排除FXOS中的基本配置故障

简介

本文档介绍用于帮助确认Cisco安全防火墙可扩展操作(FXOS)基本状态和配置正确性的步骤。

先决条件

要求

思科建议您了解以下内容：

• 思科安全防火墙可扩展操作(FXOS)
• 思科安全防火墙威胁防御(FTD)

使用的组件

本文档中的信息都是基于特定实验室环境中的设备编写的。用于本文的所有设备始于初始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。

• 思科安全防火墙可扩展运行4110，版本2.10.(1.179)
• 思科安全防火墙威胁防御，版本7.0.5

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。

背景信息

思科安全防火墙机箱是用于网络和联系人安全解决方案的下一代平台。逻辑设备允许您运行ASA或思科安全防火墙威胁防御(FTD)应用实例。

根据您添加的逻辑设备，应用实例类型和版本会得到定义。

机箱信息

此命令有助于获取机箱的整体信息（无论是否所有信息都可操作），这些信息将收集到TAC以便排除机箱错误。

Serial Number

序列号用作机箱的标识符。如果整个机箱都需要RMA，则需要此许可证

FPR4110-04-A# scope chassis 1
FPR4110-04-A /chassis # show inventory
Chassis     PID          Vendor            Serial (SN)  HW Revision
-------    -----------   ----------------- -----------  -----------
1          FPR-4110-K9   Cisco Systems Inc JMX2136L03W  0

FXOS版本

FPR4110-04-A# show version
    Version: 2.10(1.179)
    Startup-Vers: 2.10(1.179)

知道FXOS版本的方法有两种，其中一种包括固件。

FPR4110-04-A# show fabric-interconnect firmware
Fabric Interconnect A:
    Running-Kern-Vers: 5.0(3)N2(4.101.103)
    Running-Sys-Vers: 5.0(3)N2(4.101.103)
    Package-Vers: 2.10(1.179)
    Startup-Kern-Vers: 5.0(3)N2(4.101.103)
    Startup-Sys-Vers: 5.0(3)N2(4.101.103)
    Act-Kern-Status: Ready
    Act-Sys-Status: Ready
    Bootloader-Vers:

引导加载程序版本

FPR4110-04-A# scope chassis 1
FPR4110-04-A /chassis # scope server 1
FPR4110-04-A /chassis/server # scope adapter 1
FPR4110-04-A /chassis/server/adapter # show version detail
Adapter 1:
Running-Vers: 5.10(1.53)
Package-Vers: 2.10(1.179)
Update-Status: Ready
Activate-Status: Ready
Bootloader-Update-Status: Ready
Startup-Vers: 5.10(1.53)
Backup-Vers: 5.10(1.57)
Bootloader-Vers: 4.0(1.62)

检查时间

FPR4110-04-A# connect fxos
FPR4110-04-A(fxos)# show system uptime
System start time: Mon Oct 23 16:45:36 2023
System uptime: 98 days, 1 hours, 49 minutes, 36 seconds
Kernel uptime: 98 days, 1 hours, 40 minutes, 19 seconds
Active supervisor uptime: 98 days, 1 hours, 49 minutes, 36 second

show clock

FPR4110-04-A# show clock
Tue Jan 30 17:07:50 EST 2024 

检查Ntp-server

FPR4110-04-A# scope system
FPR4110-04-A /system # scope services
FPR4110-04-A /system/services # show ntp-server
NTP server hostname:
Name Time         Sync Status
--------------    ----------------
172.16.254.131    Time Synchronized

监控机箱运行状况

以下命令可帮助您对机箱硬件状态进行故障排除。

检查环境

FPR4110-04-A# scope chassis 1
FPR4110-04-A /chassis # show environment expand detail
Chassis 1:
Overall Status: Power Problem
Operability: Operable
Power State: Redundancy Failed
Thermal Status: Ok

PSU 1:
Threshold Status: N/A
Overall Status: N/A
Operability: N/A
Power State: Off
Thermal Status: OK
Voltage Status: N/A

PSU 2:
Threshold Status: OK
Overall Status: Operable
Operability: Operable
Power State: On
Thermal Status: OK
Voltage Status: OK

