable : 0 local_fault : 0x1 remote_fault : 0x0 xcvr sfp type : (1)PHY_SFP_1G_COPPER TSC4 registers: txfir(0xc252):0x0000 txdrv(0xc017):0x0000 lane(0x9003):0x1b1b Asic 56846 Registers signal_detect(1.0x81d0):0x0000 link_status(1.0x81d1):0x0000 rx_link_state(1.0x0):0x0000 pcs_rx_tx_fault(1.0x0008):0x0000 pcs_block_status_0x20(1.0x20) :0x0000 pcs_block_status_0x21(1.0x021) : 0x0000 transmitter_reg(1.0x8000):0x0000 micro_ver(1.0x81f0):0x0000
Desde la CLI del chasis, utilice el comando scope ssa y luego show slot extend detail
Se puede encontrar la misma información en el archivo sam_techsupportinfo dentro del chasis show tech bundle.
`scope ssa` `show slot expand detail` Slot: Slot ID: 1 Log Level: Info Admin State: Ok Operational State: Online Disk State: Ok Clear Log Data: Available Application Instance: Application Name: asa Admin State: Enabled Operational State: Online Running Version: 9.6.2 Startup Version: 9.6.2 Hotfixes: Externally Upgraded: No Cluster Oper State: Not Applicable Current Job Type: Start Current Job Progress: 100 Current Job State: Succeeded Clear Log Data: Available Error Msg: Current Task: App Attribute: App Attribute Key: mgmt-ip Value: 0.0.0.0 App Attribute Key: mgmt-url Value: https://0.0.0.0/ Heartbeat: Last Received Time: 2017-03-15T10:25:02.220 Heartbeat Interval: 1 Max Number of Missed heartbeats Permitted: 3 Resource: Allocated Core NR: 46 Allocated RAM (KB): 233968896 Allocated Data Disk (KB): 20971528 Allocated Binary Disk (KB): 174964 Allocated Secondary Disk (KB): 0 Heartbeat: Last Received Time: 2017-03-15T10:25:00.447 Heartbeat Interval: 5 Max Number of Missed heartbeats Permitted: 3 Monitor: OS Version: 9.6(1.150) CPU Total Load 1 min Avg: 48.110001 CPU Total Load 5 min Avg: 48.110001 CPU Total Load 15 min Avg: 48.110001 Memory Total (KB): 264377600 Memory Free (KB): 236835112 Memory Used (KB): 27542488 Memory App Total (KB): 233968896 Disk File System Count: 5 Blade Uptime: up 1 day, 6:56 Last Updated Timestamp: 2017-03-15T10:24:10.306 Disk File System: File System: /dev/sda1 Mount Point: /mnt/boot Disk Total (KB): 7796848 Disk Free (KB): 7694456 Disk Used (KB): 102392 File System: /dev/sda2 Mount Point: /opt/cisco/config Disk Total (KB): 1923084 Disk Free (KB): 1734420 Disk Used (KB): 90976 File System: /dev/sda3 Mount Point: /opt/cisco/platform/logs Disk Total (KB): 4805760 Disk Free (KB): 4412604 Disk Used (KB): 149036 File System: /dev/sda5 Mount Point: /var/data/cores Disk Total (KB): 48061320 Disk Free (KB): 43713008 Disk Used (KB): 1906892 File System: /dev/sda6 Mount Point: /opt/cisco/csp Disk Total (KB): 716442836 Disk Free (KB): 714947696 Disk Used (KB): 1495140
Comandos de verificación de Port-Channel
Comprobación 1
Para verificar qué canales de puerto están configurados actualmente en el chasis:
FPR9K-1-A# connect fxos
FPR9K-1-A(fxos)# show port-channel summary Flags: D - Down P - Up in port-channel (members) I - Individual H - Hot-standby (LACP only) s - Suspended r - Module-removed S - Switched R - Routed U - Up (port-channel) M - Not in use. Min-links not met -------------------------------------------------------------------------------- Group Port- Type Protocol Member Ports Channel -------------------------------------------------------------------------------- 11 Po11(SU) Eth LACP Eth1/4(P) Eth1/5(P) 15 Po15(SD) Eth LACP Eth1/6(D) 48 Po48(SU) Eth LACP Eth1/2(P) Eth1/3(P)
Comprobación 2
