FMC displaying "The server response was not understood. 6 Validate Network Check the role for the FMC. 12-24-2019 In this example, curl is used: 2. Cisco Bug: CSCvi38903 - FMC repairing Sybase/MySQL for_policy mismatch too slow, doesn't issue corrections to sensor. I have a new FMC on VMware which has the required resources. can verify that it still owns the database and can remain available to clients. **************** Configuration Utility ************** Open the file usr-local-sf-bin-sfcli.pl show_tech_support asa_lina_cli_util.output: 3. Is the above-mentioned command enough to start all (disabled/stuck) services? Open the file usr-local-sf-bin-troubleshoot_HADC.pl -a.output: FDM high availability configuration and status can be verified with the use of these options: In order to verify the FDM high availability configuration and status on FDM UI, check High Availability on the main page. REQUESTED FROM REMOTE for CSM_CCM service, TOTAL TRANSMITTED MESSAGES <228> for UE Channel service REQUESTED FROM REMOTE for IDS Events service, TOTAL TRANSMITTED MESSAGES <23> for EStreamer Events service Dealing with Cisco Firepower Management Center (FMC) and Firepower sensor communication. If the primary server loses communications SEND MESSAGES <27> for UE Channel service Enter this command into the CLI in order to restart the console: Log into the CLI of the managed device via Secure Shell (SSH). MSGS: 04-09 07:48:48 FTDv SF-IMS[9200]: [13243] sfmgr:sfmanager [INFO] Exiting child thread for peer 192.168.0.200 Where to start cybersecurity? Is your output from the VMware console or are you able to ssh to the server? 2. These are the management and the eventing channels. It is like this. REQUESTED FROM REMOTE for IP(NTP) service, TOTAL TRANSMITTED MESSAGES <4> for Health Events service It can take few seconds to proceed. Broadcast count = 0 Products . No change./etc/rc.d/init.d/console restart has not helped. Grandmetric LLC 2. - edited In this case, the context mode is multiple since there are multiple contexts: Firepower 2100 with ASA can run in one of these modes: Platform mode - basic operating parameters and hardware interface settings are configured in FXOS. TOTAL TRANSMITTED MESSAGES <14> for IDS Events service SERR: 04-09 07:48:50 2018-04-09 07:48:58 sfmbservice[9201]:FTDvSF-IMS[9201]: [13428] sfmbservice:sfmb_service [INFO] TERM:Peer 192.168.0.200 removed In order to verify the FTD high availability and scalability configuration, check the labels High Availability or Cluster. Run the expert command and then run the sudo su command: 3. uuid_gw => , databases. 11:18 PM STATE for Health Events service 0 Helpful Share. In this example, curl is used: 4. ul. It unifies all these capabilities in a single management interface. We are using FMC 2500 ( bare metal server USC model ). If the value is not empty, then the FTD runs in container mode: Follow these steps to verify the FTD instance deployment type on the FXOS CLI: Follow these steps to verify the FTD instance deployment type via an FXOS REST-API request. 09-03-2021 Last Modified. They are as below. RECEIVED MESSAGES <2> for Identity service After an attempt to upgrade our backup FMC from 6.6.1 (build 91) to the latest 7.0.4-55, the GUI does not allow login and gives the "The server response was not understood. These options reestablish the secure channels between both peers, verifying the certificates and creating new config file on the backend. +48 61271 04 43 Cipher used = AES256-GCM-SHA384 (strength:256 bits) Log into the web UI of your Firewall Management Center. Use a REST-API client. STORED MESSAGES for UE Channel service (service 0/peer 0) 0 Exit If your network is live, ensure that you understand the potential impact of any command. 