Tray 1 Module 1:
Threshold Status: OK
Overall Status: Operable
Operability: Operable
Power State: On
Thermal Status: OK
Voltage Status: OK

Fan Module Stats:
Ambient Temp (C): 27.000000

 Fan 1:
Threshold Status: OK
Overall Status: Operable
Operability: Operable
Power State: On
Thermal Status: OK
Voltage Status: OK

 Fan 2:
Threshold Status: OK
Overall Status: Operable
Operability: Operable
Power State: On
Thermal Status: OK
Voltage Status: OK
...
 Server 1:
Name:
User Label:
Overall Status: Ok
Operability: Operable
Oper Power: On

 Adapter 1:
Threshold Status: N/A
Overall Status: Operable
Operability: Operable
Power State: On
Thermal Status: N/A
Voltage Status: N/A

 Motherboard:
Threshold Status: OK
Overall Status: N/A
Operability: N/A
Oper Power: On
Power State: Ok
Thermal Status: OK
Voltage Status: OK
CMOS Battery Voltage Status: Ok
Mother Board Power Usage Status: Ok

 Motherboard Temperature Statistics:
Motherboard Front Temperature (C): 19.000000
Motherboard Rear Temperature (C): 26.000000

 Memory Array 1:
Threshold Status: N/A
Overall Status: N/A
Operability: N/A
Power State: N/A
Thermal Status: N/A
Voltage Status: N/A

 DIMMs:

DIMM Threshold Status Overall Status Operability Power State Thermal Status Voltage Status
---- ---------------- --------------- ----------- ----------- --------------- --------------
1 N/A Operable N/A N/A OK N/A
2 N/A Removed N/A N/A N/A N/A
3 N/A Removed N/A N/A N/A N/A
4 N/A Operable N/A N/A OK N/A
5 N/A Removed N/A N/A N/A N/A
...

 CPU 1:
Threshold Status: N/A
Overall Status: Operable
Operability: Operable
Power State: N/A
Thermal Status: OK
Voltage Status: N/A

显示故障

故障列表显示安全防火墙平台上发现的所有硬件问题，有助于获得活动故障和已清除故障的摘要。

故障按时间顺序显示。严重程度反映故障的重要性，说明中会提供简要概述。请重点关注严重程度、时间戳和说明。故障严重程度由高到低依次为：

• 关键
• 重大
• Minor（轻微）
• 警告
• 信息/条件
• 已清除

FPR4110-04-A# show fault
Severity Code Last Transition Time ID Description
--------- ----- ----------------------- ------ -----------
Major F0276 2023-12-14T18:26:29.505 507308 ether port 2/2 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Major F0276 2023-11-13T14:07:37.720 221350 ether port 1/1 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Info F0279 2023-11-13T14:07:37.720 446504 ether port 1/7 on fabric interconnect A oper state: sfp-not-present
Major F0276 2023-11-07T08:10:50.143 434090 ether port 1/6 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Major F0276 2023-11-07T08:10:49.941 434081 ether port 1/5 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Major F0282 2023-07-31T17:52:04.764 201600 lan port-channel 7 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:51:03.325 201446 lan port-channel 4 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:49:00.451 201281 lan port-channel 2 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:42:34.236 200638 lan port-channel 1 on fabric interconnect A oper state: failed, reason: No operational members
Major F0909 2023-06-19T14:02:55.642 99113 default Keyring's certificate is invalid, reason: expired.
Warning F1781 2012-01-11T02:21:44.215 90296 The password encryption key has not been set.
Info F0461 2011-12-31T21:32:43.448 35793 Log capacity on Management Controller on server 1/1 is very-low
Major F0408 2011-12-31T21:32:32.787 35497 Power state on chassis 1 is redundancy-failed
Warning F0528 2011-12-31T21:32:32.787 35498 Power supply 1 in chassis 1 power: off
Minor F1437 2011-12-31T21:31:08.462 32663 Config backup may be outdated
FPR4110-04-A# 

