FXOS CLI Troubleshooting Commands

FXOS CLI Chassis Mode Troubleshooting Commands

Use the following chassis mode FXOS CLI commands to troubleshoot issues with your system.

show environment
Displays environment information for the chassis.
For example:
FPR2100 /chassis # show environment expand detail
Chassis 1:
Overall Status: Power Problem
        Operability: Operable
        Power State: Ok
        Thermal Status: Ok
PSU 1:
            Overall Status: Powered Off
            Operability: Unknown
            Power State: Off
            Voltage Status: Unknown
        PSU 2:
            Overall Status: Operable
            Operability: Operable
            Power State: On
            Voltage Status: Ok
        Tray 1 Module 1:
            Overall Status: Operable
            Operability: Operable
            Power State: On
Fan 1:
            Overall Status: Operable
            Operability: Operable
            Power State: On
        Fan 2:
            Overall Status: Operable
            Operability: Operable
            Power State: On
        Fan 3:
            Overall Status: Operable
            Operability: Operable
            Power State: On
        Fan 4:
            Overall Status: Operable
            Operability: Operable
            Power State: On
        Server 1:
            Overall Status: Ok
                Memory Array 1:
                    Current Capacity (MB): 32768
                    Populated: 2
                    DIMMs:
                    ID  Overall Status           Capacity (MB)
                    --- ------------------------ -------------
                      1 Operable                 16384
                      2 Operable                 16384
                CPU 1:
                    Presence: Equipped
                    Cores: 8
                    Product Name: Intel(R) Xeon(R) CPU D-1548 @ 2.00GHz
                    Vendor: GenuineIntel
                    Thermal Status: OK
                    Overall Status: Operable
                    Operability: Operable

Note


When you remove dual fan module for Secure Firewall 3100 devices, to view the actual status of the fan, use the show environment basic and show environment expand commands.


show environmentbasic
Displays chassis and CPU temperature data.
For example:
FPR2100 /chassis # show environment basic
     ***************  Chassis Temps  ***************
     Inlet temperature is 75 degrees Celsius
     
     ***************  CPU Data  ***************
     Core Temperature 0 is 93 degrees Celsius
     Core Temperature 1 is 93 degrees Celsius
     Core Temperature 2 is 94 degrees Celsius
     Core Temperature 3 is 92 degrees Celsius
scope fan
Enters the fan mode on Firepower 2110, 2120, Secure Firewall 3100, and Secure Firewall 4200 devices.
scope fan-module
Enters the fan mode on Firepower 2130, 2140, Secure Firewall 3100, and Secure Firewall 4200 devices. From this mode, you can display detailed information about the chassis fan.
For example:
FPR2100 /chassis # show fan-module expand detail
    Fan Module:
        Tray: 1
        Module: 1
        Overall Status: Operable
        Operability: Operable
        Power State: On
        Presence: Equipped
        Product Name: Cisco Firepower 2000 Series Fan Tray
        PID: FPR2K-FAN
        Vendor: Cisco Systems, Inc
        Fan:
            ID: 1
            Overall Status: Operable
            Operability: Operable
            Power State: On
            Presence: Equipped
            ID: 2
            Overall Status: Operable
            Operability: Operable
            Power State: On
            Presence: Equipped
show inventory
Displays inventory information such as the chassis number, vendor, and serial number.
Note: This command only applies to Firepower 2130, Secure Firewall 3100, and 4200 devices.
For example:
    FPR2100 /chassis # show inventory
Chassis    PID             Vendor            Serial (SN) HW Revision
---------- --------------- ----------------- ----------- -----------
         1 FPR-2140        Cisco Systems, In JAD201005FC 0.1
show inventory expand
Displays detailed inventory information about FRUable components such as the chassis, PSU, and network modules.
For example:
    FPR2100 /chassis #   show inventory expand detail
    Chassis 1:
        Product Name: Cisco Firepower 2000 Appliance
        PID: FPR-2130
        VID: V01
        Vendor: Cisco Systems, Inc
        Model: FPR-2130
        Serial (SN): JAD2012091X
        HW Revision: 0.1
        PSU 1:
            Presence: Equipped
            Product Name: Cisco Firepower 2000 Series AC 400W Power Supply
            PID: FPR2K-PWR-AC-400
            VID: V01
            Vendor: Cisco Systems, Inc
            Serial (SN): LIT2010CAFE
            HW Revision: 0
        PSU 2:
            Presence: Equipped
            Product Name: Cisco Firepower 2000 Series AC 400W Power Supply
            PID: FPR2K-PWR-AC-400
            VID: V01
            Vendor: Cisco Systems, Inc
            Serial (SN): LIT2010CAFE
            HW Revision: 0
        Fan Modules:
            Tray 1 Module 1:
                Presence: Equipped
                Product Name: Cisco Firepower 2000 Series Fan Tray
                PID: FPR2K-FAN
                Vendor: Cisco Systems, Inc
        Fans:
            ID Presence
            -- --------
             1 Equipped
             2 Equipped
             3 Equipped
             4 Equipped
    Fabric Card 1:
        Description: Cisco SSP FPR 2130 Base Module
        Number of Ports: 16
        State: Online
        Vendor: Cisco Systems, Inc.
        Model: FPR-2130
        HW Revision: 0
        Serial (SN): JAD2012091X
        Perf: N/A
        Operability: Operable
        Overall Status: Operable
        Power State: Online
        Presence: Equipped
        Thermal Status: N/A
        Voltage Status: N/A
    Fabric Card 2:
        Description: 8-port 10 Gigabit Ethernet Expansion Module
        Number of Ports: 8
        State: Online
        Vendor: Cisco Systems, Inc.
        Model: FPR-NM-8X10G
        HW Revision: 0
        Serial (SN): JAD19510AKD
        Perf: N/A
        Operability: Operable
        Overall Status: Operable
        Power State: Online
        Presence: Equipped
        Thermal Status: N/A
        Voltage Status: N/A
scope psu
Enters the power supply unit mode. From this mode, you can view detailed information about the power supply unit.
For example:
    FPR2100 /chassis #  show psu expand detail     
    PSU:
        PSU: 1
        Overall Status: Powered Off
        Operability: Unknown
        Power State: Off
        Presence: Equipped
        Voltage Status: Unknown
        Product Name: Cisco Firepower 2000 Series AC 400W Power Supply
        PID: FPR2K-PWR-AC-400
        VID: V01
        Vendor: Cisco Systems, Inc
        Serial (SN): LIT2010CAFE
        Type: AC
        Fan Status: Ok
        PSU: 2
        Overall Status: Operable
        Operability: Operable
        Power State: On
        Presence: Equipped
        Voltage Status: Ok
        Product Name: Cisco Firepower 2000 Series AC 400W Power Supply
        PID: FPR2K-PWR-AC-400
        VID: V01
        Vendor: Cisco Systems, Inc
        Serial (SN): LIT2010CAFE
        Type: AC
        Fan Status: Ok
scope stats
Enters the stats mode. From this mode, you can view detailed information about the chassis statatistics.
For example:
    FPR2100 /chassis # show stats
    Chassis Stats:
        Time Collected: 2016-11-14T21:19:46.317
        Monitored Object: sys/chassis-1/stats
        Suspect: No
        Outlet Temp1 (C): 43.000000
        Outlet Temp2 (C): 41.000000
        Inlet Temp (C): 30.000000
        Internal Temp (C): 34.000000
        Thresholded: 0
    Fan Stats:
        Time Collected: 2016-11-14T21:19:46.317
        Monitored Object: sys/chassis-1/fan-module-1-1/fan-1/stats
        Suspect: No
        Speed (RPM): 17280
        Thresholded: 0
        Time Collected: 2016-11-14T21:19:46.317
        Monitored Object: sys/chassis-1/fan-module-1-1/fan-2/stats
        Suspect: No
        Speed (RPM): 17340
        Thresholded: 0
        Time Collected: 2016-11-14T21:19:46.317
        Monitored Object: sys/chassis-1/fan-module-1-1/fan-3/stats
        Suspect: No
        Speed (RPM): 17280
        Thresholded: 0
        Time Collected: 2016-11-14T21:19:46.317
        Monitored Object: sys/chassis-1/fan-module-1-1/fan-4/stats
        Suspect: No
        Speed (RPM): 17280
        Thresholded: 0     
    Psu Stats:
        Time Collected: 2016-11-14T21:19:46.318
        Monitored Object: sys/chassis-1/psu-1/stats
        Suspect: No
        Input Current (A): 0.000000
        Input Power (W): 8.000000
        Input Voltage (V): 0.000000
        Psu Temp1 (C): 32.000000
        Psu Temp2 (C): 36.000000
        Psu Temp3 (C): 32.000000
        Fan Speed (RPM): 0
        Thresholded: 0     
        Time Collected: 2016-11-14T21:19:46.318
        Monitored Object: sys/chassis-1/psu-2/stats
        Suspect: No
        Input Current (A): 0.374000
        Input Power (W): 112.000000
        Input Voltage (V): 238.503006
        Psu Temp1 (C): 36.000000
        Psu Temp2 (C): 47.000000
        Psu Temp3 (C): 47.000000
        Fan Speed (RPM): 2240
        Thresholded: 0
    CPU Env Stats:
        Time Collected: 2016-11-14T21:19:46.317
        Monitored Object: sys/chassis-1/blade-1/board/cpu-1/env-stats
        Suspect: No
        Temperature (C): 46.000000
        Thresholded: 0
        Time Collected: 2016-11-14T21:19:46.317
        Monitored Object: sys/chassis-1/blade-1/npu/cpu-1/env-stats
        Suspect: No
        Temperature (C): 38.000000
        Thresholded: 0
          