3. . STORED MESSAGES for service 7000 (service 0/peer 0) SEND MESSAGES <22> for RPC service NIP 7792433527 12-16-2017 This document describes how to restart the services on a Cisco Firewall Management Center appliance with either a web User Interface (UI) or a CLI. Standalone, failover, and cluster configuration modes are mutually exclusive. In order to verify the failover configuration and status, check the show failover section. In order to verify high availability status, use this query: FTD high availability and scalability configuration and status can be verified with the use of these options: Follow these steps to verify the FTD high availability and scalability configuration and status on the FTD CLI: 1. Use telnet/SSH to access the ASA on Firepower 2100. A cluster configuration lets you group multiple FTD nodes together as a single logical device. SEND MESSAGES <3> for service 7000 So lets execute manage_procs.pl, monitor a secondary SSH window with pigtail and filter the output by IP of the FMC. Without an arbiter, High availability or failover setup joins two devices so that if one of the devices fails, the other device can take over. REQUESTED FROM REMOTE for UE Channel service, TOTAL TRANSMITTED MESSAGES <30> for UE Channel service +48 61 271 04 43 I have also restarted the FMC several times. In order to verify theFTD cluster configuration and status, run the show running-config cluster and show cluster info commands on the CLI. RECEIVED MESSAGES <91> for UE Channel service Customers Also Viewed These Support Documents. Follow these steps to verify the FTD high availability and scalability configuration and status on the FXOS CLI: 1. MSGS: 04-09 07:48:58 FTDv SF-IMS[14543]: [14546] sfmbservice:sfmb_service [INFO] Start getting MB messages for 192.168.0.200 and committed to the other copy of the database. The information in this document is based on these software and hardware versions: High availability refers to the failover configuration. In order to verify the failover configuration, use the domain UUID and the device/container UUID from Step 3 in this query: 5. Looks some DB and other service still looking to come up. mojo_server is down . Please contact support." at the GUI login. I ran pmtool status | grep -i gui and see the following: vmsDbEngine - DownDCCSM - DownTomcat - DownVmsBackendServer - Down, I used pmtool restartbyid for all services. Heartbeat Received Time: Mon Apr 9 07:59:15 2018 In this post we are going to focus on the scripts included in FTD and FMC operating systems that help to troubleshoot connections between FTD sensors and Cisco Firepower Management Center. The arbiter server resolves disputes between the servers regarding which server should be the primary server. The information in this document was created from the devices in a specific lab environment. In order to verify high availability configuration, use the access token value in this query: 3. root@FTDv:/home/admin# sftunnel_status.pl REQUESTED FROM REMOTE for Health Events service, TOTAL TRANSMITTED MESSAGES <3> for Identity service Brookfield Place Office In order to verify the FTD cluster status, use this query: The FTD high availability and scalability configuration and status can be verified in the Firepower 4100/9300 chassis show-tech file. Please contact support." if I do /etc/rc.d/init.d/console restart "it just restarts FMC and doesn't interfere with the ongoing traffic? You should only have one Cisco_Firepower.-vrt.sh.REL.tar file left. Phone: +1 302 691 9410 STORED MESSAGES for IDS Events service (service 0/peer 0) Edit the logical device on the Logical Devices page: 2. FMC repairing Sybase/MySQL for_policy mismatch too slow, doesn't issue corrections to sensor . Password: REQUESTED FROM REMOTE for Malware Lookup Service service, TOTAL TRANSMITTED MESSAGES <6> for service 7000 If you run it from the FTD then only the particular sensor FMC communication will be affected. STORED MESSAGES for Identity service (service 0/peer 0) Related Community Discussions The verification steps for the high availability and scalability configuration, firewall mode, and instance deployment type are shown on the user interface (UI), the command-line interface (CLI), via REST-API queries, SNMP, and in the troubleshoot file. In this example, curl is used: 2. If high availability is not configured, this output is shown: If high availability is configured, this output is shown: Note: In a high availability configuration, the FMC role can have a primary or secondary role, and active or standby status. Use these resources to familiarize yourself with the community: Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. This document is not restricted to specific software and hardware versions. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. MSGS: 04-09 07:48:58 FTDv SF-IMS[14541]: [14552] sftunneld:sf_ssl[INFO] Initiating IPv4 connection to 192.168.0.200:8305/tcp But now I see that output is as, root@firepower:/# pmtool status | grep -i guimysqld (system,gui,mysql) - Running 7958httpsd (system,gui) - Running 7961sybase_arbiter (system,gui) - WaitingvmsDbEngine (system,gui) - Running 7962ESS (system,gui) - Running 7990DCCSM (system,gui) - Running 8535Tomcat (system,gui) - Running 8615VmsBackendServer (system,gui) - Running 8616mojo_server (system,gui) - Running 8041. STATE for IDS Events service MSGS: 04-09 07:48:58 FTDv SF-IMS[14541]: [14552] sftunneld:sf_ssl[INFO] reconnect to peer '192.168.0.200' in 0 seconds SERR: 04-09 07:48:58 2018-04-09 07:48:59 sfmbservice[14543]: FTDv SF-IMS[14543]: [14546] sfmbservice:sfmb_service [INFO] Start getting MB messages for 192.168.0.200 Management Interfaces: 1 Peer channel Channel-B is valid type (EVENT), using 'br1', connected to '192.168.0.200' via '192.168.0.201', TOTAL TRANSMITTED MESSAGES <16> for IP(NTP) service *************************RUN STATUS****192.168.0.200************* If you still have problems then you can see all the debugging messages in a separate SSH session to the sensor. Version: (Cisco_Firepower_Management_Center_VMware-6.2.0-362). Follow these steps to verify the FTD high availability and scalability configuration and status via SNMP: 3. REQUESTED FOR REMOTE for IDS Events service Use a REST-API client. connect ftd [instance], where the instance is relevant only for multi-instance deployment. EIN: 98-1615498 This is a top blog. There are no specific requirements for this document. STORED MESSAGES for CSM_CCM (service 0/peer 0) Appliance mode (the default) - Appliance mode allows users to configure all policies in the ASA. I have came across an issue which is a bit different from this scenarion. FMC high availability configuration and status can be verified with the use of these options: Follow these steps to verify the FMC high availability configuration and status on the FMC UI: 1. Grandmetric LLC Another great tool inherited by Sourcefire is sftunnel_status.pl. root@FTDv:/home/admin# manage_procs.pl SEND MESSAGES <7> for IDS Events service The instance deployment type can be verified with the use of these options: Follow these steps to verify the FTD instance deployment type on the FTD CLI: connect module [console|telnet], where x is the slot ID, and then connect ftd [instance], where the instance is relevant only for multi-instance deployment. All rights reserved. MSGS: 04-09 07:48:58 FTDv SF-IMS[14541]: [14552] sftunneld:sf_ssl[INFO] Connect to 192.168.0.200 on port 8305 - br1 active => 1, The other day I was reading community forum to see If anyone faced this kind of issue earlier. New here? Follow these steps to verify the FTD high availability and scalability configuration and status via FMC REST-API. MSGS: 04-09 07:48:58 FTDv SF-IMS[14541]: [14552] sftunneld:sf_ssl[WARN] Unable to connect to peer '192.168.0.200' Only advanced commands are available from the FXOS CLI. 2. In order to verify the failover configuration and status poll the OID. STATE for IP(NTP) service Enterprise Wireless: Cisco Products Overview, Ansible automation reduces response time to requests by 80%, Fortigate 200F configuration optimization with Elasticstack, Cisco Meraki - safe WLAN in high-bay warehouse, Cisco SD-WAN implementation in a sugar production company, Cisco Meraki safe WLAN in high-bay warehouse, Troubleshooting FMC and Firepower communication, Wi-Fi 6: High-Efficiency WLAN with IEEE 802.11ax [UPDATED], Phishing - a big problem for small and medium-sized businesses. STORED MESSAGES for UE Channel service (service 0/peer 0) i will share the output once Im at site. In order to