可以根据原因、详细信息、严重程度或抑制的故障过滤故障。

FPR4110-04-A# show fault ?
0-18446744073709551615 ID 
<CR> 
> Redirect it to a file 
>> Redirect it to a file in append mode 
cause Cause 
detail Detail 
severity Severity 
suppressed Fault Suppressed 
| Pipe command output to filter 

FPR4110-04-A# show fault severity major
Severity Code Last Transition Time ID Description
--------- ----- ----------------------- ------ -----------
Major F0276 2023-12-14T18:26:29.505 507308 ether port 2/2 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Major F0276 2023-11-13T14:07:37.720 221350 ether port 1/1 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Major F0276 2023-11-07T08:10:50.143 434090 ether port 1/6 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Major F0276 2023-11-07T08:10:49.941 434081 ether port 1/5 on fabric interconnect A oper state: link-down, reason: Link failure or not-connected
Major F0282 2023-07-31T17:52:04.764 201600 lan port-channel 7 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:51:03.325 201446 lan port-channel 4 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:49:00.451 201281 lan port-channel 2 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:42:34.236 200638 lan port-channel 1 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:41:34.673 200660 lan port-channel 3 on fabric interconnect A oper state: failed, reason: No operational members
Major F0408 2011-12-31T21:32:32.787 35497 Power state on chassis 1 is redundancy-faile

电源问题

对于电源问题，“Voltage Problem（电压问题）”状态表示存在问题。

FPR4110-04-A# scope chassis 1
FPR4110-04-A /chassis # show psu

PSU:
PSU Type Wattage (W) Overall Status
--- ---- ----------- --------------
 1 DV 0 N/A
 2 DV 1100 Operable

风扇问题

如果存在热故障，很可能是冷却/风扇的合理硬件问题，也可能是软件缺陷引起的误报。如果风扇状态为“无法运行”或“已降级”，请与TAC联系以获取进一步帮助。

FPR4110-04-A# scope chassis 1
FPR4110-04-A /chassis # show fan-module
Fan Module:
Tray Module Overall Status
----------- --------- --------------
1 1 Operable
1 2 Operable
1 3 Operable
1 4 Operable
1 5 Operable
1 6 Operable

显示事件

检查应用故障的FXOS非常重要，以了解问题是否出在刀片本身，或应用是否因软件相关问题无法启动。

FPR4110-04-A# scope chassis
FPR4110-04-A /chassis # scope server
FPR4110-04-A /chassis/server # scope fxos
FPR4110-04-A /chassis/server/fxos # show event
Creation Time ID Code Description
----------------------- ------- -------- -----------
2024-01-25T14:09:32.783 588408 E4197910 [FSM:STAGE:END]: Waiting for install license complete from blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:HostWaitForLicInstalledComplete)
2024-01-25T14:09:32.783 588409 E4197611 [FSM:STAGE:SKIP]: Reboot blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RebootHostAfterUpgrade)
2024-01-25T14:09:32.783 588410 E4197611 [FSM:STAGE:END]: Reboot blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RebootHostAfterUpgrade)
2024-01-25T14:09:32.783 588411 E4197612 [FSM:END]: Init OS on blade 1/1(FSM:sam:dme:OsControllerInitOS)
2024-01-25T14:09:32.783 588412 E4197612 [FSM:STAGE:END]: (FSM-STAGE:sam:dme:OsControllerInitOS:success)
2024-01-25T14:09:32.782 588405 E4197909 [FSM:STAGE:STALE-SUCCESS]: Request for upgrade to blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RequestToInstallLicense)
2024-01-25T14:09:32.782 588406 E4197909 [FSM:STAGE:END]: Request for upgrade to blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RequestToInstallLicense)
2024-01-25T14:09:32.782 588407 E4197910 [FSM:STAGE:SKIP]: Waiting for install license complete from blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:HostWaitForLicInstalledComplete)
2024-01-25T14:09:32.773 588404 E4197909 [FSM:STAGE:ASYNC]: Request for upgrade to blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RequestToInstallLicense)
2024-01-25T14:09:32.768 588401 E4197609 [FSM:STAGE:END]: Request for upgrade to blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:RequestToUpgrade)
2024-01-25T14:09:32.768 588402 E4197610 [FSM:STAGE:SKIP]: Waiting for upgrade complete from blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:HostWaitForUpgradeComplete)
2024-01-25T14:09:32.768 588403 E4197610 [FSM:STAGE:END]: Waiting for upgrade complete from blade 1/1(FSM-STAGE:sam:dme:OsControllerInitOS:HostWaitForUpgradeComplete)
FPR4110-04-A /chassis/server/fxos # 