Para verificar los Port-Channels asignados a un dispositivo lógico:
FPR9K-1-A# scope ssa FPR9K-1-A /ssa # show configuration scope ssa enter logical-device ftd_682021968 ftd "1,2,3" clustered enter cluster-bootstrap set chassis-id 1 set ipv4 gateway 0.0.0.0 set ipv4 pool 0.0.0.0 0.0.0.0 set ipv6 gateway :: set ipv6 pool :: :: set virtual ipv4 0.0.0.0 mask 0.0.0.0 set virtual ipv6 :: prefix-length "" ! set key set mode spanned-etherchannel set name 682021968 set site-id 0 exit enter external-port-link Ethernet11_ftd Ethernet1/1 ftd set decorator "" set description "" set port-name Ethernet1/1 exit enter external-port-link PC11_ftd Port-channel11 ftd set decorator "" set description "" set port-name Port-channel11 exit enter external-port-link PC48_ftd Port-channel48 ftd set decorator "" set description "" set port-name Port-channel48 exit
Comprobación 3
Para verificar las estadísticas de tráfico de canal de puerto por puerto:
FPR9K-1-A(fxos)# show port-channel traffic interface port-channel 11 ChanId Port Rx-Ucst Tx-Ucst Rx-Mcst Tx-Mcst Rx-Bcst Tx-Bcst ------ --------- ------- ------- ------- ------- ------- ------- 11 Eth1/4 62.91% 0.0% 58.90% 49.99% 100.00% 0.0% 11 Eth1/5 37.08% 0.0% 41.09% 50.00% 0.0% 0.0%
Comprobación 4
Para verificar los detalles de un canal de puerto específico:
FPR9K-1-A(fxos)# show port-channel database interface port-channel 11 port-channel11 Last membership update is successful 2 ports in total, 2 ports up First operational port is Ethernet1/4 Age of the port-channel is 0d:20h:26m:27s Time since last bundle is 0d:18h:29m:07s Last bundled member is Ethernet1/5 Ports: Ethernet1/4 [active ] [up] * Ethernet1/5 [active ] [up]
Comprobación 5
Para verificar el ID del sistema local LACP:
FPR9K-1-A(fxos)# show lacp system-identifier 32768,b0-aa-77-2f-81-bb
Comprobación 6
Para verificar el ID del sistema LACP de los dispositivos ascendentes junto con los indicadores de estado LACP:
FPR9K-1-A(fxos)# show lacp neighbor Flags: S - Device is sending Slow LACPDUs F - Device is sending Fast LACPDUs A - Device is in Active mode P - Device is in Passive mode port-channel11 neighbors Partner's information Partner Partner Partner Port System ID Port Number Age Flags Eth1/4 32768,4-62-73-d2-65-0 0x118 66828 FA LACP Partner Partner Partner Port Priority Oper Key Port State 32768 0xb 0x3d Partner's information Partner Partner Partner Port System ID Port Number Age Flags Eth1/5 32768,4-62-73-d2-65-0 0x119 66826 FA LACP Partner Partner Partner Port Priority Oper Key Port State 32768 0xb 0x3d
Comprobación 7
Para comprobar el historial de eventos de Port-Channel:
FPR9K-1-A(fxos)# show port-channel internal event-history all Low Priority Pending queue: len(0), max len(1) [Thu Apr 6 11:07:48 2017] High Priority Pending queue: len(0), max len(16) [Thu Apr 6 11:07:48 2017] PCM Control Block info: pcm_max_channels : 4096 pcm_max_channel_in_use : 48 pc count : 3 hif-pc count : 0 Max PC Cnt : 104 Load-defer timeout : 120 ==================================================== PORT CHANNELS: 2LvPC PO in system : 0 port-channel11 channel : 11 bundle : 65535 ifindex : 0x1600000a admin mode : active oper mode : active fop ifindex : 0x1a003000 nports : 2 active : 2 pre cfg : 0 ltl : 0x0 (0) lif : 0x0 iod : 0x78 (120) global id : 3 flag : 0 lock count : 0 num. of SIs: 0 ac mbrs : 0 0 lacp graceful conv disable : 0 lacp suspend indiv disable : 1 pc min-links : 1 pc