verify the FTD cluster configuration, check the value of the Mode attribute value under the specific slot in the`show logical-device detail expand` section: 4. current. In order to verify the failover status, check the value of theha-role attribute value under the specific slot in the`show slot expand detail` section: 3. FMC displaying "The server response was not understood. MSGS: 04-09 07:48:58 FTDv SF-IMS[14541]: [14551] sftunneld:sf_connections [INFO] Start connection to : 192.168.0.200 (wait 0 seconds is up) New here? MSGS: 04-09 07:48:58 FTDv SF-IMS[14541]: [14551] sftunneld:sf_peers [INFO] Peer 192.168.0.200 needs a single connection With an arbiter, the primary server Use these options to access the FTD CLI in accordance with the platform and deployment mode: connect module [console|telnet], where x is the slot ID, and then connect ftd [instance], where the instance is relevant only for multi-instance deployment. In this example, curl is used: 2. 02:49 AM Specify the token, the slot ID in this query, and check the value of deployType: ASA supports single and multi-context modes. Registration process. ", root@vm4110:/Volume/home/admin# pmtool status | grep -i guimysqld (system,gui,mysql) - Running 4908httpsd (system,gui) - Running 4913sybase_arbiter (system,gui) - WaitingvmsDbEngine (system,gui) - DownESS (system,gui) - Running 4949DCCSM (system,gui) - DownTomcat (system,gui) - DownVmsBackendServer (system,gui) - Downmojo_server (system,gui) - Running 5114, I have checked the certificate is the default one and I changed the cipher suites, but no luck. I changed the eth0 IP and tried pinging the IP and in that case it was not pingable anymore. MSGS: 04-09 07:48:58 FTDv SF-IMS[14541]: [14552] sftunneld:sf_ssl[INFO] Wait to connect to 8305 (IPv6): 192.168.0.200 of a database. In order to verify the FTD high availability and scalability status, check the unit role in parenthesis. TOTAL TRANSMITTED MESSAGES <58> for CSM_CCM service Run the troubleshoot_HADC.pl command and select option 1 Show HA Info Of FMC. REQUESTED FROM REMOTE for UE Channel service, TOTAL TRANSMITTED MESSAGES <0> for FSTREAM service ip => 192.168.0.200, FCM web interface or FXOS CLI can be used for FXOS configuration. Thanks. Use a REST-API client. The module is not keeping the change. pmtool status | grep -E "Waiting|Down|Disable", pmtool status | grep -E "Waiting|Down|Disable|Running". Check the labels Routed or Transparent: Follow these steps to verify the FTD firewall mode via FMC REST-API. In order to verify the FTD cluster status, check the value of the Cluster State and Cluster Role attribute values under the specific slot in the`show slot expand detail` section: ASA high availability and scalability configuration and status can be verified with the use of these options: Follow these steps to verify the ASA high availability and scalability configuration on the ASA CLI: connect module [console|telnet], where x is the slot ID, and then connect asa. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. # cat 'usr-local-sf-bin-sfcli.pl show_tech_support asa_lina_cli_util.output', Verify High Availability and Scalability Configuration, Configure and troubleshoot SNMP on Firepower FDM, Configure SNMP on Firepower NGFW Appliances, Secure Firewall Management Center REST API Quick Start Guide, Version 7.1, Cisco Firepower Threat Defense REST API Guide, Firepower 1000/2100 and Secure Firewall 3100 ASA and FXOS Bundle Versions, Firepower Troubleshoot File Generation Procedures, Cisco Firepower 2100 Getting Started Guide, Cisco Firepower Threat Defense Compatibility Guide, Firepower Management Center (FMC) Version 7.1.x, Firepower eXtensible Operating System (FXOS) 2.11.1.x, Access from the FXOS console CLI (Firepower 1000/2100/3100) via command. 12:19 AM STORED MESSAGES for RPC service (service 0/peer 0) All of the devices used in this document started with a cleared (default) configuration. The context type can be verified with the use of these options: Follow these steps to verify the ASA context mode on the ASA CLI: Follow these steps to verify the ASA context mode in the ASA show-tech file: 1. 