Management and Troubleshooting · Topic 1 of 6

Troubleshooting with the FMC and the Device CLI

Learn to troubleshoot Secure Firewall with FMC health, tasks and events and the FTD CLI, including show commands, the diagnostic CLI and expert mode.

  • 4 min
In a nutshell
  • The FMC shows health, tasks, events and the audit log.
  • The device CLI prompt for FTD is >.
  • show managers shows the registration state of a device.

What it is

Troubleshooting Secure Firewall uses two views: the Secure Firewall Management Center (FMC) and the command line of the device.

The FMC shows policy, health, deployment status and events. The device CLI shows what the firewall is actually doing right now.

A good method is to start in the FMC for the big picture and then move to the CLI to confirm details.

Problem reportuser cannot connectFMChealth, tasks, eventsDevice CLIshow commandsFixpolicy or network

How it works

Each tool answers a different kind of question, so use them together.

What the FMC can tell you

The FMC is the first stop for many problems.

  • The health monitor shows if a device is normal, warning or critical, and which module raised it.
  • The task and message area shows the result of deployments and other jobs, including errors.
  • Connection events show which rule matched, what the action was and the reason for a block.
  • The audit log shows who changed what and when.

If a deployment failed, the task message usually tells you why. If traffic is blocked, the connection event often names the rule or the policy that caused it.

The FMC can also collect troubleshooting files from a device. These are bundles that you can give to support. You find the option in the health or device troubleshooting area of the FMC.

The FTD CLI

Log in to the management address of the device with SSH. The prompt is >, and this is the Secure Firewall Threat Defense CLI.

> show version
> show managers
> show interface ip brief
> show network
> show failover
CommandWhat it shows
show versionSoftware version and model
show managersThe manager and registration state
show interface ip briefInterface names, addresses and status
show networkManagement interface settings
show failoverHigh availability state

Many ASA style commands work at this prompt and they pass through to the data path. Examples are show conn, show xlate, show nat and show route.

Diagnostic CLI and expert mode

Two more levels exist on the device.

The diagnostic CLI is the ASA style shell, entered with system support diagnostic-cli. It has a firepower prompt with an enable step, and it gives more of the lower level data path commands.

The expert command opens a Linux shell. It is for deeper work, usually with support guidance. Changes made there are not managed by the FMC, so use it carefully.

Clishprompt is greater than signdiagnostic cli commandDiagnostic CLIASA styleexpertLinux shellsupport level

Registration and management problems

If the FMC shows a device as down, check the management path. On the device, show managers tells you the state of the registration. The FMC and the device talk on a secure channel, and filters or routing problems on the path can break it.

Time can also matter. Wrong clocks can cause certificate and licence problems, so check the time on both sides.

A simple method

Work from the symptom to the layer.

  1. Check health and the last deployment in the FMC.
  2. Find the connection event and the rule or reason.
  3. Check interface, route and NAT on the device CLI.
  4. Use capture or tracer tools for packet level proof, which later pages cover.

What to remember for the exam

Seven facts cover the usual questions.

  • The FMC shows health, tasks, events and the audit log.
  • The device CLI prompt for FTD is >.
  • show managers shows the registration state of a device.
  • show failover shows the high availability state.
  • system support diagnostic-cli enters the ASA style diagnostic CLI.
  • The expert command opens a Linux shell, and its changes are not managed by the FMC.
  • A connection event shows the rule that matched and the action taken.
Exam tip

Start with the connection event in the FMC. It often names the rule that blocked the traffic, so you can skip a long search.

Common mistakes

These four mistakes are common when troubleshooting.

Starting with packet captures. Check health, deployment and events first, because they are quicker.

Changing settings in the expert shell. The FMC does not know about them and can overwrite them at the next deploy.

Ignoring failed tasks. A failed deployment means the device may still run old policy.

Forgetting the management path. If the device cannot reach the FMC, nothing deploys.

Watch out

Use the expert shell with care and preferably with support guidance. It gives full access to the underlying system.

Check yourself

Work through these three questions.

  • Which FMC feature shows why a deployment failed?

    The task and message area, which lists the result and the error of each job.

  • How do you enter the ASA style diagnostic shell on an FTD device?

    Use the command system support diagnostic-cli at the > prompt.

  • Which command shows whether a device is registered to the FMC?

    show managers, which shows the manager and the registration state.

Topic 1 of 6 in Management and Troubleshooting

Test yourself on Management and Troubleshooting

The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.