Show System Reset-reason

对于意外应用/设备重新加载，请验证是否存在任何进程(FTD)的核心，并使用show crash命令检查ASA/Lina crashinfo。如果它们不存在，则问题可能与FXOS相关，并可使用FXOS关键字进行路由。

FPR4110-04-A# connect fxos
FPR4110-04-A(fxos)# show system reset-reason
----- reset reason for Supervisor-module 1 (from Supervisor in slot 1) ---
1) No time
Reason: Unknown
Service: 
Version: 5.0(3)N2(4.101)

2) No time
Reason: Unknown
Service: 
Version: 5.0(3)N2(4.101)
...

主板电源问题

FPR4110-04-A# scope chassis 1
FPR4110-04-A /chassis # scope server 1/1
FPR4110-04-A /chassis/server # show fsm status

Slot: 1
Server: sys/chassis-1/blade-1
 
FSM 1:
Remote Result: Not Applicable
Remote Error Code: None
Remote Error Description:
Status: Nop
Previous Status: Turnup Success
Timestamp: 2023-10-23T16:48:19.299
Try: 0
Flags: 0
Progress (%): 100
Current Task:

 FSM 2:
Status: Nop
Previous Status: Identify Success
Timestamp: 2023-10-23T16:47:33.592
Try: 0
Progress (%): 100
Current Task:

 FSM 3:
Status: Nop
Previous Status: Configure Success
Timestamp: 2023-10-23T16:48:16.739
Try: 0
Flags: 0
Progress (%): 100
Current Task:

FPR4110-04-A /chassis/server # show fault
Severity Code Last Transition Time ID Description
--------- ------- ------------------------ -------- -----------
Info F0461 2011-12-31T21:32:43.448 35793 Log capacity on Management Controller on server 1/1 is very-low

逻辑设备

如背景信息中所述，逻辑设备允许您运行ASA或FTD应用实例。

以下是一些用于确认机箱中安装的应用实例状态的命令。

监控实例

显示服务器状态

查看插槽和发现状态。

FPR4110-04-A# show server status
Server Slot Status Overall Status Discovery
------- ------------ ------- ---------
1/1 Equipped Ok Complete

显示插槽

查看日志级别、管理状态和插槽的可操作状态。

FPR4110-04-A# scope ssa
FPR4110-04-A /ssa # show slot

Slot:
Slot ID Log Level Admin State Oper State
------- --------- ------------ ----------
1 Info Ok Online

显示应用程序实例

查看名称、版本、作者、支持的部署类型、CSP类型以及是否使用默认应用。

FPR4110-04-A# scope ssa
FPR4110-04-A /ssa # show app
Name Version Author Supported Deploy Types CSP Type Is Default App
---- -------- ------ ---------------------- ----------- --------------
ftd 7.0.4-55 cisco Native,Container Application No
ftd 7.0.5-72 cisco Native,Container Application Yes

显示逻辑设备

FPR4110-04-A# scope ssa
FPR4110-04-A /ssa # show logical-device

Logical Device:
Name Description Slot ID Mode Oper State Template Name
---- ----------- ------- ---------- ---------- -------------
FTD1 1 Standalone Ok ftd

显示应用实例

在插槽范围下使用show app-instance查看应用实例的运行状态的完整信息。

此命令特别有助于创建或升级应用程序实例，如它在运行状态（如果它正在安装或联机）和正在运行的软件版本中所示。

FPR4110-04-A# scope ssa
FPR4110-04-A /ssa # scope slot 1
FPR4110-04-A /ssa/slot # show app-instance
Application Instance:
App Name Identifier Admin State Oper State Running Version Startup Version Deploy Type Turbo Mode Profile Name Cluster State Cluster Role
-------- ---------- ----------- ---------- --------------- --------------- ----------- ---------- ------------ -------------- ------------
ftd FTD1 Enabled Online 7.0.5-72 7.0.5-72 Native No Not Applicable None