FXOS CLI Eth-Uplink Mode Troubleshooting Commands

Use the following eth-uplink mode FXOS CLI commands to troubleshoot issues with your system.

show detail
Displays detailed information about your Firepower 1000/2100, Secure Firewall 3100, or Secure Firewall 4200 device's Ethernet uplink.
For example:
    FPR2100 /eth-uplink # show detail
    Ethernet Uplink:
        Mode: Security Node
        MAC Table Aging Time (dd:hh:mm:ss): 00:04:01:40
        VLAN Port Count Optimization: Disabled
        Current Task:
scope fabric a
Enters the eth-uplink interface mode. From this mode, you can view port channel, statistics, and interface information.
For example:
FPR2100 /eth-uplink/fabric # show interface
Interface:
    Port Name      Port Type          Admin State Oper State       State Reason
    -------------- ------------------ ----------- ---------------- ------------
    Ethernet1/1    Data               Enabled     Up               Up
    Ethernet1/2    Data               Enabled     Link Down        Down
    Ethernet1/3    Data               Disabled    Link Down        Down
    Ethernet1/4    Data               Disabled    Link Down        Down
    Ethernet1/5    Data               Disabled    Link Down        Down
    Ethernet1/6    Data               Disabled    Link Down        Down
    Ethernet1/7    Data               Disabled    Link Down        Down
    Ethernet1/8    Data               Disabled    Link Down        Down
    Ethernet1/9    Data               Disabled    Link Down        Down
    Ethernet1/10   Data               Disabled    Link Down        Down
    Ethernet1/11   Data               Disabled    Link Down        Down
    Ethernet1/12   Data               Disabled    Link Down        Down
    Ethernet1/13   Data               Disabled    Link Down        Down
    Ethernet1/14   Data               Disabled    Link Down        Down
    Ethernet1/15   Data               Disabled    Link Down        Down
    Ethernet1/16   Data               Disabled    Link Down        Down
    Ethernet2/1    Data               Disabled    Link Down        Down
    Ethernet2/2    Data               Disabled    Link Down        Down
    Ethernet2/3    Data               Disabled    Link Down        Down
    Ethernet2/4    Data               Disabled    Link Down        Down
    Ethernet2/5    Data               Disabled    Link Down        Down
    Ethernet2/6    Data               Disabled    Link Down        Down
    Ethernet2/7    Data               Disabled    Link Down        Down
    Ethernet2/8    Data               Disabled    Link Down        Down
    FPR2100 /eth-uplink/fabric # show port-channel
    Port Channel:
        Port Channel Id Name             Port Type          Admin State            Oper State            State Reason
        --------------- ---------------- ------------------           -----------               ----------------           ------------
        1               Port-channel1    Data               Disabled                       Link Down                      Down
    FPR2100 /eth-uplink/fabric/port-channel # show stats
    Ether Error Stats:
        Time Collected: 2016-11-14T21:27:16.386
        Monitored Object: fabric/lan/A/pc-1/err-stats
        Suspect: No
        Rcv (errors): 0
        Align (errors): 0
        Fcs (errors): 0
        Xmit (errors): 0
        Under Size (errors): 0
        Out Discard (errors): 0
        Deferred Tx (errors): 0
        Int Mac Tx (errors): 0
        Int Mac Rx (errors): 0
        Thresholded: Xmit Delta Min     
    Ether Loss Stats:
        Time Collected: 2016-11-14T21:27:16.386
        Monitored Object: fabric/lan/A/pc-1/loss-stats
        Suspect: No
        Single Collision (errors): 0
        Multi Collision (errors): 0
        Late Collision (errors): 0
        Excess Collision (errors): 0
        Carrier Sense (errors): 0
        Giants (errors): 0
        Symbol (errors): 0
        SQE Test (errors): 0
        Thresholded: 0
    Ether Pause Stats:
        Time Collected: 2016-11-14T21:27:16.386
        Monitored Object: fabric/lan/A/pc-1/pause-stats
        Suspect: No
        Recv Pause (pause): 0
        Xmit Pause (pause): 0
        Resets (resets): 0
        Thresholded: 0
    Ether Rx Stats:
        Time Collected: 2016-11-14T21:27:16.386
        Monitored Object: fabric/lan/A/pc-1/rx-stats
        Suspect: No
        Total Packets (packets): 0
        Unicast Packets (packets): 0
        Multicast Packets (packets): 0
        Broadcast Packets (packets): 0
        Total Bytes (bytes): 0
        Jumbo Packets (packets): 0
        Thresholded: 0
    Ether Tx Stats:
       Time Collected: 2016-11-14T21:27:16.386
        Monitored Object: fabric/lan/A/pc-1/tx-stats
        Suspect: No
        Total Packets (packets): 0
        Unicast Packets (packets): 0
        Multicast Packets (packets): 0
        Broadcast Packets (packets): 0
        Total Bytes (bytes): 0
        Jumbo Packets (packets): 0
    FPR2100 /eth-uplink/fabric/interface # show stats
    Ether Error Stats:
        Time Collected: 2016-11-14T21:27:46.395
        Monitored Object: sys/switch-A/slot-1/switch-ether/port-1/err-stats
        Suspect: No
        Rcv (errors): 0
        Align (errors): 0
        Fcs (errors): 0
        Xmit (errors): 0
        Under Size (errors): 0
        Out Discard (errors): 0
        Deferred Tx (errors): 0
        Int Mac Tx (errors): 0
        Int Mac Rx (errors): 0
        Thresholded: Xmit Delta Min     
    Ether Loss Stats:
        Time Collected: 2016-11-14T21:27:46.395
        Monitored Object: sys/switch-A/slot-1/switch-ether/port-1/loss-stats
        Suspect: No
        Single Collision (errors): 0
        Multi Collision (errors): 0
        Late Collision (errors): 0
        Excess Collision (errors): 0
        Carrier Sense (errors): 0
        Giants (errors): 7180
        Symbol (errors): 0
        SQE Test (errors): 0
        Thresholded: 0     
    Ether Pause Stats:
        Time Collected: 2016-11-14T21:27:46.395
        Monitored Object: sys/switch-A/slot-1/switch-ether/port-1/pause-stats
        Suspect: No
        Recv Pause (pause): 0
        Xmit Pause (pause): 0
        Resets (resets): 0
        Thresholded: 0
    Ether Rx Stats:
        Time Collected: 2016-11-14T21:27:46.395
        Monitored Object: sys/switch-A/slot-1/switch-ether/port-1/rx-stats
        Suspect: No
        Total Packets (packets): 604527
        Unicast Packets (packets): 142906
        Multicast Packets (packets): 339031
        Broadcast Packets (packets): 122590
        Total Bytes (bytes): 59805045
        Jumbo Packets (packets): 0
        Thresholded: 0
    Ether Tx Stats:
        Time Collected: 2016-11-14T21:27:46.395
        Monitored Object: sys/switch-A/slot-1/switch-ether/port-1/tx-stats
        Suspect: No
        Total Packets (packets): 145018
        Unicast Packets (packets): 145005
        Multicast Packets (packets): 0
        Broadcast Packets (packets): 13
        Total Bytes (bytes): 13442404
        Jumbo Packets (packets): 0
        Thresholded: 0

FXOS CLI Fabric Interconnect Mode Troubleshooting Commands

Use the following fabric-interconnect mode FXOS CLI commands to troubleshoot issues with your system.

show card
Displays information on a fabric card.
For example:
    FPR2100 /fabric-interconnect # show card detail expand
    Fabric Card:
        Id: 1
        Description: Cisco SSP FPR 2130 Base Module
        Number of Ports: 16
        State: Online
        Vendor: Cisco Systems, Inc.
        Model: FPR-2130
        HW Revision: 0
        Serial (SN): JAD2012091X
        Perf: N/A
        Operability: Operable
        Overall Status: Operable
        Power State: Online
        Presence: Equipped
        Thermal Status: N/A
        Voltage Status: N/A
show card
Displays information on a fabric card details. This command can be used to display the network module details.
For example:

# firepower-4225 /fabric-interconnect # show card detail expand 

Fabric Card:
    Id: 2
    Description: 2-port 100 Gigabit Ethernet Expansion Module
    Number of Ports: 2
    Admin State: Enabled
    State: Online
    Vendor: Cisco Systems, Inc.
    Model: FPR-X-NM-2X100G
    Serial (SN): FJZ26390V7D
    Perf: N/A
    Operability: Operable
    Overall Status: Online
    Power State: Online
    Presence: Equipped
    Thermal Status: N/A
    Voltage Status: N/A
    Current Task:
show image
Displays all available images.
firepower /firmware # show image
Name                                          Type                 Version
--------------------------------------------- -------------------- -------
cisco-ftd.6.2.0.131.csp                       Firepower Cspapp     6.2.0.131
cisco-ftd.6.2.0.140.csp                       Firepower Cspapp     6.2.0.140
cisco-ftd.6.2.0.175.csp                       Firepower Cspapp     6.2.0.175
fxos-k8-fp2k-firmware.0.4.04.SPA              Firepower Firmware   0.4.04
fxos-k8-fp2k-lfbff.82.1.1.303i.SSA            Firepower System     82.1(1.303i)
fxos-k8-fp2k-npu.82.1.1.303i.SSA              Firepower Npu        82.1(1.303i)
fxos-k8-fp2k-npu.82.1.1.307i.SSA              Firepower Npu        82.1(1.307i)
fxos-k9-fp2k-manager.82.1.1.303i.SSA          Firepower Manager    82.1(1.303i)
show inventory expand
Displays all fabric card details. This command can be used to display the network module details.
firepower-4225 /fabric-interconnect # show inventory expand 
A:

    Fabric Card:

    Slot  Description          Num Ports  State      PID             Serial (SN)
    ----- -------------------- ---------- ---------- --------------- -----------
        0 Logical Slot for Management Interface
                                        2 N/A        FPR-4225        FJZ26345ZGZ
        1 Cisco FPR 4225 Base Module
                                        8 On         FPR-4225        FJZ26345ZGZ
        3 4-port 200 Gigabit Ethernet Expansion Module
                                        4 Online     FPR-X-NM-4X200G FJZ25430132

show package
Displays all available packages.
    firepower /firmware # show package
    Name                                          Package-Vers
    --------------------------------------------- ------------
    cisco-ftd-fp2k.6.2.0.131-303i.SSA             6.2(0.131-303i)
    cisco-ftd-fp2k.6.2.0.140-307i.SSA             6.2(0.140-307i)
    cisco-ftd-fp2k.6.2.0.140-308i.SSA             6.2(0.140-308i)
    cisco-ftd-fp2k.6.2.0.175-311i.SSA             6.2(0.175-311i)
    cisco-ftd-fp2k.6.2.0.175-314i.SSA             6.2(0.175-314i)
    cisco-ftd-fp2k.6.2.0.175-318i.SSA             6.2(0.175-318i)
    cisco-ftd-fp2k.6.2.0.175-319i.SSA             6.2(0.175-319i)
show package package name expand
Displays the package details.
    firepower /firmware # show package  cisco-ftd-fp2k.6.2.0.131-303i.SSA expand
    Package cisco-ftd-fp2k.6.2.0.131-303i.SSA:
        Images:
            cisco-ftd.6.2.0.131.csp
            fxos-k8-fp2k-firmware.0.4.04.SPA
            fxos-k8-fp2k-lfbff.82.1.1.303i.SSA
            fxos-k8-fp2k-npu.82.1.1.303i.SSA
            fxos-k9-fp2k-manager.82.1.1.303i.SSA
scope auto-install
Enters the auto-install mode. From this mode, you can view the current FXOS upgrade state.
    firepower /firmware/auto-install # show     
    Firmware Auto-Install:
        Package-Vers Oper State                   Upgrade State
        ------------ ---------------------------- -------------
        6.2(0.175-319i)            Scheduled                    Installing Application
scope firmware
Enters the firmware mode. From this mode, you can view download task information.
For example:
    FPR2100 /firmware # show download-task
    Download task:
        File Name                                                  Protocol Server          Port       Userid          State
        ---------                                                            -------- --------------- ---------- --------------- -----
        cisco-ftd-fp2k.6.2.0.175-314i.SSA              Scp      172.29.191.78            0 danp            Downloaded
       cisco-ftd-fp2k.6.2.0.175-318i.SSA               Scp      172.29.191.78            0 danp            Downloaded
        cisco-ftd-fp2k.6.2.0.175-319i.SSA              Scp      172.29.191.78            0 danp            Downloaded
scope download-task
Enters the download-task mode. From this mode, you can view additional details about each download task and restart the download task.
For example:
Download task:
    File Name: test.SSA
    Protocol: Scp
    Server: 172.29.191.78
    Port: 0
    Userid: user
    Path: /tmp
    Downloaded Image Size (KB): 0
    Time stamp: 2016-11-15T19:42:29.854
    State: Failed
    Transfer Rate (KB/s): 0.000000
    Current Task: deleting downloadable test.SSA on local(FSM-STAGE:sam:dme:FirmwareDownloaderDownload:DeleteLocal)
firepower /firmware/download-task # show fsm status 
File Name: test.SSA
    FSM 1:
        Remote Result: End Point Failed
        Remote Error Code: ERR MO Illegal Iterator State
        Remote Error Description: End point timed out. Check for IP, port, password, disk space or network access related issues.#
        Status: Download Fail
        Previous Status: Download Fail
        Timestamp: 2016-11-15T19:42:29.854
        Try: 2
        Progress (%): 0
        Current Task: deleting downloadable test.SSA on local(FSM-STAGE:sam:dme:FirmwareDownloaderDownload:DeleteLocal)
    firepower /firmware/download-task # restart
    Password:
scope psu
Enters the power supply unit mode. From this mode, you can view detailed information about the power supply unit.
For example:
    FPR2100 /chassis #  show psu expand detail     
    PSU:
        PSU: 1
        Overall Status: Powered Off
        Operability: Unknown
        Power State: Off
        Presence: Equipped
        Voltage Status: Unknown
        Product Name: Cisco Firepower 2000 Series AC 400W Power Supply
        PID: FPR2K-PWR-AC-400
        VID: V01
        Vendor: Cisco Systems, Inc
        Serial (SN): LIT2010CAFE
        Type: AC
        Fan Status: Ok
        PSU: 2
        Overall Status: Operable
        Operability: Operable
        Power State: On
        Presence: Equipped
        Voltage Status: Ok
        Product Name: Cisco Firepower 2000 Series AC 400W Power Supply
        PID: FPR2K-PWR-AC-400
        VID: V01
        Vendor: Cisco Systems, Inc
        Serial (SN): LIT2010CAFE
        Type: AC
        Fan Status: Ok

Connect Local-Mgmt Troubleshooting Commands for the Secure Firewall 3100

In addition to the existing debugging commands, CLIs specific to Secure Firewall 3100 are explained in this section below.

Use the following connect local-mgmt mode FXOS CLI commands to troubleshoot issues with your Secure Firewall 3100. To access connect local-mgmt mode, enter:

FPR3100# connect local-mgmt

show portmanager
Displays detailed information about switched, packets, SFP-FEC counters, digital optical monitoring, QOS functionality, CPSS AP, and Cyclic log dumps.
For example:
The following CLI displays the FXOS port manager switch hardware TCAM rules dump in vtcam-tti:

firepower-3140(local-mgmt)# show portmanager switch forward-rules hardware vtcam-tti detail 
 VTCAM_RULE_ID   VLAN   SRC_PORT  PORTCHANNEL_ID  FLAGS  MODE  REF_COUNT 
1               21      0          2               0      2     5          3 
2             3078      0          0               0      0     0          1 
3             3077      0          0               0      0     0          1 
4             3076      0          0               0      0     0          1 
5             3075      0          0               0      0     0          1 
6             3074      0          0               0      0     0          1 
7             3073      0          0               0      0     0          1 
8                1      0          0               0      0     0          1 
9               18    102          0               0     24     8          1 
10               5    157          0               0     24     8          1 
11              31      0         12               0      2     5          3 
12              15    105          0               0     24     8          1 
13               9    111          0               0     24     8          1 
14              13    107          0               0     24     8          1 
15              26      0          7               0      2     5          3 
16              29      0         10               0      2     5          3 
17              23      0          4               0      2     5          3 
18              19    101          0               0     24     8          1 
19              30      0         11               0      2     5          3 
20              28      0          9               0      2     5          3 
21               4    156          0               0     24     8          1 
22              34      0         15               0      2     5          3 
23               6    158          0               0     24     8          1 
24               8    112          0               0     24     8          1 
25              24      0          5               0      2     5          3 
26              14    106          0               0     24     8          1 
27              32      0         13               0      2     5          3 
28              25      0          6               0      2     5          3 
29              12     0          0               9      6     5          2
30              20      0          1               0      2     5          3 
31              11    109          0               0     24     8          1 
32              27      0          8               0      2     5          3 
33              17    103          0               0     24     8          1 
34              22      0          3               0      2     5          3 
35              16    104          0               0     24     8          1 
36               3      0         19               0     26     8          1 
37              35      0         16               0      2     5          3 
38              33      0         14               0      2     5          3 
39               7    159          0               0     24     8          1 
40               2      0         17               0     26     8          1 
41              10    110          0               0     24     8          1 


The following CLI displays the FXOS port manager switch VLANs output:

firepower-3140(local-mgmt)# show portmanager switch vlans 
VLAN                           Ports                            Tag      MAC-Learning   FDB-mode
-----  -----------------------------------------------------  --------  -------------- ---------
1                             0/17,19                        pop_outer_tag    Control       FID    
2                             0/1-16,18               outer_tag0_inner_tag1   Control       FID    
                                0/20                      pop_outer_tag                
3                             0/1-16,18               outer_tag0_inner_tag1   Control       FID    
4                             0/1-16,18               outer_tag0_inner_tag1   Control       FID    
5                             0/1-16,18               outer_tag0_inner_tag1   Control       FID    
6                             0/1-16,18               outer_tag0_inner_tag1   Control       FID    
7                             0/1-16,18               outer_tag0_inner_tag1   Control       FID    
8                             0/1-16,18               outer_tag0_inner_tag1   Control       FID    
The following CLI helps you to to check port-channel interface summary:
firepower-3140(local-mgmt)# show por
portchannel  portmanager  

firepower-3140(local-mgmt)# show portchannel summary 
Flags:  D - Down        P - Up in port-channel (members)
I - Individual  H - Hot-standby (LACP only)
s - Suspended   r - Module-removed
S - Switched    R - Routed
U - Up (port-channel)
M - Not in use. Min-links not met
-------------------------------------------------------------------------------
Group Port-       Type     Protocol  Member Ports
      Channel
--------------------------------------------------------------------------------
3     Po3(U)      Eth      LACP      Eth1/3(P)    
2     Po2(U)      Eth      LACP      Eth1/2(P)    