02-21-2020 SEND MESSAGES <1> for Identity service The ASA firewall mode can be verified with the use of these options: Follow these steps to verify the ASA firewall mode on the ASA CLI: 2. New here? Open the troubleshoot file and navigate to the folder -troubleshoot .tar/results---xxxxxx/command-outputs. The restarting of the box did the trick for me. Again, this would result in lost transactions and incompatible databases. No error and nothing. Open the troubleshoot file and navigate to the folder .tar/results---xxxxxx/command-outputs. Learn more about how Cisco is using Inclusive Language. What is the proper command to change the default gateway of the module? Cisco Firepower Management Center Virtual Appliance Known Affected Release 6.0.0 6.0.1 Description (partial) Symptom: Firepower Management Center (FMC) UI displays that system processes are starting and login page is not working. ChannelB Connected: Yes, Interface br1 We are able to loginto the CLI. 2. Follow these steps to verify the ASA high availability and scalability configuration via SNMP: 3. It gives real time outputs from a bunch of log files. I was then able to add them back with the new default GW. The logic path Im following is to confirm there isnt a duplicate IP address responding to your pings. HALT REQUEST SEND COUNTER <0> for Malware Lookup Service service During the FMC restart, any new mapping could not be created, and that would cause the old mapping to be used instead which would allow limited users to have full access, or vice-versa, depending on the last connected user from that IP. Container instance - A container instance uses a subset of resources of the security module/engine. My problem is a little different. MSGS: 04-09 07:48:46 FTDv SF-IMS[9200]: [13244] sfmgr:sfmanager [INFO] WRITE_THREAD:Terminated sftunnel write thread for peer 192.168.0.200 What version of the software and patch level are you running. In order to verify the cluster status, use the domain UUID and the device/container UUID from Step 6 in this query: In order to verify the FTD cluster configuration, use the logical device identifier in this query: For FXOS versions 2.7 and later, open the file. 4 Update routes For example, there is no verification command for FTD standalone configuration. FMC displaying "The server response was not understood. 1. The arbiter server resolves disputes between the servers regarding which server should be the primary server. In order to verify the cluster configuration and status, poll the OID 1.3.6.1.4.1.9.9.491.1.8.1. MSGS: 04-09 07:48:58 FTDv SF-IMS[14541]: [14541] sftunneld:sf_peers [INFO] Using a 20 entry queue for 192.168.0.200 - 8121 How to Ask The Cisco Community for Help. For FDM-managed FTD, refer to, In order to verify the FTD failover configuration and status, poll the OID. Firepower 2100 mode with ASA be verified with the use of these options: Follow these steps to verify the Firepower 2100 mode with ASA on the ASA CLI: 1. Metalowa 5, 60-118 Pozna, Poland The firewall mode refers to a routed or transparent firewall configuration. Also I came across a command that restart FMC console services. " REQUESTED FOR REMOTE for UE Channel service Brookfield Place Office sw_version 6.2.2.2 NIP 7792433527 STORED MESSAGES for Health service (service 0/peer 0) Find answers to your questions by entering keywords or phrases in the Search bar above. If neither exists, then the FTD runs in a standalone configuration: 3. Access from the FXOS CLI via commands (Firepower 4100/9300): For virtual FTDs, direct SSH access to FTD, or console access from the hypervisor or cloud UI, Ensure that SNMP is configured and enabled. Follow these steps to verify the FTD firewall mode on the FCM UI: 1. After changing the default gateway of the SFR module on 5585-x I restarted the module. Multi-instance capability is only supported for the FTD managed by FMC; it is not supported for the ASA or the FTD managed by FDM. In addition, the other copy of the database would be unusable for mirroring It can also act as a database server for other Products & Services; Support; How to Buy; Training & Events; Partners; Cisco Bug: CSCvi38903 . If the cluster is configured and enabled, this output is shown: Follow these steps to verify the FTD high availability and scalability configuration and status on the FMC UI: 2. 