對「遠端FMC未成功更新」進行故障排除
目錄
簡介
本文描述如何對「遠端FMC未成功更新」進行故障排除。更新此對等體之前，請完成遠端FMC上的更新。
必要條件
需求
思科建議您瞭解以下主題：
- Firepower Management Center (FMC)
- FMC CLI基礎知識。
採用元件
本文件所述內容不限於特定軟體和硬體版本。
本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。
背景資訊
錯誤消息
錯誤 "Remote FMC is not updated successfully. Complete the update on remote FMC before updating this peer" 嘗試升級FMC高可用性(HA)對管理的裝置時，會顯示在FMC GUI上。此錯誤不允許啟動受管裝置的升級。以下是錯誤警報在GUI中的外觀：
也可以使用expert mode命令cat /var/log/httpd/httpd_error_log.1從FMC的CLI驗證錯誤 | grep -i '遠端FMC'。
> expert
root@FMC:~$ cat /var/log/httpd/httpd_error_log.1 | grep -i 'Remote FMC'
[Mon Jan 30 07:20:10.062741 2022] [cgi:error] [pid 5906] [client 192.168.1.10:45267] AH01215: (Remote FMC is not updated successfully. Complete the update on remote FMC before updating this peer.) in /usr/local/sf/htdocs/admin/update.cgi:331 at /usr/local/sf/lib/perl/5.10.1/SF.pm line 120.: /usr/local/sf/htdocs/admin/update.cgi, referer:
[Mon Jan 30 07:22:43.370986 2022] [cgi:error] [pid 15376] [clien 192.168.1.10:45267] AH01215: (Remote FMC is not updated successfully. Complete the update on remote FMC before updating this peer.) in /usr/local/sf/htdocs/admin/update.cgi:331 at /usr/local/sf/lib/perl/5.10.1/SF.pm line 120.: /usr/local/sf/htdocs/admin/update.cgi, referer:
錯誤原因
當HA中的兩個FMC之間的軟體補丁版本、漏洞資料庫(VDB)版本、入侵規則(SRU)版本或地理定位資料庫(GeoDB)版本不匹配時，會發生此錯誤。當列出的任何版本更新停滯或安裝失敗時，就會發生不匹配。當您在幫助>關於部分下從FMC UI檢查版本時，看不到此不匹配項，但是建議您在兩個FMC上檢查此頁面進行驗證。
找出問題
從GUI檢查HA中FMC的版本
在FMC GUI中，轉至幫助>關於，以確認在HA中兩個FMC上的軟體補丁程式、VDB、SRU和GeoDB的版本均相同。以下影像顯示來自GUI的HA中兩個FMC的版本相符的範例：
. 
從CLI在HA中驗證FMC上VDB、SRU和GeoDB版本的安裝狀態
在FMC CLI的專家模式下，您需要驗證VDB、SRU和GeoDB更新是否已完全安裝，且在HA中的兩個FMC上沒有任何故障。
檢查VDB安裝狀態
在FMC CLI的專家模式下，使用以下命令cat /var/log/sf/<vdb-image-folder>/status.log 驗證VDB更新是否成功。以下是成功安裝VDB的範例：
root@FMC:~$ cat /var/log/sf/vdb-4.5.0-338/status.log
state:running
ui:The install has begun
ui:[ 0%] Running script pre/000_start.sh...
ui:[ 4%] Running script pre/010_check_versions.sh...
ui:[ 8%] Running script pre/011_check_versions.pl...
ui:[12%] Running script pre/020_check_space.sh...
ui:[15%] Running script pre/500_stop_rna.pl...
ui:[19%] Running script pre/999_finish.sh...
ui:[23%] Running script installer/000_start.sh...
ui:[27%] Running script installer/100_install_files.pl...
ui:[31%] Running script installer/200_install_fingerprints.sh...
ui:[35%] Running script installer/300_install_vdb.sh...
ui:[38%] Running script installer/400_install_rdps.pl...
ui:[42%] Running script installer/420_delete_obsolete_ids.pl...
ui:[46%] Running script installer/450_resave_detectors.pl...
ui:[50%] Running script installer/525_export_compliance_policies.pl...
ui:[54%] Running script installer/600_fix_dbcheck.sh...