max-bundle : 16 pc max active members : 32 pc is-suspend-minlinks : 0 port load defer enable : 0 lacp fast-select-hot-standby disable : 0 ethpm bundle lock count : 0 bundle res global id : 2 Members: Ethernet1/4 [bundle_no = 0] Ethernet1/5 [bundle_no = 0] port-channel external lock: Lock Info: resource [eth-port-channel 11] type[0] p_gwrap[(nil)] FREE @ 246108 usecs after Wed Apr 5 14:18:10 2017 type[1] p_gwrap[(nil)] FREE @ 436471 usecs after Wed Apr 5 16:15:30 2017 type[2] p_gwrap[(nil)] FREE @ 436367 usecs after Wed Apr 5 16:15:30 2017 0x1600000a internal (ethpm bundle) lock: Lock Info: resource [eth-port-channel 11] type[0] p_gwrap[(nil)] FREE @ 246083 usecs after Wed Apr 5 14:18:10 2017 type[1] p_gwrap[(nil)] FREE @ 610546 usecs after Wed Apr 5 16:19:04 2017 type[2] p_gwrap[(nil)] FREE @ 610437 usecs after Wed Apr 5 16:19:04 2017 0x1600000a >>>>FSM: <eth-port-channel 11> has 194 logged transitions<<<<< 1) FSM:Transition at 557291 usecs after Wed Apr 5 16:04:27 2017 Previous state: [PCM_PC_ST_WAIT_REL_RESRC] Triggered event: [PCM_PC_EV_REL_RESRC_DONE] Next state: [PCM_PC_ST_INIT] 2) FSM: Transition at 49036 usecs after Wed Apr 5 16:07:18 2017 Previous state: [PCM_PC_ST_INIT] Triggered event: [PCM_PC_EV_L2_CREATE] Next state: [PCM_PC_ST_WAIT_CREATE] 3) FSM: Transition at 49053 usecs after Wed Apr 5 16:07:18 2017 Previous state: [PCM_PC_ST_WAIT_CREATE] Triggered event: [PCM_PC_EV_L2_CREATED] Next state: [PCM_PC_ST_CREATED]
Comprobación 8
debug lacp all produce un resultado muy grande:
FPR9K-1-A(fxos)# debug lacp all
2017 Jul 11 10:42:23.854160 lacp: lacp_pkt_parse_pdu(569): lacp_pkt_parse_pdu: got packet from actorport=220a partnerport= 43 2017 Jul 11 10:42:23.854177 lacp: lacp_pkt_compute_port_params(1163): Ethernet1/3(0x1a002000): pa aggregatable state=1 ac aggregatable state=1 pkt sync=1 port_stateactive=1 2017 Jul 11 10:42:23.854190 lacp: lacp_pkt_compute_port_params(1170): p_el=(8000, 2-0-0-0-0-1, 136, 8000, 220a) 2017 Jul 11 10:42:23.854198 lacp: lacp_pkt_compute_port_params(1172): p_el_pkt=(8000, 2-0-0-0-0-1, 136, 8000, 220a) 2017 Jul 11 10:42:23.854207 lacp: lacp_utils_get_obj_type_from_ifidx(390): lacp_utils_get_obj_type_from_ifidx: For if-index 1a002000 , if_type =26 2017 Jul 11 10:42:23.854218 lacp: Malloc in fu_fsm_event_new@../utils/fsmutils/fsm.c[5317]-ty[1]0x9bf719c[124] 2017 Jul 11 10:42:23.854228 lacp: lacp_utils_cr_fsm_event(572): Called from lacp_utils_create_fsm_event_with_params: Create event 0x9bf719c 2017 Jul 11 10:42:23.854237 lacp: Malloc in fu_fsm_event_pair_new@../utils/fsmutils/fsm.c[5327]-ty[2]0x9bf730c[132] 2017 Jul 11 10:42:23.854248 lacp: fu_fsm_execute_all: match_msg_id(0), log_already_open(0) 2017 Jul 11 10:42:23.854257 lacp: Malloc in fu_fsm_event_new@../utils/fsmutils/fsm.c[5317]-ty[1]0x9bf719c[124] 2017 Jul 11 10:42:23.854268 lacp: fu_fsm_execute: (Ethernet1/3) 2017 Jul 11 10:42:23.854275 lacp: current state [LACP_ST_PORT_MEMBER_COLLECTING_AND_DISTRIBUTING_ENABLED] 2017 Jul 11 10:42:23.854283 lacp: current event [LACP_EV_PARTNER_PDU_IN_SYNC_COLLECT_ENABLED_DISTRIBUTING_ENABLED] 2017 Jul 11 10:42:23.854291 lacp: next state [FSM_ST_NO_CHANGE] 2017 Jul 11 10:42:23.854304 lacp: lacp_proto_get_state(969): IF Ethernet1/3(0x1a002000): end PartnerEnd(2): state TimeOut(1): enable_flag False 2017 Jul 11 10:42:23.854314 lacp: lacp_proto_record_pdu(2266): Recording PDU for LACP pkt on IF Ethernet1/3(0x1a002000) 2017 Jul 