09:47 AM, I am not able to login to FMC GUI. I had to delete IP, subnet and default GW from the NIC. STATE for UE Channel service Check the output for a specific slot: FXOS REST-API is supported on Firepower 4100/9300. 2. Enter choice: I am using 3th, 4th and 5th option. To see if any process is stuck or not? In this document these expressions are used interchangeably: In some cases, the verification of high availability and scalability configuration or status is not available. Your email address will not be published. root@FTDv:/home/admin# pigtail | grep 192.168.0.200 ul. ************************RPC STATUS****192.168.0.200************* williams_t82. It can be run from the FTD expert mode or the FMC. I am not able to login to the gui. Enter this command into the CLI in order to restart the processes that run on a managed device. May 14, 2021. Find answers to your questions by entering keywords or phrases in the Search bar above. In order to verify the FTD cluster configuration and status, check the Clustered label and the CLUSTER-ROLE attribute value on the Logical Devices page: The FTD high availability and scalability configuration and status verification on the FXOS CLI are available on Firepower 4100/9300. Click on the application icon, and check the Firewall Mode in the Settings tab: Follow these steps to verify the FTD firewall mode on the FXOS CLI: Follow these steps to verify the FTD firewall mode via FXOS REST-API request. RECEIVED MESSAGES <22> for RPC service uuid => e5845934-1cb1-11e8-9ca8-c3055116ac45, Newly installed FMC virtual is not accessible through GUI. - edited Find answers to your questions by entering keywords or phrases in the Search bar above. In order to verify the FTD firewall mode, check the show firewall section: Follow these steps to verify the FTD firewall mode on the FMC UI: 2. Ensure that SNMP is configured and enabled. Open file tech_support_brief in _FPRM.tar.gz/_FPRM.tar, Cisco bug ID CSCwb94424 ENH: Add a CLISH command for FMC HA configuration verification, Cisco bug ID CSCvn31622 ENH: Add FXOS SNMP OIDs to poll logical device and app-instance configuration, Cisco bug ID CSCwb97767 ENH: Add OID for verification of FTD instance deployment type, Cisco bug ID CSCwb97772 ENH: Include output of 'show fxos mode' in show-tech of ASA on Firepower 2100, Cisco bug ID CSCwb97751 OID 1.3.6.1.4.1.9.9.491.1.6.1.1 for transparent firewall mode verification is not available. I have the same down services askostasthedelegate, 02-24-2022 View with Adobe Reader on a variety of devices, View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone, View on Kindle device or Kindle app on multiple devices, # curl -s -k -v -X POST 'https://192.0.2.1/api/fmc_platform/v1/auth/generatetoken' -H 'Authentication: Basic' -u 'admin:Cisco123' | grep -i X-auth-access-token, Sybase Process: Running (vmsDbEngine, theSybase PM Process is Running). Without an arbiter, both servers could assume that they should take ownership Management Interfaces: 1 RECEIVED MESSAGES <8> for IP(NTP) service As they are run from the expert mode (super user), it is better that you have a deep understanding of any potential impact on the production environment. There is a script included in the Cisco Firepower system called manage_procs.pl (use it wisely). Be careful, if you run it from the FMC and you have hundreds of sensors it will reestablish all communication channels to all of your sensors at once. mine is reporting killing DCCSM with /var/sf/bin/dccsmstop.pl but that is just an info error. You should use the "configure network" subcommands on a Firepower service module vs. the Linux shell commands. 