LACP KeepAlive Timer:
--------------------------------------------------------------------------------
      Channel  PeerKeepAliveTimerFast
--------------------------------------------------------------------------------
3     Po3(U)      False          
2     Po2(U)      False          

Cluster LACP Status:
--------------------------------------------------------------------------------
      Channel  ClusterSpanned  ClusterDetach  ClusterUnitID  ClusterSysID
--------------------------------------------------------------------------------
3     Po3(U)      False          False          0                    
2     Po2(U)      False          False          0     
</pre>
The following CLI displays the port-channel load-balancing method:

firepower-3140(local-mgmt)# show portchannel load-balance 
PortChannel Load-Balancing Configuration:
   src-dst ip-l4port
PortChannel Load-Balancing Configuration Used Per-Protocol:
Non-IP: src-dst mac
   IP: src-dst ip-l4port
</pre>
The following CLI displays the status of FXOS system processes:
firepower-3140(local-mgmt)# show pmon state

SERVICE NAME             STATE     RETRY(MAX)    EXITCODE    SIGNAL    CORE
------------             -----     ----------    --------    ------    ----
svc_sam_dme            running           0(4)           0         0      no 
svc_sam_dcosAG         running           0(4)           0         0      no 
svc_sam_portAG         running           0(4)           0         0      no 
svc_sam_statsAG        running           0(4)           0         0      no 
httpd.sh               running           0(4)           0         0      no 
svc_sam_sessionmgrAG   running           0(4)           0         0      no 
sam_core_mon           running           0(4)           0         0      no 
svc_sam_svcmonAG       running           0(4)           0         0      no 
svc_sam_serviceOrchAG   running           0(4)           0         0      no 
svc_sam_appAG          running           0(4)           0         0      no 
svc_sam_envAG          running           0(4)           0         0      no 
svc_sam_npuAG          running           0(4)           0         0      no 
svc_sam_eventAG        running           0(4)           0         0      no
The following CLI displays switch hardware TCAM rules dump in vtcam-tti stage matching ethernet 1/1 port:

firepower-3140(local-mgmt)# show portmanager switch forward-rules hardware vtcam-tti ethernet 1 1 
RULE_ID   VLAN   SRC_PORT   PC_ID   SRC_ID   MODE   PAK_CNT 
 1          20     0   1       0     101      0       151
The following CLI displays switch hardware TCAM rules dump in vtcam-tti stage matching vlan 0:
firepower-3140(local-mgmt)# show portmanager switch forward-rules hardware vtcam-tti vlan 0
         RULE_ID   VLAN   SRC_PORT   PC_ID   SRC_ID   MODE  PAK_CNT 
1           2      0         17       0       17      0       1709
2           3      0         19       0       19      0       1626
3           4      0         16       0        0      0         0
4           5      0         15       0        0      0         0
5           6      0         14       0        0      0         0
6           7      0         13       0        0      0         0
7           8      0         12       0        0      0         0
8           9      0         11       0        0      0         0
9          10      0         10       0        0      0         0
10         11      0          9       0        0      0         0
11         12      0          8       0        0      0         0
12         13      0          7       0        0      0         0
13         14      0          6       0        0      0         0
14         15      0          5       0        0      0         0
15         16      0          4       0        0      0         0
16         17      0          3       0        0      0         0
17         18      0          2       0        0      0         0
18         19      0          1       0        0      0         0
19         20      0          1       0      101      0       166
20         21      0          2       0      102      0       1597
21         22      0          3       0      103      0         0
22         23      0          4       0      104      0         0
23         24      0          5       0      105      0         0
24         25      0          6       0      106      0         0
25         26      0          7       0      107      0         0
26         27      0          8       0      108      0         0
27         28      0          9       0      109      0         0
28         29      0         10       0      110      0         0
29         30      0         11       0      111      0         0
30         31      0         12       0      112      0         0
31         32      0         13       0      159      0         0
32         33      0         14       0      158      0         0
33         34      0         15       0      157      0         0
34         35      0         16       0      156      0         0
35          1      0         17       0        0      0         0
The following CLI displays detailed information about hardware MAC-filter / EM stage rules:
firepower-3140(local-mgmt)# show portmanager switch forward-rules hardware mac-filter detail 
EM Entry-No  :     1


      VLAN            :    0
      SRC_PORT        :   17
      PC_ID           :    0
      SRC_ID          :   17
      DST_PORT        :   19
      HW_ID           :   3072
      ACT_CMD         :    0
      PCL_ID          :    1
      REDIRECT_CMD    :    1
      BYPASS_BRG      :    1
      CND_INDEX       : 3074
      PACKET_COUNT    :       1977
      DMAC            : 00:00:00:00:00:00


EM Entry-No  :     2


      VLAN            :    0
      SRC_PORT        :   19
      PC_ID           :    0
      SRC_ID          :   19
      DST_PORT        :   17
      HW_ID           :   3074
      ACT_CMD         :    0
      PCL_ID          :    1
      REDIRECT_CMD    :    1
      BYPASS_BRG      :    1
      CND_INDEX       : 3075
      PACKET_COUNT    :       1858
      DMAC            : 00:00:00:00:00:00
The following CLI displays switch hardware TCAM rules dump in mac-filter stage matching ethernet 1/9 port:

firepower-3140(local-mgmt)# show portmanager switch forward-rules hardware mac-filter ethernet 1 9
VLAN   SRC_PORT   PC_ID   SRC_ID   DST_PORT     PKT_CNT      DMAC 
1        0          9       0      109      1536            0  1:80:c2:0:0:2
The following CLI displays detailed information about software MAC-filter:

firepower-3140(local-mgmt)# show portmanager switch forward-rules software mac-filter detail
 VLAN   SRC_PORT   PORTCHANNEL_ID   DST_PORT   FLAGS   MODE      DMAC 
1         0         17                0         19      26      8   0:0:0:0:0:0 
2         0          9                0       1536       2      5   1:80:c2:0:0:2 
3       104          0                0          4      24      8   0:0:0:0:0:0 
4         0          7                0       1536       2      5   1:80:c2:0:0:2 
5       101          0                0          1      24      8   0:0:0:0:0:0 
6         0          1                0       1536       2      5   1:80:c2:0:0:2 
7         0          3                0       1536       2      5   1:80:c2:0:0:2 
8       106          0                0          6      24      8   0:0:0:0:0:0 
9       158          0                0         14      24      8   0:0:0:0:0:0 
10        0         13                0       1536       2      5   1:80:c2:0:0:2 
11        0         14                0       1536       2      5   1:80:c2:0:0:2 
12        0          6                0       1536       2      5   1:80:c2:0:0:2 
13        0          8                0       1536       2      5   1:80:c2:0:0:2 
14      112          0                0         12      24      8   0:0:0:0:0:0 
15      107          0                0          7      24      8   0:0:0:0:0:0 
16        0         19                0         17      26      8   0:0:0:0:0:0 
17        0         12                0       1536       2      5   1:80:c2:0:0:2 
18        0          5                0       1536       2      5   1:80:c2:0:0:2 
19      102          0                0          2      24      8   0:0:0:0:0:0 
20      156          0                0         16      24      8   0:0:0:0:0:0 
21      103          0                0          3      24      8   0:0:0:0:0:0 
22        0         11                0       1536       2      5   1:80:c2:0:0:2 
23      157          0                0         15      24      8   0:0:0:0:0:0 
24      111          0                0         11      24      8   0:0:0:0:0:0 
25        0         10                0       1536       2      5   1:80:c2:0:0:2 
26      108          0                0          8      24      8   0:0:0:0:0:0 
27      159          0                0         13      24      8   0:0:0:0:0:0 
28      110          0                0         10      24      8   0:0:0:0:0:0 
29      105          0                0          5      24      8   0:0:0:0:0:0 
30        0          2                0       1536       2      5   1:80:c2:0:0:2 
31        0          4                0       1536       2      5   1:80:c2:0:0:2 
32        0         16                0       1536       2      5   1:80:c2:0:0:2 
33      109          0                0          9      24      8   0:0:0:0:0:0 
34        0         15                0       1536       2      5   1:80:c2:0:0:2
The following CLI displays switch software DB rules in mac-filter stage matching ethernet1/9 port:

firepower-3140(local-mgmt)# show portmanager switch forward-rules software mac-filter ethernet 1 9
VLAN   SRC_PORT   PORTCHANNEL_ID   DST_PORT   FLAGS   MODE      DMAC 
1         0          9                0       1536       2      5   1:80:c2:0:0:2
The following CLI displays detailed information about switch bridge engine packet drops:

firepower-3140(local-mgmt)# show portmanager switch counters bridge 
Bridge Ingress Drop Counter: 2148
No Bridge Ingress Drop
The following CLI displays details on hardware switch packet counters:

firepower-3140(local-mgmt)# show portmanager switch counters packet-trace 

       Counter                                Description       
---------------------- ---------------------------------------------------------
goodOctetsRcv          Number of ethernet frames received that are not bad    
                       ethernet frames or MAC Control pkts                    
badOctetsRcv           Sum of lengths of all bad ethernet frames received     
gtBrgInFrames          Number of packets received                             
gtBrgVlanIngFilterDisc Number of packets discarded due to VLAN Ingress Filtering
gtBrgSecFilterDisc     Number of packets discarded due to                     
                       Security Filtering measures                            
gtBrgLocalPropDisc     Number of packets discarded due to reasons other than  
                       VLAN ingress and Security filtering                    
dropCounter            Ingress Drop Counter                                   
outUcFrames            Number of unicast packets transmitted                  
outMcFrames            Number of multicast packets transmitted. This includes 
                       registered multicasts, unregistered multicasts         
                       and unknown unicast packets                            
outBcFrames            Number of broadcast packets transmitted                
brgEgrFilterDisc       Number of IN packets that were Bridge Egress filtered  
txqFilterDisc          Number of IN packets that were filtered                
                       due to TxQ congestion                                  
outCtrlFrames          Number of out control packets                          
                       (to cpu, from cpu and to  analyzer)                    
egrFrwDropFrames       Number of packets dropped due to egress                
                       forwarding restrictions                                
goodOctetsSent         Sum of lengths of all good ethernet                    
                       frames sent from this MAC                              
        Counter            Source port- 0/0    Destination port- 0/0
-----------------------  ---------------------  ---------------------
goodOctetsRcv                    ---                    ---          
badOctetsRcv                      ---                    ---          
                                       Ingress counters 
gtBrgInFrames                    6650                   6650          
gtBrgVlanIngFilterDisc             0                      0           
gtBrgSecFilterDisc                 0                      0           
gtBrgLocalPropDisc                 0                      0           
dropCounter                      2163           Only for source-port  
                                       Egress counters 
outUcFrames                        0                      0           
outMcFrames                      2524                   2524          
outBcFrames                      1949                   1949          
brgEgrFilterDisc                  14                     14           
txqFilterDisc                      0                      0           
outCtrlFrames                      0                      0           
egrFrwDropFrames                   0                      0           
goodOctetsSent                    ---                    ---          #
The following CLI displays detailed informatin about the switch traffic for CPU:

firepower-3140(local-mgmt)# show portmanager switch traffic cpu 

Dev/RX queue  packets    bytes
------------  ---------- ----------

0/0           0          0          
0/1           0          0          
0/2           0          0          
0/3           0          0          
0/4           0          0          
0/5           0          0          
0/6           0          0          
0/7           0          0          #
The following CLI displays details on hardware switch port traffic:

firepower-3140(local-mgmt)# show portmanager switch traffic port 


max-rate - pps that the port allow with packet size=64 
actual-tx-rate - pps that egress the port (+ % from 'max')
actual-rx-rate - pps that ingress the port(+ % from 'max')

Dev/Port   max-rate  actual-tx-rate    actual-rx-rate     
---------  --------  ---------------   --------------- 
0/1         1488095    (0%)---           (0%)---          
0/2         1488095    (0%)---           (0%)---          
0/3         14880      (0%)---           (0%)---          
0/4         14880      (0%)---           (0%)---          
0/5         14880      (0%)---           (0%)---          
0/6         14880      (0%)---           (0%)---          
0/7         14880      (0%)---           (0%)---          
0/8         14880      (0%)---           (0%)---          
0/9         14880952   (0%)---           (0%)---          
0/10        14880952   (0%)---           (0%)---          
0/11        14880952   (0%)---           (0%)---          
0/12        14880952   (0%)---           (0%)---          
0/13        14880952   (0%)---           (0%)---          
0/14        14880952   (0%)---           (0%)---          
0/15        1488095    (0%)---           (0%)---          
0/16        1488095    (0%)---           (0%)---          
0/17        14880952   (0%)---           (0%)---          
0/18        74404761   (0%)---           (0%)---          
0/19        37202380   (0%)---           (0%)---          
0/20        37202380   (0%)---           (0%)---       
The following CLI displays detailed information about SFP-FEC Counters matching ethernet 1/13 port:


firepower-3140(local-mgmt)# show portmanager counters ethernet 1 13
   Good Octets Received                              : 2153
   Bad Octets Received                               : 0
   MAC Transmit Error                                : 0
   Good Packets Received                             : 13
   Bad packets Received                              : 0
   BRDC Packets Received                             : 0
   MC Packets Received                               : 13
   .........
   .........
   txqFilterDisc                                     : 0
   linkchange                                        : 1
   FcFecRxBlocks                                     : 217038081
   FcFecRxBlocksNoError                              : 217038114
   FcFecRxBlocksCorrectedError                       : 0
   FcFecRxBlocksUnCorrectedError                     : 0
   FcFecRxBlocksCorrectedErrorBits                   : 0
   FcFecRxBlocksCorrectedError0                      : 0
   FcFecRxBlocksCorrectedError1                      : 0
   FcFecRxBlocksCorrectedError2                      : 0
   FcFecRxBlocksCorrectedError3                      : 0
   FcFecRxBlocksUnCorrectedError0                    : 0
   FcFecRxBlocksUnCorrectedError1                    : 0
   FcFecRxBlocksUnCorrectedError2                    : 0
   FcFecRxBlocksUnCorrectedError3                    : 0

The following CLI displays detailed information about SFP-FEC Counters matching ethernet 1/14 port:


firepower-3140(local-mgmt)# show portmanager counters ethernet 1 14
   Good Octets Received                              : 2153
   Bad Octets Received                               : 0
   MAC Transmit Error                                : 0
   Good Packets Received                             : 13
   Bad packets Received                              : 0
   BRDC Packets Received                             : 0
   MC Packets Received                               : 13
   .....
   .....
   txqFilterDisc                                     : 0
   linkchange                                        : 1
   RsFeccorrectedFecCodeword                         : 0
   RsFecuncorrectedFecCodeword                       : 10
   RsFecsymbolError0                                 : 5
   RsFecsymbolError1                                 : 0
   RsFecsymbolError2                                 : 0
   RsFecsymbolError3                                 : 0
The following CLI displays detailed information on the Digital Optical Monitoring information matching ethernet 1/5 port:

firepower-4245(local-mgmt)# show portmanager port-info ethernet 1 5
        ....
        ....
                 DOM info:
                 ========:

                 Status/Control Register: 0800
                       RX_LOS State: 0
                       TX_FAULT State: 0
                 Alarm Status: 0000
                 No active alarms
                 Warning Status: 0000
                 No active warnings
 
       THRESHOLDS
                               high alarm    high warning    low warning     low alarm
          Temperature     C    +075.000        +070.000        +000.000         -05.000
          Voltage         V    003.6300        003.4650        003.1350        002.9700
          Bias Current   mA    012.0000        011.5000        002.0000        001.0000
          Transmit power mW    034.6740        017.3780        002.5120        001.0000
          Receive power  mW    034.6740        017.3780        001.3490        000.5370
 
                 Environmental Information - raw values
                 Temperature: 38.84 C
                 Supply voltage: 33703 in units of 100uVolt
                 Tx bias: 3499 in units of 2uAmp
                 Tx power:  0.1 dBm (10251 in units of 0.1 uW)
                 Rx power: -0.9 dBm (8153 in units of 0.1 uW)
                 DOM (256 bytes of raw data in hex)
                    =====================================
                    0x0000 : 4b 00 fb 00 46 00 00 00 8d cc 74 04 87 5a 7a 76
                    0x0010 : 17 70 01 f4 16 76 03 e8 87 72 03 e8 43 e2 09 d0
                    0x0020 : 87 72 02 19 43 e2 05 45 00 00 00 00 00 00 00 00
                    0x0030 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    0x0040 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    0x0050 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 86
                    0x0060 : 26 54 83 a7 0d ab 28 0b 1f d9 00 00 00 00 08 00
                    0x0070 : 00 00 03 00 00 00 00 00 08 f3 00 00 00 00 00 01
                    0x0080 : 49 4e 55 49 41 43 53 45 41 41 31 30 2d 33 33 38
                    0x0090 : 38 2d 30 31 56 30 31 20 01 00 46 00 00 00 00 e3
                    0x00a0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    0x00b0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    0x00c0 : 53 46 50 2d 31 30 2f 32 35 47 2d 43 53 52 2d 53
                    0x00d0 : 20 20 20 20 30 38 00 00 00 00 00 00 00 00 00 d1
                    0x00e0 : 1e 20 2a 2a 31 34 29 36 00 00 00 00 00 00 00 00
                    0x00f0 : 00 00 00 00 00 56 00 00 ff ff ff ff 00 00 00 cf
                    =====================================
                  PHY Data:
                  PAGE IFC OFFSET VALUE  | PAGE IFC OFFSET VALUE
                  ---- --- ------ -----  | ---- --- ------ -----
The following CLI displays detailed information about the parameters set for the packet capture:

firepower-3140(local-mgmt)# show portmanager switch pktcap-rules software 
Software DB rule:1 
 Slot= 1
 Interface= 12
 Breakout-port= 0
 Protocol= 6
 Ethertype= 0x0000
 Filter_key= 0x00000040
 Session= 1
 Vlan= 0
 SrcPort= 0
 DstPort= 0
 SrcIp= 0.0.0.0
 DstIp= 0.0.0.0 
 SrcIpv6= ::
 DestIpv6= ::
 SrcMacAddr= 00:00:00:00:00:00
 DestMacAddr= 00:00:00:00:00:00
The following CLI displays detailed information on the FXOS port manager switch hardware TCAM rules:

firepower-3140(local-mgmt)# show portmanager switch pktcap-rules hardware 
Hardware DB rule:1 
 Hw_index= 15372
 Rule_id= 10241
 Cnc_index= 1
 Packet_count= 0
 Slot= 1
 Interface= 12
 Protocol= 6
 Ethertype= 0x0000
 Vlan= 0
 SrcPort= 0
 DstPort= 0
 SrcIp= 0.0.0.0
 DstIp= 0.0.0.0 
 SrcIpv6= ::
 DestIpv6= ::
 SrcMacAddr= 00:00:00:00:00:00
 DestMacAddr= 00:00:00:00:00:00
The following displays detailed information about the QOS functionality:

firepower(local-mgmt)# show portmanager switch qos-rule policer counters 
Policer_type   green(pass_count)    yellow(pass_count)     red(drop_count)     
--------------------------------------------------------------------------     
OSPF                  102025351                 17832                 590
780        
Policer_type   green(pass_count)    yellow(pass_count)     red(drop_count)     
--------------------------------------------------------------------------     
CCL_CLU                  0                 0                 0                 
Policer_type   green(pass_count)    yellow(pass_count)     red(drop_count)     
--------------------------------------------------------------------------     
BFD                  61343307                 0                 0              
Policer_type   green(pass_count)    yellow(pass_count)     red(drop_count)     
--------------------------------------------------------------------------     
HA                  0                 0                  0
Policer_type   green(pass_count)    yellow(pass_count)     red(drop_count)     
--------------------------------------------------------------------------     
CCL_CONTROL                   0                0                0              