11 10:42:23.854325 lacp: lacp_proto_set_state(900): IF Ethernet1/3(0x1a002000): Set end ActorEnd(1): state Defaulted(6) from False to False 2017 Jul 11 10:42:23.854335 lacp: lacp_proto_get_state(969): IF Ethernet1/3(0x1a002000): end PartnerEnd(2): state TimeOut(1): enable_flag False 2017 Jul 11 10:42:23.854344 lacp: lacp_proto_update_ntt(2211): updateNTT called for IF Ethernet1/3(0x1a002000) 2017 Jul 11 10:42:23.854355 lacp: lacp_proto_get_state(969): IF Ethernet1/3(0x1a002000): end ActorEnd(1): state TimeOut(1): enable_flag True 2017 Jul 11 10:42:23.854362 lacp: lacp_timer_start_w_chgd_time(681): lacp_timer_start_w_chgd_time: starting timer with time in ms = 15000 2017 Jul 11 10:42:23.854377 lacp: lacp_timer_start(637): Timer Started: Timer_Arg ([rid type IF-Rid: ifidx 0x1a002000: ch_num 0: event_id LACP_EV_RECEIVE_PARTNER_PDU_TIMED_OUT(17): timer_id 426092: type PartnerTimedOut: active True: period_in_ms 15000]) 2017 Jul 11 10:42:23.854386 lacp: lacp_timer_start(638): Timer period=15 seconds 2017 Jul 11 10:42:23.854396 lacp: Free ptr in fu_fsm_execute@../utils/fsmutils/fsm.c[1091] for addr 0x9bf719c 2017 Jul 11 10:42:23.854408 lacp: fu_fsm_execute_all: done processing event LACP_EV_PARTNER_PDU_IN_SYNC_COLLECT_ENABLED_DISTRIBUTING_ENABLED 2017 Jul 11 10:42:23.854419 lacp: fu_mts_drop ref 0x9bf7320 opc 90117 2017 Jul 11 10:42:23.854434 lacp: fu_fsm_execute_all: MTS_OPC_NET_L2_RX_DATA_HDR(msg_id 2623696) dropped 2017 Jul 11 10:42:23.854445 lacp: fu_fsm_engine_post_event_processing 2017 Jul 11 10:42:23.854453 lacp: end of while in fu_fsm_engine 2017 Jul 11 10:42:23.854461 lacp: fu_handle_process_hot_plugin_msg: Entered the function line 143 2017 Jul 11 10:42:23.854468 lacp: begin fu_fsm_engine: line[2357] 2017 Jul 11 10:42:24.361501 lacp: lacp_pkt_encode_pdu_helper(770): lacp_pkt_encode_pdu_helper: pkt_len=LACP_PDU_LEN=110 periodic_rate:1 2017 Jul 11 10:42:24.361530 lacp: lacp_pkt_encode_pdu_helper(797): lacp_pkt_encode_pdu_helper: if_idx=Ethernet1/3(0x1a002000) partner-mac=0-a6-ca-f3-c7-83 port_num=43 2017 Jul 11 10:42:24.361542 lacp: lacp_debug_wrapper_tl(1718): Executing [mcecm_api_is_pc_mcec] 2017 Jul 11 10:42:24.361551 lacp: lacp_debug_wrapper_tl(1718): input: if_index = [0x16000000] 2017 Jul 11 10:42:24.361559 lacp: lacp_debug_wrapper_tl(1718): Executing [mcecm_cache_is_pc_mcec] 2017 Jul 11 10:42:24.361568 lacp: lacp_debug_wrapper_tl(1718): output:0 2017 Jul 11 10:42:24.361589 lacp: lacp_pkt_encode_pdu_helper(842): 0x1a002000: Set short_timeout to periodic_rate:1 2017 Jul 11 10:42:24.361599 lacp: lacp_pkt_encode_pdu_helper(879): lacp_pkt_encode_pdu_helper: actor-port-state=3f agg=1 insync=1 coll=1 dis=1 active=1 short_timeout=1 2017 Jul 11 10:42:24.361612 lacp: lacp_pkt_encode_pdu_helper(906): lacp_pkt_encode_pdu_helper: if_idx=Ethernet1/3(0x1a002000) partner-port-state=3d agg=1 insync=1 coll=1 dis=1 active=1 short-timeout=0 2017 Jul 11 10:42:24.361624 lacp: lacp_pkt_encode_pdu_helper(910): lacp_pkt_encode_pdu_helper: if_idx=Ethernet1/3(0x1a002000) partner-mac=2-0-0-0-0-1 port_num=220a 2017 Jul 11 10:42:24.361636 lacp: lacp_net_tx_data(206): lacp_net_tx_data: Sending buffer with length 110 2017 Jul 11 10:42:24.361648 lacp: lacp_net_tx_data(215): 01 01 01 14 ffff 2017 Jul 11 10:42:24.361658 lacp: lacp_net_tx_data(215): ffff 2017 Jul 11 10:42:24.361668 lacp: lacp_net_tx_data(215): 00 00 00 02 14 ffff 2017 Jul 11 10:42:24.361678 lacp: lacp_net_tx_data(215): ffff 2017 Jul 11 10:42:24.361689 lacp: lacp_net_tx_data(215): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2017 Jul 11 10:42:24.361700 lacp: lacp_net_tx_data(215): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2017 Jul 11 10:42:24.361710 lacp: lacp_net_tx_data(215): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2017 Jul 11 10:42:24.361721 lacp: lacp_net_tx_data(247): Ethernet1/3(0x1a002000): Tx LACP PDU len: 110 As:3f, Ps:3d 2017 Jul 11 10:42:24.361753 lacp: lacp_proto_get_state(969): IF Ethernet1/3(0x1a002000): end PartnerEnd(2): state TimeOut(1): enable_flag False 2017 Jul 11 10:42:24.361764 lacp: lacp_proto_restart_tx_timer(1802): lacp_proto_restart_tx_timer: got enable flag=0 before sending on interface Ethernet1/3(0x1a002000) 2017 Jul 11 10:42:24.361773 lacp: lacp_proto_restart_tx_timer(1825): lacp_proto_restart_tx_timer: flag 0 interface Ethernet1/3(0x1a002000) periodic_timer is fast 2017 Jul 11 10:42:24.361782 lacp: lacp_timer_start_w_chgd_time(681): lacp_timer_start_w_chgd_time: starting timer with time in ms = 1000 2017 Jul 11 10:42:24.361798 lacp: lacp_timer_start(637): Timer Started: Timer_Arg ([rid type IF-Rid: ifidx 0x1a002000: ch_num 0: event_id LACP_EV_PERIODIC_TRANSMIT_TIMER_EXPIRED(19): timer_id 400214: type PDUSendTime: active True: period_in_ms 1000]) 2017 Jul 11 10:42:24.361807 lacp: lacp_timer_start(638): Timer period=1 seconds 2017 Jul 11 10:42:24.361820 lacp: lacp_pkt_encode_pdu_helper(770): lacp_pkt_encode_pdu_helper: pkt_len=LACP_PDU_LEN=110 periodic_rate:1 2017 Jul 11 10:42:24.361833 lacp: lacp_pkt_encode_pdu_helper(797): lacp_pkt_encode_pdu_helper: if_idx=Ethernet1/4(0x1a003000) partner-mac=0-a6-ca-f3-c7-83 port_num=44 2017 Jul 11 10:42:24.361841 lacp: lacp_debug_wrapper_tl(1718): Executing [mcecm_api_is_pc_mcec] 2017 Jul 11 10:42:24.361849 lacp: lacp_debug_wrapper_tl(1718): input: if_index = [0x16000000] 2017 Jul 11 10:42:24.361857 lacp: lacp_debug_wrapper_tl(1718): Executing [mcecm_cache_is_pc_mcec] 2017 Jul 11 10:42:24.361865 lacp: lacp_debug_wrapper_tl(1718): output:0 2017 Jul 11 10:42:24.361879 lacp: lacp_pkt_encode_pdu_helper(842): 0x1a003000: Set short_timeout to periodic_rate:1 2017 Jul 11 10:42:24.361888 lacp: lacp_pkt_encode_pdu_helper(879): lacp_pkt_encode_pdu_helper: actor-port-state=7f agg=1 insync=1 coll=1 dis=1 active=1 short_timeout=1 2017 Jul 11 10:42:24.361899 lacp: lacp_pkt_encode_pdu_helper(906): lacp_pkt_encode_pdu_helper: if_idx=Ethernet1/4(0x1a003000) partner-port-state=0 agg=0 insync=0 coll=0 dis=0 active=0 short-timeout=0 2017 Jul 11 10:42:24.361910 lacp: lacp_pkt_encode_pdu_helper(910): lacp_pkt_encode_pdu_helper: if_idx=Ethernet1/4(0x1a003000) partner-mac=0-0-0-0-0-0 port_num=0 2017 Jul 11 10:42:24.361920 lacp: lacp_net_tx_data(206): lacp_net_tx_data: Sending buffer with length 110 2017 Jul 11 10:42:24.361930 lacp: lacp_net_tx_data(215): 01 01 01 14 ffff 2017 Jul 11 10:42:24.361940 lacp: lacp_net_tx_data(215): ffff 2017 Jul 11 10:42:24.361950 lacp: lacp_net_tx_data(215): 00 00 00 02 14 00 00 00 00 00 00 00 00 00 00 00 00 2017 Jul 11 10:42:24.361960 lacp: lacp_net_tx_data(215): 00 00 00 00 00 00 03 10 00 00 00 00 00 00 00 00 00 2017 Jul 11 10:42:24.361971 lacp: lacp_net_tx_data(215): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2017 Jul 11 10:42:24.361981 lacp: lacp_net_tx_data(215): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2017 Jul 11 