显示应用实例详细信息

FPR4110-04-A# scope ssa
FPR4110-04-A /ssa # show app-instance detail

App Name: ftd
Identifier: FTD1
Slot ID: 1
Admin State: Enabled
Oper State: Online
Running Version: 7.0.5-72
Startup Version: 7.0.5-72
Deploy Type: Native
Profile Name:
Cluster State: Not Applicable
Cluster Role: None
Current Job Type: Start
Current Job Progress: 100
Current Job State: Succeeded
Clear Log Data: Available
Error Msg:
Hotfixes:
Externally Upgraded: No
FPR4110-04-A /ssa #

显示资源详细信息


查看应用程序实例的资源分配。

FPR4110-04-A# scope ssa
FPR4110-04-A /ssa # scope slot 1
FPR4110-04-A /ssa/slot # enter app-instance ftd FTD1
FPR4110-04-A /ssa/slot/app-instance # show resource detail

Resource:
Allocated Core NR: 22
Allocated RAM (MB): 52096
Allocated Data Disk (MB): 128685
Allocated Binary Disk (MB): 3907
Allocated Secondary Disk (MB): 0

机箱管理器访问

访问本地Web服务器

默认情况下，安全防火墙威胁防御4100/9300机箱拒绝对本地Web服务器的所有访问。您必须使用每个IP块允许的服务的列表配置IP访问列表。

IP访问列表支持以下协议：

• HTTPS

• SNMP

• SSH

FPR4110-04-A# scope system
FPR4110-04-A /system # scope services
FPR4110-04-A /system/services # show ip-block 

Permitted IP Block:
IP Address Prefix Length Protocol
---------- ------------- --------
0.0.0.0 0 https
0.0.0.0 0 snmp

命令enter用于配置新条目。

FPR4110-04-A /system/services # enter ?
dns Domain Name Server hostname 
ip-block Permitted IP Block 
ipv6-block Permitted IPv6 Block 
ntp-server NTP server hostname 
ssh-host SSH Server public keys 

FPR4110-04-A /system/services # enter ip-block ?
a.b.c.d IP Address

FPR4110-04-A /system/services # enter ip-block 0.0.0.0 ?
0-32 Prefix Length 

FPR4110-04-A /system/services # enter ip-block 0.0.0.0 0 ?
https Https 
snmp Snmp 
ssh Ssh

FPR4110-04-A /system/services/ # enter ip-block 0.0.0.0 0 ssh
FPR4110-04-A /system/services/ip-block* # commit-buffer
FPR4110-04-A /system/services/ip-block # up
FPR4110-04-A /system/services # show ip-block 

Permitted IP Block:
IP Address Prefix Length Protocol
---------- ------------- --------
0.0.0.0 0 https
0.0.0.0 0 snmp
0.0.0.0 0 ssh

监控接口

验证机箱管理IP

FPR4110-04-A# show fabric-interconnect 

Fabric Interconnect:
ID OOB IP Addr OOB Gateway OOB Netmask OOB IPv6 Address OOB IPv6 Gateway Prefix Operability Ingress VLAN Group Entry Count (Current/Max) Switch Forwarding Path Entry Count (Current/Max)
--- ------------ ------------ --------------- ---------------- ---------------- ------ ----------- -------------------------------------------- ------------------------------------------------
A 172.16.244.72 172.16.244.65 255.255.255.192 :: :: 64 Operable 0/500 53/102

Show Mgmt-port

确定管理接口的状态。

FPR4110-04-A# connect local-mgmt 
FPR4110-04-A(local-mgmt)# 
FPR4110-04-A(local-mgmt)# show mgmt-port
eth0 Link encap:Ethernet HWaddr 50:0f:80:8e:a5:cd 
inet addr:172.16.244.72 Bcast:172.16.244.127 Mask:255.255.255.192
inet6 addr: fe80::520f:80ff:fe8e:a5cd/64 Scope:Link
inet6 addr: fe80::520f:80ff:fe8e:a5cd/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:7359566 errors:0 dropped:0 overruns:0 frame:0
TX packets:1147585 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000 
RX bytes:1735874306 (1.6 GiB) TX bytes:360530127 (343.8 MiB)