09-06-2021 Reserved SSL connections: 0 For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. sybase_arbiter (system,gui) - Waiting vmsDbEngine (system,gui) - Down ESS (system,gui) - Running 4949 DCCSM (system,gui) - Down Tomcat (system,gui) - Down VmsBackendServer (system,gui) - Down mojo_server (system,gui) - Running 5114 I have checked the certificate is the default one and I changed the cipher suites, but no luck info@grandmetric.com. eth0 (control events) 192.168.0.200, STORED MESSAGES for Malware Lookup Service service (service 0/peer 0) FTD does not support multi-context mode. HALT REQUEST SEND COUNTER <0> for UE Channel service STATE for Malware Lookup Service service REQUESTED FOR REMOTE for UE Channel service RECEIVED MESSAGES <2> for Health Events service In some small percentage of cases it may result in URL lookups not being successful (where there is a URL filtering policy and the target URL is not already cached and categorized on the managed device). - edited Metalowa 5, 60-118 Pozna, Poland Let us guide you through Cisco Firepower Threat Defense technology (FTD) along with Firepower Management Center (FMC) as security management and reporting environment. 2. 2023 Cisco and/or its affiliates. 2. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. In this case, high availability is not configured and FMC operates in a standalone configuration: If high availability is configured, local and remote roles are shown: Follow these steps to verify the FMC high availability configuration and status on the FMC CLI: 1. SEND MESSAGES <20> for CSM_CCM service Keep in mind that you may use the pigtail command during the registration process and monitor where the registration is failing. 200 Vesey Street Follow these steps to verify the FTD high availability and scalability configuration and status in the FTD troubleshoot file: 1. - edited error. Not coming up even after restart. 06:58 AM. z o.o. with both the mirror and the arbiter, it must shut down and wait for either one to become available. Email: info@grandmetric.com, Grandmetric Sp. I had this issue, I fixed it by restarting the console from expert mode. REQUESTED FROM REMOTE for Identity service, TOTAL TRANSMITTED MESSAGES <44> for RPC service You can assess if this is your problem by:entering expert modetype sudo su - (enter password)type df -TH. SFTUNNEL Start Time: Mon Apr 9 07:48:59 2018 04:36 AM. 3. last_changed => Mon Apr 9 07:07:16 2018. New York, NY 10281 PEER INFO: Email: info@grandmetric.com, Troubleshooting FMC and Cisco Firepower Sensor communication. HALT REQUEST SEND COUNTER <0> for IP(NTP) service /Volume/home/admin# pmtool status | grep -i guimysqld (system,gui,mysql) - Running 24404httpsd (system,gui) - Running 24407sybase_arbiter (system,gui) - WaitingvmsDbEngine (system,gui) - Running 24408ESS (system,gui) - Running 24437DCCSM (system,gui) - Running 25652Tomcat (system,gui) - Running 25805VmsBackendServer (system,gui) - Running 25806mojo_server (system,gui) - Down, /Volume/home/admin# pmtool status | grep -i downSyncd (normal) - Downexpire-session (normal) - DownPruner (normal) - DownActionQueueScrape (system) - Downrun_hm (normal) - Downupdate_snort_attrib_table (normal) - DownSFTop10Cacher (normal) - Downmojo_server (system,gui) - DownRUAScheduledDownload - Period 3600 - Next run Tue Aug 30 10:02:00 2022, /etc/rc.d/init.d/console restartStopping Cisco Firepower Management Center 2500okStarting Cisco Firepower Management Center 2500, please waitstarted. MSGS: 04-09 07:48:57 FTDv SF-IMS[5575]: [13337] SFDataCorrelator:EventStreamHandler [INFO] Reset: Closing estreamer connection to:192.168.0.200 If you run a FirePOWER (SFR) Service Module on an ASA, you must enter this command on the ASA in order to access the SFR module: After you provide the user credentials and successfully log into the shell, enter this command in order to restart the services: Log into the CLI of the Sourcefire managed device. In order to verify the failover status, use the domain UUID and the DeviceHAPair UUID from Step 4 in this query: 6. have you looking compute requirement for 7.0 ? REQUESTED FOR REMOTE for Health Events service In order to verify the ASA cluster configuration and status, run the show running-config cluster and show cluster info commands on the CLI.