10:42:24.361991 lacp: lacp_net_tx_data(215): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2017 Jul 11 10:42:24.362001 lacp: lacp_net_tx_data(247): Ethernet1/4(0x1a003000): Tx LACP PDU len: 110 As:7f, Ps:00 2017 Jul 11 10:42:24.362022 lacp: lacp_proto_get_state(969): IF Ethernet1/4(0x1a003000): end PartnerEnd(2): state TimeOut(1): enable_flag False 2017 Jul 11 10:42:24.362032 lacp: lacp_proto_restart_tx_timer(1802): lacp_proto_restart_tx_timer: got enable flag=0 before sending on interface Ethernet1/4(0x1a003000) 2017 Jul 11 10:42:24.362042 lacp: lacp_proto_restart_tx_timer(1825): lacp_proto_restart_tx_timer: flag 0 interface Ethernet1/4(0x1a003000) periodic_timer is fast 2017 Jul 11 10:42:24.362050 lacp: lacp_timer_start_w_chgd_time(681): lacp_timer_start_w_chgd_time: starting timer with time in ms = 1000 2017 Jul 11 10:42:24.362062 lacp: lacp_timer_start(637): Timer Started: Timer_Arg ([rid type IF-Rid: ifidx 0x1a003000: ch_num 0: event_id LACP_EV_PERIODIC_TRANSMIT_TIMER_EXPIRED(19): timer_id 399340: type PDUSendTime: active True: period_in_ms 1000])
Recomendación
Verifique si recibe paquetes LACP del par. Por ejemplo, la interfaz Ethernet1/3 recibe paquetes LACP, pero Ethernet1/4 no:
2017 Jul 11 10:42:25.641920 lacp: lacp_net_get_pkt_info(746): Packet received on phy_if_idx Ethernet1/3(0x1a002000): log_if_idx Ethernet1/3(0x1a002000): pkt_len 124 l2 header len 14 2017 Jul 11 10:42:25.641937 lacp: lacp_net_process_rx_data(480): Ethernet1/3(0x1a002000): Rx LACP PDU len: 124 As:3f, Ps:3d
Comprobación 9
En este resultado, la interfaz Ethernet1/4 es miembro de Port-Channel, pero está en modo individual (suspendido en el lado del switch):
ciscofcm01-A(fxos)# show lacp internal event-history interface ethernet 1/4 >>>>FSM: <Ethernet1/4> has 549 logged transitions<<<<< 1) FSM:<Ethernet1/4> Transition at 385779 usecs after Wed Jul 5 13:13:03 2017 Previous state: [LACP_ST_PORT_IS_DOWN_OR_LACP_IS_DISABLED] Triggered event: [LACP_EV_CLNUP_PHASE_II] Next state: [LACP_ST_PORT_IS_DOWN_OR_LACP_IS_DISABLED] 2) FSM:<Ethernet1/4> Transition at 955546 usecs after Wed Jul 5 13:13:03 2017 Previous state: [LACP_ST_PORT_IS_DOWN_OR_LACP_IS_DISABLED] Triggered event: [LACP_EV_LACP_ENABLED_AND_PORT_UP] Next state: [LACP_ST_DETACHED_LAG_NOT_DETERMINED] 3) FSM:<Ethernet1/4> Transition at 962224 usecs after Wed Jul 5 13:13:10 2017 Previous state: [LACP_ST_DETACHED_LAG_NOT_DETERMINED] Triggered event: [LACP_EV_RECEIVE_PARTNER_PDU_TIMED_OUT] Next state: [FSM_ST_NO_CHANGE] 4) FSM:<Ethernet1/4> Transition at 963838 usecs after Wed Jul 5 13:13:13 2017 Previous state: [LACP_ST_DETACHED_LAG_NOT_DETERMINED] Triggered event: [LACP_EV_RECEIVE_PARTNER_PDU_TIMED_OUT] Next state: [FSM_ST_NO_CHANGE] 5) FSM:<Ethernet1/4> Transition at 964002 usecs after Wed Jul 5 13:13:13 2017 Previous state: [LACP_ST_DETACHED_LAG_NOT_DETERMINED] Triggered event: [LACP_EV_RECEIVE_PARTNER_PDU_TIMED_OUT_II_INDIVIDUAL] Next state: [LACP_ST_INDIVIDUAL_OR_DEFAULT] 6) FSM:<Ethernet1/4> Transition at 735923 usecs after Wed Jul 5 13:13:36 2017 Previous state: [LACP_ST_INDIVIDUAL_OR_DEFAULT] Triggered event: [LACP_EV_UNGRACEFUL_DOWN] Next state: [LACP_ST_PORT_IS_DOWN_OR_LACP_IS_DISABLED]
Comprobación 10
En este resultado, la interfaz Ethernet1/3 está operativa y es miembro de PortChannel1 mientras que Ethernet1/4 aunque es miembro de PortChannel1 está en modo individual. Tenga en cuenta que Ethernet1/3 envía (tx) y recibe (rx) paquetes, pero Ethernet1/4 sólo envía (rx) no tx:
ciscofcm01-A(fxos)# debug lacp pkt ciscofcm01-A(fxos)# 2017 Jul 11 11:04:05.278736 lacp: lacp_net_process_rx_data(480): Ethernet1/3(0x1a002000): Rx LACP PDU len: 124 As:3f, Ps:3d 2017 Jul 11 11:04:05.602855 lacp: lacp_net_tx_data(247): Ethernet1/3(0x1a002000): Tx LACP PDU len: 110 As:3f, Ps:3d 2017 Jul 11 11:04:05.983134 lacp: lacp_net_tx_data(247): Ethernet1/4(0x1a003000): Tx LACP PDU len: 110 As:7f, Ps:00 2017 Jul 11 11:04:06.249929 lacp: lacp_net_process_rx_data(480): Ethernet1/3(0x1a002000): Rx LACP PDU len: 124 As:3f, Ps:3d 2017 Jul 11 11:04:06.602815 lacp: lacp_net_tx_data(247): Ethernet1/3(0x1a002000): Tx LACP PDU len: 110 As:3f, Ps:3d 2017 Jul 11 11:04:06.992812 lacp: lacp_net_tx_data(247): Ethernet1/4(0x1a003000): Tx LACP PDU len: 110 As:7f, Ps:00 2017 Jul 11 11:04:07.163780 lacp: lacp_net_process_rx_data(480): Ethernet1/3(0x1a002000): Rx LACP PDU len: 124 As:3f, Ps:3d 2017 Jul 11 11:04:07.602814 lacp: lacp_net_tx_data(247): Ethernet1/3(0x1a002000): Tx LACP PDU len: 110 As:3f, Ps:3d 2017 Jul 11 11:04:08.002817 lacp: lacp_net_tx_data(247): Ethernet1/4(0x1a003000): Tx LACP PDU len: 110 As:7f, Ps:00 2017 Jul 11 11:04:08.102006 lacp: lacp_net_process_rx_data(480): Ethernet1/3(0x1a002000): Rx LACP PDU len: 124 As:3f, Ps:3d 2017 Jul 11 11:04:08.612810 lacp: lacp_net_tx_data(247): Ethernet1/3(0x1a002000): Tx LACP PDU len: 110 As:3f, Ps:3d 2017 Jul 11 11:04:09.002811 lacp: lacp_net_tx_data(247): Ethernet1/4(0x1a003000): Tx LACP PDU len: 110 As:7f, Ps:00 2017 Jul 11 11:04:09.091937 lacp: lacp_net_process_rx_data(480): Ethernet1/3(0x1a002000): Rx LACP PDU len: 124 As:3f, Ps:3d 2017 Jul 11 11:04:09.622810 lacp: lacp_net_tx_data(247): Ethernet1/3(0x1a002000): Tx LACP PDU len: 110 As:3f, Ps:3d 2017 Jul 11 11:04:10.002807 lacp: lacp_net_tx_data(247): Ethernet1/4(0x1a003000): Tx LACP PDU len: 110 As:7f, Ps:00 2017 Jul 11 11:04:10.004411 lacp: lacp_net_process_rx_data(480): Ethernet1/3(0x1a002000): Rx LACP PDU len: 124 As:3f, Ps:3d 2017 Jul 11 11:04:10.632806 lacp: lacp_net_tx_data(247): Ethernet1/3(0x1a002000): Tx LACP PDU len: 110 As:3f, Ps:3d 2017 Jul 11 11:04:10.854094 lacp: lacp_net_process_rx_data(480): Ethernet1/3(0x1a002000): Rx LACP PDU len: 124 As:3f, Ps:3d 2017 Jul 11 11:04:11.002789 lacp: lacp_net_tx_data(247): Ethernet1/4(0x1a003000): Tx LACP PDU len: 110 As:7f, Ps:00 2017 Jul 11 11:04:11.642807 lacp: lacp_net_tx_data(247): Ethernet1/3(0x1a002000): Tx LACP PDU len: 110 As:3f, Ps:3d 2017 Jul 11 11:04:11.714199 lacp: lacp_net_process_rx_data(480): Ethernet1/3(0x1a002000): Rx LACP PDU len: 124 As:3f, Ps:3d
Para obtener más información, consulte este documento:
Vía 1
En el archivo .tar FPRM, extraiga el contenido del archivo FPRM_A_TechSupport.tar.gz. A continuación, abra el archivo sam_techsupportinfo y busque Package-Vers:
FPR4140-A# show fabric-interconnect firmware Fabric Interconnect A: Running-Kern-Vers: 5.0(3)N2(4.11.74) Running-Sys-Vers: 5.0(3)N2(4.11.74) Package-Vers: 2.1(1.77) Startup-Kern-Vers: 5.0(3)N2(4.11.74) Startup-Sys-Vers: 5.0(3)N2(4.11.74) Act-Kern-Status: Ready Act-Sys-Status: Ready Bootloader-Vers:
Vía 2
En el archivo .tar de FRPM, extraiga el contenido del archivo FPRM_A_TechSupport.tar.gz. A continuación, abra el archivo /var/sysmgr/sam_logs/svc_sam_dme.log y busque la palabra clave AInPlatformVersion:
Utiliza el componente de agente de aplicaciones MIO.