Ping可用于测试连接。

FPR4110-04-A(local-mgmt)# ping 172.16.244.65
PING 172.16.244.65 (172.16.244.65) from 172.16.244.72 eth0: 56(84) bytes of data.
64 bytes from 172.16.244.65: icmp_seq=1 ttl=254 time=1.15 ms
64 bytes from 172.16.244.65: icmp_seq=2 ttl=254 time=1.38 ms
^C
--- 172.16.244.65 ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 12ms
rtt min/avg/max/mdev = 1.146/1.364/1.479/0.122 ms
FPR4110-04-A(local-mgmt)# 

在管理接口上设置捕获

在机箱(MIO)管理接口上启用捕获（仅适用于FP41xx/FP93xx）。默认情况下，它仅捕获10个数据包。

FPR4110-04-A# connect fxos
FPR4110-04-A(fxos)# ethanalyzer local interface mgmt
Capturing on 'eth0'
1 2024-01-30 16:15:56.149887591 fe80::6a9e:bff:fed5:678c → ff02::2 ICMPv6 70 Router Solicitation from 68:9e:0b:d5:67:8c
2 2024-01-30 16:15:56.635897727 80:b7:09:32:f2:a0 → ff:ff:ff:ff:ff:ff ARP 60 Who has 172.16.244.65? Tell 172.16.244.106
3 2024-01-30 16:15:56.650081622 c4:72:95:76:df:97 → 01:80:c2:00:00:00 STP 60 RST. Root = 0/12/2c:31:24:b1:6b:00 Cost = 4 Port = 0x8017
4 2024-01-30 16:15:57.170356692 172.16.244.72 → 172.16.254.131 NTP 90 NTP Version 3, client
5 2024-01-30 16:15:57.234298977 172.16.254.131 → 172.16.244.72 NTP 90 NTP Version 3, server
6 2024-01-30 16:15:58.656444769 c4:72:95:76:df:97 → 01:80:c2:00:00:00 STP 60 RST. Root = 0/12/2c:31:24:b1:6b:00 Cost = 4 Port = 0x8017
7 2024-01-30 16:15:59.170382028 172.16.244.72 → 172.16.254.131 NTP 90 NTP Version 3, client
8 2024-01-30 16:15:59.233556065 172.16.254.131 → 172.16.244.72 NTP 90 NTP Version 3, server
9 2024-01-30 16:15:59.352654266 0.0.0.0 → 255.255.255.255 DHCP 368 DHCP Discover - Transaction ID 0x328ec1b7
10 2024-01-30 16:16:00.150684560 fe80::6a9e:bff:fed5:678c → ff02::2 ICMPv6 70 Router Solicitation from 68:9e:0b:d5:67:8c
10 packets captured
Program exited with status 0

Ethanalyzer也可用于传入界面。选项为高优先级或低优先级日志。

FPR4110-04-A(fxos)# ethanalyzer local interface ?
inbound-hi Inbound(high priority) interface
inbound-low Inbound(low priority) interface
mgmt Management interface

可以对捕获使用过滤器。

FPR4110-04-A(fxos)# ethanalyzer local interface ?
inbound-hi Inbound(high priority) interface
inbound-low Inbound(low priority) interface
mgmt Management interface

show interface

此命令显示机箱中接口的列表和当前状态，简要说明每种可操作状态的原因。

FPR4110-04-A# scope eth-uplink 
FPR4110-04-A /eth-uplink # scope fabric a
FPR4110-04-A /eth-uplink/fabric # show interface