The following CLI verifies if the high priority traffic is hitting the TCAM:

firepower(local-mgmt)# show portmanager switch qos-rule counters
Rule_no   Rule_id    Rule_type     pass_count     
---------------------------------------------     
  1        9218     SW_QOS_BFD           0
Rule_no   Rule_id    Rule_type     pass_count     
---------------------------------------------     
  2        9216     SW_QOS_OSPF      102633941
Rule_no   Rule_id    Rule_type     pass_count     
---------------------------------------------     
  3        9217     SW_QOS_BFD      61343307

The following CLI displays the CPU statistics as per queue per device matching ethernet 1/10 port:

firepower(local-mgmt)# show queuing interface ethernet 1 10
Queue     Traffic-type    Scheduler-type  oper-bandwidth    Destination
-----------------------------------------------------------------------
  3            Data           WRR             100           Application
  4         CCL-CLU            SP               0           Application
  5             BFD            SP               0           Application
  6            OSPF            SP               0           Application
  7  CCL-CONTROL/HA/LACP_Tx    SP               0           Application
  0  packet-capture           N/A               0                   CPU
  7            LACP_Rx        N/A               0                   CPU
Port 1/10 Queue Statistics:
Queue 0:
  Number of packets passed :                    0
  Number of packets dropped:                    0
Queue 1:
 Number of packets passed :                     0
 Number of packets dropped:                     0
Queue 2:
  Number of packets passed :                    0
  Number of packets dropped:                    0
Queue 3:
  Number of packets passed :            466420167
  Number of packets dropped:                    0
Queue 4:
  Number of packets passed :                    0
  Number of packets dropped:                    0
Queue 5:
  Number of packets passed :                    0
  Number of packets dropped:                    0
Queue 6:
  Number of packets passed :             41536261
  Number of packets dropped:                    0
Queue 7:
  Number of packets passed :                  912
  Number of packets dropped:                    0
CPU Statistics:
Queue 2:
  Number of packets passed :                180223
  Number of packets dropped:                     0
Queue 7:
  Number of packets passed :                  1572
  Number of packets dropped:                     0


The following CLI displays the CPU statistics as per queue per device matching internal 1/1 port:

firepower(local-mgmt)# show queuing interface internal 1 1
Queue     Traffic-type    Scheduler-type  oper-bandwidth    Destination
-----------------------------------------------------------------------
  3            Data           WRR             100           Application
  4         CCL-CLU            SP               0           Application
  5             BFD            SP               0           Application
  6            OSPF            SP               0           Application
  7  CCL-CONTROL/HA/LACP_Tx    SP               0           Application
  0  packet-capture           N/A               0                   CPU
  7            LACP_Rx        N/A               0                   CPU
Port 1/18 Queue Statistics:
Queue 0:
  Number of packets passed :                    0
  Number of packets dropped:                    0
Queue 1:
 Number of packets passed :                     0
 Number of packets dropped:                     0
Queue 2:
  Number of packets passed :                    0
  Number of packets dropped:                    0
Queue 3:
  Number of packets passed :                   17
  Number of packets dropped:                    0
Queue 4:
  Number of packets passed :                    0
  Number of packets dropped:                    0
Queue 5:
  Number of packets passed :                    0
  Number of packets dropped:                    0
Queue 6:
  Number of packets passed :                 5151
  Number of packets dropped:                    0
Queue 7:
  Number of packets passed :                 17345
  Number of packets dropped:                    0
CPU Statistics:
Queue 2:
  Number of packets passed :                180223
  Number of packets dropped:                     0
Queue 7:
  Number of packets passed :                  1572
  Number of packets dropped:                     0
Note:The CPU statistics are per Queue per Device

The following CLI displays detailed information about dump AP log option :

firepower-3110(local-mgmt)# dump portmanager switch ap-log 
requested log has been dumped to /opt/cisco/platform/logs/portmgr.out*

firepower-3110(local-mgmt)# dump portmanager switch cyclic-log 
requested log has been dumped to /opt/cisco/platform/logs/portmgr.out*


The following CLI displays detailed information on enabling or disabling verbose logging for port manager:

firepower-3110(local-mgmt)# debug portmanager switch 
all  Enable or Disable verbose logging for switch 

firepower-3110(local-mgmt)# debug portmanager switch all 
firepower-3110(local-mgmt)#

firepower-3110(local-mgmt)# no debug portmanager switch all 
firepower-3110(local-mgmt)#

The following CLI displays detailed information on port-based packet drops for eight traffic classes/queues:

firepower-3110(local-mgmt)# show portmanager switch tail-drop-allocated buffers all
-------------------------------------------------------------------------------------------------
     |          |                          Per Port and Traffic Class                           |
Port | Per port | TC0     | TC1     | TC2     | TC3     | TC4     | TC5     | TC6     | TC7     |
-----|----------|---------|---------|---------|---------|---------|---------|---------|---------|
0/1  |10        |10       |0        |0        |0        |0        |0        |0        |0        |
0/2  |15        |5        |5        |5        |0        |0        |0        |0        |0        |
0/3  |0         |0        |0        |0        |0        |0        |0        |0        |0        |
0/4  |80        |0        |0        |0        |0        |0        |0        |0        |80       |
0/5  |0         |0        |0        |0        |0        |0        |0        |0        |0        |
0/6  |0         |0        |0        |0        |0        |0        |0        |0        |0        |
0/7  |200       |25       |25       |50       |0        |0        |25       |50       |25       |
0/8  |0         |0        |0        |0        |0        |0        |0        |0        |0        |
-------------------------------------------------------------------------------------------------


The following CLI displays dropped packet counts due to tti-lookup0:

firepower-3110(local-mgmt)# show portmanager switch default-rule-drop-counter tti-lookup0

Rule_id    cnc_index     packet_count     
-------------------------------------     
  1           1                4
The following CLI displays dropped packet counts due to ipcl-lookup0:

firepower-3110(local-mgmt)# show portmanager switch default-rule-drop-counter ipcl-lookup0 
Rule_id    cnc_index     packet_count     
-------------------------------------     
4096           0              114

Connect Local-Mgmt Troubleshooting Commands for the Secure Firewall 4200 in Appliance Mode

In addition to the existing debugging commands, CLIs specific to Secure Firewall 3100 are explained in this section below.

Use the following connect local-mgmt mode FXOS CLI commands to troubleshoot issues with your Secure Firewall 3100 in Appliance mode. To access connect local-mgmt mode, enter:

FPR 4200# connect local-mgmt

show portmanager
Displays detailed information about switched, packets, SFP-FEC counters, digital optical monitoring, QOS functionality, CPSS AP, and Cyclic log dumps.
For example:
The following CLI displays the FXOS port manager switch hardware TCAM rules dump in vtcam-tti:
firepower(local-mgmt)# show portmanager switch forward-rules hardware vtcam-tti
      RULE_ID   VLAN   NUM_MPLS_LABELS  SRC_PORT   PC_ID   SRC_ID   MODE   PAK_CNT 
1           2      0       0               10       0       10      0         1951
2           3      0       0               14       0       14      0           19
3           4      0       0                9       0        9      0       227505
4           5      0       0               13       0       13      0       103587
5           6      0       0                8       0        0      0            0
6           7      0       0                7       0        0      0            0
7           8      0       0                6       0        0      0            0
8           9      0       0                5       0        0      0            0
9          10      0       0                4       0        0      0            0
10         11      0       0                3       0        0      0            0
11         12      0       0                2       0        0      0            0
12         13      0       0                1       0        0      0          607
13         14      0       0               44       0        0      0            0
14         15      0       0               40       0        0      0            0
15         16      0       0               36       0        0      0            0
16         17      0       0               32       0        0      0            0
17         30      0       0                1       0      101      1         2120
18         18      0       0                1       0      101      0          306
19         19      0       0                2       0      102      0         2429
20         20      0       0                3       0      103      0            0
21         21      0       0                4       0      104      0            0
22         22      0       0                5       0      105      0            0
23         23      0       0                6       0      106      0            0
24         24      0       0                7       0      107      0            0
25         25      0       0                8       0      108      0            0
26         26      0       0               32       0      117      0            0
27         27      0       0               36       0      121      0            0
28         28      0       0               40       0      125      0            0
29         29      0       0               44       0      129      0            0
30          1      0       0                9       0        0      0         1875
31       8193      0       1                0       0        0      0            0
32       8194      0       2                0       0        0      0            0
33       8195      0       3                0       0        0      0            0
34       8196      0       4                0       0        0      0            0
35       8197      0       5                0       0        0      0            0
36       8198      0       6                0       0        0      0            0