Por ejemplo, cuando se asigna un nuevo Port-Channel al FTD desde MIO:
La depuración del agente de aplicaciones FTD muestra:
firepower# debug app-agent 255 appagent : part 0 : ftd_001_JAD19500BAB0Z690F2.interfaceMapping.update appagent : part 1 : ssp-xml:3 appagent : part 2 : 7 appagent : part 3 : appAG appagent : part 4 : <interfaceMappingConfigUpdateRequest>appagent : Process the request message appagent : It is an update request command appagent : Invoke request msg handler for cmd interfaceMapping.update appagent : Processing InterfaceMapping Update Message appagent : Creating Interface Mapping Structure. appagent : Processing the tag externalPort. appagent : ================================ appagent : PortName=Port-channel11 appagent : ftw capability=0 appagent : no available ftw peers appagent : cleaning external_port_ftw_peers_t appagent : Sending Response message for Interface Mapping update Message appagent : Send response message to appAG appagent : resp_msg->cmdName =appAG.interfaceMapping.update appagent : resp_msg->content_version =ssp-xml:3 appagent : resp_msg->msgId =7 appagent : resp_msg->statuscode =100 appagent : resp_msg->data =<interfaceMappingConfigUpdateResponse> <response> Port-channel11 1011 data individual individual down 1000 5897.bdb9.367e 9
22 100
<message>Request success</message> </response> </interfaceMappingConfigUpdateResponse> appagent : part 0 : ftd_001_JAD19500BAB0Z690F2.interfaceStatus.update appagent : part 1 : ssp-xml:3 appagent : part 2 : 8 appagent : part 3 : appAG appagent : part 4 : <interfaceStatusUpdateRequest><interface><interfaceName>Port-channel11</interfaceName><externalOperationalStatus>down</externalOperationalStatus><internalOperationalStatus>up</internalOperationalStatus></interface></interfaceStatusUpdateRequest> appagent : Process the request message appagent : It is an update request command appagent : Invoke request msg handler for cmd interfaceStatus.update appagent : Processing Interface Status Update Request. appagent : The Fxos version is 2.1.1 or newer appagent : Parsing interface status update request message for FXOS > 211 appagent : Parsing Interface Status Req. appagent : Interface Status Successfully Updated. appagent : Sending Response for Interface Status Update Request appagent : Send response message to appAG appagent : resp_msg->cmdName =appAG.interfaceStatus.update appagent : resp_msg->content_version =ssp-xml:3 appagent : resp_msg->msgId =8 appagent : resp_msg->statuscode =100 appagent : resp_msg->data =<interfaceStatusUpdateResponse> <response>100
<message>Request success</message> </response> </interfaceStatusUpdateResponse>
El chasis de firepower tiene varios SN. El que se utiliza para una solicitud de RMA se puede tomar de estos resultados:
FP4120-5-A# scope chassis 1 FP4120-5-A /chassis # show inventory Chassis PID Vendor Serial (SN) HW Revision ---------- --------------- ----------------- ----------- ----------- 1 FPR-4120-K9 Cisco Systems Inc FLM12345KL6 0
or
FP4120-5-A# connect local-mgmt FP4120-5-A(local-mgmt)# show license all Smart Licensing Status ====================== Smart Licensing is ENABLED Registration: Status: UNREGISTERED Export-Controlled Functionality: Not Allowed License Authorization: Status: No Licenses in Use License Usage ============== No licenses in use Product Information =================== UDI: PID:FPR-4120-SUP,SN:JAD19500BAB
or
FP4120-5-A# scope license FP4120-5-A /license # show license all Smart Licensing Status ====================== Smart Licensing is ENABLED Registration: Status: UNREGISTERED Export-Controlled Functionality: Not Allowed License Authorization: Status: No Licenses in Use License Usage ============== No licenses in use Product Information =================== UDI: PID:FPR-4120-SUP,SN:JAD19500BAB
La respuesta corta es no. La SSD1 contiene la imagen de la aplicación (por ejemplo, FTD o ASA). Si saca el SSD1 del chasis y lo conecta a un chasis diferente, el módulo no se enciende y aparecen estos errores:
Se detectó el intercambio crítico de servidores blade F1548 2017-11-08T11:36:40.095 427280 en la ranura 1
Discordancia de la imagen del módulo de seguridad
Falta el disco local 1 en el servidor 1/1
A partir de la versión FXOS 2.2.1 puede utilizar el comando show environment summary
FPR4100-1 /chassis # show environment summary Chassis INFO : Total Power Consumption: 440.000000 Inlet Temperature (C): 21.000000 CPU Temperature (C): 39.000000 Last updated Time: 2018-07-01T09:39:55.157 PSU 1: Type: AC Input Feed Status: Ok 12v Output Status: Ok Overall Status: Operable PSU 2: Type: AC Input Feed Status: N/A 12v Output Status: N/A Overall Status: Removed FAN 1 Fan Speed RPM (RPM): 12110 Speed Status: Ok Overall Status: Operable FAN 2 Fan Speed RPM (RPM): 12110 Speed Status: Ok Overall Status: Operable FAN 3 Fan Speed RPM (RPM): 12100 Speed Status: Ok Overall Status: Operable
Para obtener más información, consulte:
Supervisión del estado del chasis
FPR-4110-7-A# scope chassis 1
FPR-4110-7-A /chassis # scope server 1
FPR-4110-7-A /chassis/server # scope adapter 1
FPR-4110-7-A /chassis/server/adapter # show version detail
Adapter 1:
Running-Vers: 5.3(1.91)
Package-Vers: 2.3(1.88)
Update-Status: Ready
Activate-Status: Ready
Bootloader-Update-Status: Ready
Startup-Vers: 5.3(1.91)
Backup-Vers: 5.3(1.48)
Bootloader-Vers: MF-111-234949