ui:[58%] Running script installer/605_install_dbcheck_upgrade_script.sh...
ui:[62%] Running script installer/610_install_missing_upgrade_script.sh...
ui:[65%] Running script installer/615_purge_vdb_149_log.sh...
ui:[69%] Running script installer/900_update_version.sh...
ui:[73%] Running script installer/901_update_db_version.pl...
ui:[77%] Running script installer/950_reapply_to_sensor.pl...
ui:[81%] Running script installer/975_export_data.pl...
ui:[85%] Running script installer/999_finish.sh...
ui:[88%] Running script post/000_start.sh...
ui:[92%] Running script post/500_start_rna.pl...
ui:[96%] Running script post/999_finish.sh...
ui:[100%] The install completed successfully.
ui:The install has completed.
state:finished
檢查SRU安裝狀態
在FMC CLI的專家模式下，使用命令cat /var/log/sf/<sru-image-folder>/status.log 驗證SRU更新是否成功。以下是成功安裝SRU的範例：
root@FMC:~$ cat /var/log/sf/sru-2021-05-03-001-vrt/status.log
state:running
ui:The force install has begun.
ui:[ 0%] Running script pre/000_start.sh...
ui:[ 5%] Running script pre/010_check_versions.sh...
ui:[11%] Running script pre/020_check_space.sh...
ui:[16%] Running script pre/999_finish.sh...
ui:[21%] Running script installer/000_start.sh...
ui:[26%] Running script installer/050_sru_log_start.pl...
ui:[32%] Running script installer/100_install_files.pl...
ui:[37%] Running script installer/510_install_policy.pl...
ui:[42%] Running script installer/520_install_rules.pl...
ui:[47%] Running script installer/521_rule_docs.sh...
ui:[53%] Running script installer/530_install_module_rules.pl...
ui:[58%] Running script installer/540_install_decoder_rules.pl...
ui:[63%] Running script installer/602_log_package.pl...
ui:[68%] Running script installer/900_update_version.sh...
ui:[74%] Running script installer/999_finish.sh...
ui:[79%] Running script post/000_start.sh...
ui:[84%] Running script post/500_copy_contents.sh...
ui:[89%] Running script post/900_iru_log_finish.pl...
ui:[95%] Running script post/999_finish.sh...
ui:[100%] The force install completed successfully.
ui:The force install has completed.
state:finished
檢查GeoDB安裝狀態
在FMC CLI的專家模式下，使用cat /var/log/sf/<geodb-image-folder>/status.log 命令驗證GeoDB更新是否成功。以下是成功安裝GeoDB的示例：
root@FMC:~$ cat /var/log/sf/geodb-2022-08-02-100/status.log
state:running
ui:The install has begun.
ui:[ 0%] Running script installer/200_prechecks.pl...
ui:[33%] Running script installer/500_install_country_map.pl...
ui:[67%] Running script installer/601_fix_country.pl...
ui:[100%] The install completed successfully.
ui:The install has completed.
state:finished
如果安裝失敗或由於任何原因而停滯，您可以從status.log中看到此失敗或停滯的步驟。以下是在FMC上安裝GeoDB失敗的示例：
root@FMC:~$ cat /var/log/sf/geodb-2022-07-17-100/status.log
state:running
ui:The install has begun.
ui:[ 0%] Running script installer/200_prechecks.pl...
ui:[33%] Running script installer/500_install_country_map.pl...
ui:[67%] Running script installer/601_fix_country.pl...