The following CLI displays switch hardware TCAM rules dump in vtcam-tti stage matching vlan 0:
firepower(local-mgmt)# show portmanager switch forward-rules hardware vtcam-tti  
      RULE_ID   VLAN   NUM_MPLS_LABELS  SRC_PORT   PC_ID   SRC_ID   MODE  PAK_CNT 
1           2      0       0               10       0       10      0     1961
2           3      0       0               14       0       14      0     19
3           4      0       0                9       0        9      0     227517
4           5      0       0               13       0       13      0     103683
5           6      0       0                8       0        0      0          0
6           7      0       0                7       0        0      0          0
7           8      0       0                6       0        0      0          0
8           9      0       0                5       0        0      0          0
9          10      0       0                4       0        0      0          0
10         11      0       0                3       0        0      0          0
11         12      0       0                2       0        0      0          0
12         13      0       0                1       0        0      0        617
13         14      0       0               44       0        0      0          0
14         15      0       0               40       0        0      0          0
15         16      0       0               36       0        0      0          0
16         17      0       0               32       0        0      0          0
17         30      0       0                1       0      101      1       2156
18         18      0       0                1       0      101      0        306
19         19      0       0                2       0      102      0       2466
20         20      0       0                3       0      103      0          0
21         21      0       0                4       0      104      0          0
22         22      0       0                5       0      105      0          0
23         23      0       0                6       0      106      0          0
24         24      0       0                7       0      107      0          0
25         25      0       0                8       0      108      0          0
26         26      0       0               32       0      117      0          0
27         27      0       0               36       0      121      0          0
28         28      0       0               40       0      125      0           0
29         29      0       0               44       0      129      0           0
30          1      0       0                9       0        0      0        1875
31       8193      0       1                0       0        0      0           0
32       8194      0       2                0       0        0      0           0
33       8195      0       3                0       0        0      0           0
34       8196      0       4                0       0        0      0           0
35       8197      0       5                0       0        0      0           0
36       8198      0       6                0       0        0      0           0
The following CLI displays switch hardware TCAM rules dump in mac-filter stage matching ethernet 1/9 port:

firepower(local-mgmt)# show portmanager switch forward-rules hardware mac-filter 
      VLAN   SRC_PORT   PC_ID   SRC_ID   DST_PORT     PKT_CNT      DMAC 
1        0         44       0      129      1536            0  1:80:c2:0:0:2
2        0         44       0      129      1536            0  ff:ff:ff:ff:ff:ff
3        0          2       0      102      1536            0  ba:db:ad:f0:2:8f
4        0          4       0      104      1536            0  ff:ff:ff:ff:ff:ff
5        0          4       0      104      1536            0  1:80:c2:0:0:2
6        0          5       0      105      1536            0  1:80:c2:0:0:2
7        0          5       0      105      1536            0  ff:ff:ff:ff:ff:ff
8        0         13       0       13         9       103735  0:0:0:0:0:0
9        0         32       0      117      1536            0  ba:db:ad:f0:2:9e
10       0          7       0      107      1536            0  ff:ff:ff:ff:ff:ff
11       0          7       0      107      1536            0  1:80:c2:0:0:2
12       0          6       0      106      1536            0  1:80:c2:0:0:2
13       0          6       0      106      1536            0  ff:ff:ff:ff:ff:ff
14       0         14       0       14        10           19  0:0:0:0:0:0
15       0         10       0       10        14         1979  0:0:0:0:0:0
16       0         44       0      129      1536            0  ba:db:ad:f0:2:a1
17       0          9       0        9        13      1227537  0:0:0:0:0:0
18       0          8       0      108      1536            0  1:80:c2:0:0:2
19       0          8       0      108      1536            0  ff:ff:ff:ff:ff:ff
20       0          1       0      101      1536            0  ff:ff:ff:ff:ff:ff
21       0          1       0      101      1536            0  1:80:c2:0:0:2
22       0          3       0      103      1536            0  1:80:c2:0:0:2
23       0          1       0      101      1536         2183  1:0:0:0:0:0
24       0          3       0      103      1536            0  ff:ff:ff:ff:ff:ff
25       0          2       0      102      1536           23  ff:ff:ff:ff:ff:ff
26       0          2       0      102      1536            0  1:80:c2:0:0:2
27       0         32       0      117      1536            0  ff:ff:ff:ff:ff:ff
28       0         32       0      117      1536            0  1:80:c2:0:0:2
29       0         40       0      125      1536            0  ff:ff:ff:ff:ff:ff
30       0         40       0      125      1536            0  1:80:c2:0:0:2
31       0          7       0      107      1536            0  ba:db:ad:f0:2:94
32       0          5       0      105      1536            0  ba:db:ad:f0:2:92
33       0         36       0      121      1536            0  1:80:c2:0:0:2
34       0          4       0      104      1536            0  ba:db:ad:f0:2:91
35       0         36       0      121      1536            0  ff:ff:ff:ff:ff:ff
36       0          8       0      108      1536            0  ba:db:ad:f0:2:95
37       0          6       0      106      1536            0  ba:db:ad:f0:2:93
38       0          3       0      103      1536            0  ba:db:ad:f0:2:90
39       0         36       0      121      1536            0  ba:db:ad:f0:2:9f
40       0          1       0      101      1536           32  ba:db:ad:f0:2:8e
41       0         40       0      125      1536            0  ba:db:ad:f0:2:a0
The following CLI displays detailed information about software MAC-filter:

firepower-4225(local-mgmt)# show portmanager switch forward-rules software mac-filter 
      NATIVE_VLAN    VLAN   SRC_PORT   PORTCHANNEL_ID   DST_PORT   FLAGS   MODE DMAC 
1              0      106          6                0       1536       2      5 1:80:c2:0:0:2 
2              0      105          5                0       1536       2      5 ff:ff:ff:ff:ff:ff 
3              0      105          5                0       1536       2      5 1:80:c2:0:0:2 
4              0      121          0                0         36      24      8 0:0:0:0:0:0 
5              0      106          6                0       1536       2      5 ff:ff:ff:ff:ff:ff 
6              0      121         36                0       1536       2      5 1:80:c2:0:0:2 
7              0      117         32                0       1536       2      5 1:80:c2:0:0:2 
8              0      125         40                0       1536       2      5 ff:ff:ff:ff:ff:ff 
9              0      129          0                0         44      24      8 0:0:0:0:0:0 
10             0      117         32                0       1536       2      5 ff:ff:ff:ff:ff:ff 
11             0      103          3                0       1536       2      5 1:80:c2:0:0:2 
12             0      102          2                0       1536       2      5 ff:ff:ff:ff:ff:ff 
13             0      117          0                0         32      24      8 0:0:0:0:0:0 
14             0      107          0                0          7      24      8 0:0:0:0:0:0 
15             0      101          1                0       1536       2      5 ba:db:ad:f0:2:8e 
16             0      107          7                0       1536       2      5 ff:ff:ff:ff:ff:ff 
17             0      106          6                0       1536       2      5 ba:db:ad:f0:2:93 
18             0      105          0                0          5      24      8 0:0:0:0:0:0 
19             0      102          0                0          2      24      8 0:0:0:0:0:0 
20             0      104          4                0       1536       2      5 ba:db:ad:f0:2:91 
21             0      107          7                0       1536       2      5 ba:db:ad:f0:2:94 
22             0      129         44                0       1536       2      5 1:80:c2:0:0:2 
23             0      102          2                0       1536       2      5 1:80:c2:0:0:2 
24             0      121         36                0       1536       2      5 ff:ff:ff:ff:ff:ff 
25             0        1         13                0          9      26      8 0:0:0:0:0:0 
26             0      108          8                0       1536       2      5 1:80:c2:0:0:2 
27             0      101          1                0       1536       2      5 ff:ff:ff:ff:ff:ff 
28             0        2         10                0         14      26      8 0:0:0:0:0:0 
29             0      101          1                0       1536       2      5 1:80:c2:0:0:2 
30             0        1          9                0         13      26      8 0:0:0:0:0:0 
31             0      129         44                0       1536       2      5 ff:ff:ff:ff:ff:ff 
32             0      125          0                0         40      24      8 0:0:0:0:0:0 
33             0      108          8                0       1536       2      5 ba:db:ad:f0:2:95 
34             0        2         14                0         10      26      8 0:0:0:0:0:0 
35             0      129         44                0       1536       2      5 ba:db:ad:f0:2:a1 
36             0      103          0                0          3      24      8 0:0:0:0:0:0 
37             0      104          0                0          4      24      8 0:0:0:0:0:0 
38             0      104          4                0       1536       2      5 ff:ff:ff:ff:ff:ff 
39             0      107          7                0       1536       2      5 1:80:c2:0:0:2 
40             0      104          4                0       1536       2      5 1:80:c2:0:0:2 
41             0      101          1                0       1536      18      8 0:0:0:0:0:0 
42             0      101          0                0          1      24      8 0:0:0:0:0:0 
43             0      108          8                0       1536       2      5 ff:ff:ff:ff:ff:ff 
44             0      121         36                0       1536       2      5 ba:db:ad:f0:2:9f 
45             0      117         32                0       1536       2      5 ba:db:ad:f0:2:9e 
46             0      105          5                0       1536       2      5 ba:db:ad:f0:2:92 
47             0      125         40                0       1536       2      5 ba:db:ad:f0:2:a0 
48             0      125         40                0       1536       2      5 1:80:c2:0:0:2 
49             0      108          0                0          8      24      8 0:0:0:0:0:0 
50             0      106          0                0          6      24      8 0:0:0:0:0:0 
51             0      103          3                0       1536       2      5 ba:db:ad:f0:2:90 
52             0      102          2                0       1536       2      5 ba:db:ad:f0:2:8f 
53             0      103          3                0       1536       2      5 ff:ff:ff:ff:ff:ff
  