Interface:
Port Name Port Type Admin State Oper State Allowed Vlan State Reason
----------- --------- ----------- ---------- ------------ ------------
Ethernet1/1 Data Enabled Link Down All Link failure or not-connected
Ethernet1/2 Data Disabled Admin Down All Administratively down
Ethernet1/3 Data Enabled Up All Port is enabled and up
Ethernet1/4 Data Enabled Up All Port is enabled and up
Ethernet1/5 Data Enabled Link Down All Link failure or not-connected
Ethernet1/6 Data Enabled Link Down All Link failure or not-connected
Ethernet1/7 Data Enabled Sfp Not Present All Unknown
Ethernet1/8 Mgmt Enabled Up All Port is enabled and up
Ethernet2/2 Data Enabled Link Down All Link failure or not-connected
Ethernet2/5 Data Disabled Sfp Not Present All Unknown
Ethernet2/6 Data Disabled Sfp Not Present All Unknown
Ethernet2/7 Data Disabled Sfp Not Present All Unknown
Ethernet2/8 Data Disabled Sfp Not Present All Unknow

如前所述，故障表示在安全防火墙平台上发现的任何硬件问题。您可以检查不同范围中的故障，缩小每个范围中的问题范围。此示例显示以太上行链路中的故障。

FPR4110-04-A# scope eth-uplink 
FPR4110-04-A /eth-uplink # show fault
Severity Code Last Transition Time ID Description
--------- ------ ------------------------ ------- -----------
Major F0727 2024-01-29T20:31:54.282 597025 lan Member 2/3 of Port-Channel 1 on fabric interconnect A is down, membership: down
Major F0727 2024-01-29T20:31:54.282 597023 lan Member 2/4 of Port-Channel 1 on fabric interconnect A is down, membership: down
Major F0282 2023-07-31T17:52:04.764 201600 lan port-channel 7 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:51:03.325 201446 lan port-channel 4 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:49:00.451 201281 lan port-channel 2 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:42:34.236 200638 lan port-channel 1 on fabric interconnect A oper state: failed, reason: No operational members
Major F0282 2023-07-31T17:41:34.673 200660 lan port-channel 3 on fabric interconnect A oper state: failed, reason: No operational member

显示端口通道

这显示机箱中配置的端口通道数量及其常规状态。

您可以移动到特定端口通道范围以获取成员信息。

如果您看到port-channel发生故障，请与TAC联系以获取进一步帮助，因为这是端口信道发生故障的示例。

FPR4110-04-A# scope eth-uplink
FPR4110-04-A /eth-uplink # scope fabric a
FPR4110-04-A /eth-uplink/fabric # show port-channel
Port Channel:
Port Channel Id Name Port Type Admin State Oper State Port Channel Mode Allowed Vlan State Reason
--------------- -------------- --------- ----------- ---------- ----------------- ------------ ------------
1 Port-channel1 Data Enabled Failed Active All No operational members
2 Port-channel2 Data Enabled Failed Active All No operational members
3 Port-channel3 Data Enabled Failed Active All No operational members
4 Port-channel4 Data Enabled Failed Active All No operational members
7 Port-channel7 Data Enabled Failed Active All No operational members

FPR4110-04-A /eth-uplink/fabric # scope port-channel 1
FPR4110-04-A /eth-uplink/fabric/port-channel # show member

Member Port:
Port Name Membership Oper State State Reason
----------- ---------- ---------------- ------------
Ethernet2/3 Down Sfp Not Present Unknown
Ethernet2/4 Down Sfp Not Present Unknown

使用命令show port-channel summary查看设备上的所有端口信道及其成员

FPR4110-04-A# connect fxos
FPR4110-04-A(fxos)# show port-channel summary
Flags: 
D - Down 
P - Up in port-channel (members)
I - Individual H - Hot-standby (LACP only)
s - Suspended r - Module-removed
S - Switched R - Routed
U - Up (port-channel)
M - Not in use. Min-links not met
--------------------------------------------------------------------------------
Group Port-Channel Type Protocol Member Ports
--------------------------------------------------------------------------------
1 Po1(SD) Eth LACP Eth2/3(D) Eth2/4(D) 
2 Po2(SD) Eth NONE --
3 Po3(SD) Eth NONE --
4 Po4(SD) Eth NONE --
7 Po7(SD) Eth NONE --

相关信息

• 生成FXOS故障排除文件
• 回答Firepower可扩展操作系统(FXOS)常见问题
• 配置Firepower设备上的NTP设置并对其进行故障排除
• 配置并验证Firepower设备上的端口通道