ui:[67%] Fatal error: Error running script installer/601_fix_country.pl
從CLI驗證HA中FMC上軟體版本和修補程式的安裝狀態
在FMC CLI的專家模式下，使用cat /etc/sf/patch_history命令驗證兩個FMC是否安裝了相同的版本和修補程式。運行此命令可識別兩個FMC上的任何不匹配。以下是CLI中修補程式不匹配的示例：
root@FMC:~$ cat /etc/sf/patch_history 6.2.3-83
6.6.0-90 6.6.4-59 6.6.5-81 Hotfix_DE-8__413769962 <<<<<<<<<<< Here the FMC seems to have a Hotfix installation image that is not present from the other FMC
------------------------------------------------------------------- root@FMC:~$ cat /etc/sf/patch_history 6.2.3-83
6.6.0-90 6.6.4-59 6.6.5-81
要進一步檢查FMC中熱修復程式的安裝是否成功，您需要檢查此映像資料夾的status.log:
root@FMC:~$ cat /var/log/sf/Cisco_Firepower_Mgmt_Center_Hotfix_DE-6.6.5.2/status.log
ui:[98%] Upgrade complete ui:[99%] Running script 999_finish/999_z_must_remain_last_finalize_boot.sh... ui:[99%] Running script 999_finish/999_zz_install_bundle.sh... ui:[100%] The system will now restart services. ui:System will now restart services. ui:[100%] Installation completed successfully. ui:Upgrade has completed. state:finished
此範例驗證修補程式映像是否不存在於HA中的其中一個FMC中，而另一個已成功安裝修補程式。
疑難排解
要解決錯誤，您必須從發現問題的FMC的CLI手動強制安裝更新。
Disclaimer: Root access to the FMC devices is required in order to execute the commands under this section. Please use caution when running commands from the root of the FMC.
VDB、SRU和GeoDB更新問題
識別VDB、SRU或GeoDB更新問題後，請通過CLI命令install_update.pl /var/sf/updates/<image-file> —force執行手動強制安裝。以下是GeoDB更新手動強制安裝的示例：
> expert
root@FMC:~$ sudo su
<Enter the root password>
root@FMC:# install_update.pl /var/sf/updates/Cisco_Firepower_GEODB_FMC_Update-2022-08-02-100.sh.REL.tar --force
修補程式安裝問題
對於修補程式/修補程式安裝，您需要下載修補程式檔案並將其安裝到FMC，其中通過GUI或CLI的修補程式檔案不存在。
FMC GUI 設定：
轉至System > Updates > Product Updates，並上傳要安裝的修補程式版本。然後按一下Install選項，選擇需要安裝修補程式的裝置並繼續安裝。
在FMC CLI上：
要從FMC CLI安裝軟體/修補程式，請將修補程式升級檔案上載到FMC CLI上的/var/log/sf/路徑，然後執行命令install_update.pl /var/log/sf/<image-file>。此命令在同一螢幕上運行升級日誌，以便我們監視進度。以下是從CLI安裝修補程式的示例：
> expert
root@FMC:~$ sudo su
<Enter the root password>
root@FMC:# install_update.pl /var/log/sf/Cisco_Firepower_Mgmt_Center_Hotfix_DE-6.6.5.2
如果SSH會話超時，請使用命令install_update.pl -detach /var/log/sf/<image-file> 在後台運行安裝。這樣，即使SSH會話已關閉，仍可運行升級。
驗證
VDB、SRU或GeoDB更新
手動強制安裝完成後，可以使用cat /var/log/sf/<image-version-folder>/status.log 命令從CLI驗證安裝狀態，以進行VDB、SRU和GeoDB更新。下面是一個成功安裝GeoDB的status.log輸出示例：
root@FMC:/Volume/home/admin# cat /var/log/sf/geodb-2022-08-02-100/status.log
state:running
ui:The force install has begun.
ui:[ 0%] Running script installer/200_prechecks.pl...
ui:[33%] Running script installer/500_install_country_map.pl...
ui:[67%] Running script installer/601_fix_country.pl...
ui:[100%] The force install completed successfully.
ui:The force install has completed.
state:finished
修補程式或修補程式更新
手動安裝更新後，從CLI執行cat /var/log/sf/<patch-image-folder>/status.log 命令以驗證此安裝的狀態。以下是成功安裝的status.log輸出的範例：
root@FMC:/var/log/sf/Cisco_Firepower_Mgmt_Center_Hotfix_DE-6.6.5.2# tail -f status.log
ui:[98%] Upgrade complete
ui:[99%] Running script 999_finish/999_z_must_remain_last_finalize_boot.sh...
ui:[99%] Running script 999_finish/999_zz_install_bundle.sh...
ui:[100%] The system will now restart services.
ui:System will now restart services.
ui:[100%] Installation completed successfully.
ui:Upgrade has completed.
state:finished
修訂記錄
| 修訂 | 發佈日期 | 意見 |
|---|---|---|
1.0 |
26-Aug-2022 |
初始版本 |
意見