The following CLI displays detailed information about switch bridge engine packet drops:
firepower-4225(local-mgmt)# show portmanager switch counters bridge 
Bridge Ingress Drop Counter: 4688
No Bridge Ingress Drop
The following CLI displays details on hardware switch packet counters:

how portmanager switch counters packet-trace

firepower-4225(local-mgmt)# show portmanager switch counters packet-trace

       Counter                                Description       
---------------------- ---------------------------------------------------------
goodOctetsRcv          Number of ethernet frames received that are not bad    
                       ethernet frames or MAC Control pkts                    
badOctetsRcv           Sum of lengths of all bad ethernet frames received     
gtBrgInFrames          Number of packets received                             
gtBrgVlanIngFilterDisc Number of packets discarded due to VLAN Ingress Filtering
gtBrgSecFilterDisc     Number of packets discarded due to                     
                       Security Filtering measures                            
gtBrgLocalPropDisc     Number of packets discarded due to reasons other than  
                       VLAN ingress and Security filtering                    
dropCounter            Ingress Drop Counter                                   
outUcFrames            Number of unicast packets transmitted                  
outMcFrames            Number of multicast packets transmitted. This includes 
                       registered multicasts, unregistered multicasts         
                       and unknown unicast packets                            
outBcFrames            Number of broadcast packets transmitted                
brgEgrFilterDisc       Number of IN packets that were Bridge Egress filtered  
txqFilterDisc          Number of IN packets that were filtered                
                       due to TxQ congestion                                  
outCtrlFrames          Number of out control packets                          
                       (to cpu, from cpu and to  analyzer)                    
egrFrwDropFrames       Number of packets dropped due to egress                
                       forwarding restrictions                                
goodOctetsSent         Sum of lengths of all good ethernet                    
                       frames sent from this MAC                              


        Counter            Source port- 0/0    Destination port- 0/0
-----------------------  ---------------------  ---------------------
goodOctetsRcv                    ---                    ---          
badOctetsRcv                      ---                    ---          

                                       Ingress counters 
gtBrgInFrames                   1341132                1341132        
gtBrgVlanIngFilterDisc             0                      0           
gtBrgSecFilterDisc                 0                      0           
gtBrgLocalPropDisc                 0                      0           
dropCounter                      4699           Only for source-port  

                                       Egress counters 
outUcFrames                     1329593                1329593        
outMcFrames                      4594                   4594          
outBcFrames                      2237                   2237          
brgEgrFilterDisc                   9                      9           
txqFilterDisc                      0                      0           
outCtrlFrames                      0                      0           
egrFrwDropFrames                   0                      0           
mcFifoDropPkts                     0                      0           
mcFilterDropPkts                   0                      0           

goodOctetsSent                    ---                    ---          
The following CLI displays detailed informatin about the switch traffic for CPU:

firepower-4225(local-mgmt)# show portmanager switch traffic cpu 

Dev/RX queue  packets    bytes
------------  ---------- ----------

Dev/RX queue  packets    bytes
------------  ---------- ----------

0/0           0          0          
0/1           0          0          
0/2           0          0          
0/3           0          0          
0/4           0          0          
0/5           0          0          
0/6           0          0          
0/7           0          0  
The following CLI displays details on hardware switch port traffic:

firepower-4225(local-mgmt)# show portmanager switch traffic port 


max-rate - pps that the port allow with packet size=64 
actual-tx-rate - pps that egress the port (+ % from 'max')
actual-rx-rate - pps that ingress the port(+ % from 'max')

Dev/Port   max-rate  actual-tx-rate    actual-rx-rate     
---------  --------  ---------------   --------------- 
0/1         1488095    (0%)---           (0%)---          
0/2         1488095    (0%)---           (0%)---          
0/3         14880      (0%)---           (0%)---          
0/4         14880      (0%)---           (0%)---          
0/5         14880      (0%)---           (0%)---          
0/6         14880      (0%)---           (0%)---          
0/7         14880      (0%)---           (0%)---          
0/8         14880      (0%)---           (0%)---          
0/9         14880952   (0%)---           (0%)---          
0/10        14880952   (0%)---           (0%)---          
0/11        14880952   (0%)---           (0%)---          
0/12        14880952   (0%)---           (0%)---          
0/13        14880952   (0%)---           (0%)---          
0/14        14880952   (0%)---           (0%)---          
0/15        1488095    (0%)---           (0%)---          
0/16        1488095    (0%)---           (0%)---          
0/17        14880952   (0%)---           (0%)---          
0/18        74404761   (0%)---           (0%)---          
0/19        37202380   (0%)---           (0%)---          
0/20        37202380   (0%)---           (0%)---       
The following CLI displays detailed information about SFP-FEC Counters matching ethernet 1/13 port:


firepower-4225(local-mgmt)# show portmanager counters ethernet 1 13
   Good Octets Received                              : 2153
   Bad Octets Received                               : 0
   MAC Transmit Error                                : 0
   Good Packets Received                             : 13
   Bad packets Received                              : 0
   BRDC Packets Received                             : 0
   MC Packets Received                               : 13
   .........
   .........
   txqFilterDisc                                     : 0
   linkchange                                        : 1
   FcFecRxBlocks                                     : 217038081
   FcFecRxBlocksNoError                              : 217038114
   FcFecRxBlocksCorrectedError                       : 0
   FcFecRxBlocksUnCorrectedError                     : 0
   FcFecRxBlocksCorrectedErrorBits                   : 0
   FcFecRxBlocksCorrectedError0                      : 0
   FcFecRxBlocksCorrectedError1                      : 0
   FcFecRxBlocksCorrectedError2                      : 0
   FcFecRxBlocksCorrectedError3                      : 0
   FcFecRxBlocksUnCorrectedError0                    : 0
   FcFecRxBlocksUnCorrectedError1                    : 0
   FcFecRxBlocksUnCorrectedError2                    : 0
   FcFecRxBlocksUnCorrectedError3                    : 0

The following CLI displays detailed information about SFP-FEC Counters matching ethernet 1/14 port:

firepower-4225(local-mgmt)# show portmanager counters ethernet 1 14
   Good Octets Received                              : 2153
   Bad Octets Received                               : 0
   MAC Transmit Error                                : 0
   Good Packets Received                             : 13
   Bad packets Received                              : 0
   BRDC Packets Received                             : 0
   MC Packets Received                               : 13
   .....
   .....
   txqFilterDisc                                     : 0
   linkchange                                        : 1
   RsFeccorrectedFecCodeword                         : 0
   RsFecuncorrectedFecCodeword                       : 10
   RsFecsymbolError0                                 : 5
   RsFecsymbolError1                                 : 0
   RsFecsymbolError2                                 : 0
   RsFecsymbolError3                                 : 0
The following CLI displays detailed information on the Digital Optical Monitoring information matching ethernet 1/5 port:

firepower-4245(local-mgmt)# show portmanager port-info ethernet 1 5
        ....
        ....
                 DOM info:
                 ========:

                 Status/Control Register: 0800
                       RX_LOS State: 0
                       TX_FAULT State: 0
                 Alarm Status: 0000
                 No active alarms
                 Warning Status: 0000
                 No active warnings
 
       THRESHOLDS
                               high alarm    high warning    low warning     low alarm
          Temperature     C    +075.000        +070.000        +000.000         -05.000
          Voltage         V    003.6300        003.4650        003.1350        002.9700
          Bias Current   mA    012.0000        011.5000        002.0000        001.0000
          Transmit power mW    034.6740        017.3780        002.5120        001.0000
          Receive power  mW    034.6740        017.3780        001.3490        000.5370
 
                 Environmental Information - raw values
                 Temperature: 38.84 C
                 Supply voltage: 33703 in units of 100uVolt
                 Tx bias: 3499 in units of 2uAmp
                 Tx power:  0.1 dBm (10251 in units of 0.1 uW)
                 Rx power: -0.9 dBm (8153 in units of 0.1 uW)
                 DOM (256 bytes of raw data in hex)
                    =====================================
                    0x0000 : 4b 00 fb 00 46 00 00 00 8d cc 74 04 87 5a 7a 76
                    0x0010 : 17 70 01 f4 16 76 03 e8 87 72 03 e8 43 e2 09 d0
                    0x0020 : 87 72 02 19 43 e2 05 45 00 00 00 00 00 00 00 00
                    0x0030 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    0x0040 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    0x0050 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 86
                    0x0060 : 26 54 83 a7 0d ab 28 0b 1f d9 00 00 00 00 08 00
                    0x0070 : 00 00 03 00 00 00 00 00 08 f3 00 00 00 00 00 01
                    0x0080 : 49 4e 55 49 41 43 53 45 41 41 31 30 2d 33 33 38
                    0x0090 : 38 2d 30 31 56 30 31 20 01 00 46 00 00 00 00 e3
                    0x00a0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    0x00b0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    0x00c0 : 53 46 50 2d 31 30 2f 32 35 47 2d 43 53 52 2d 53
                    0x00d0 : 20 20 20 20 30 38 00 00 00 00 00 00 00 00 00 d1
                    0x00e0 : 1e 20 2a 2a 31 34 29 36 00 00 00 00 00 00 00 00
                    0x00f0 : 00 00 00 00 00 56 00 00 ff ff ff ff 00 00 00 cf
                    =====================================
                  PHY Data:
                  PAGE IFC OFFSET VALUE  | PAGE IFC OFFSET VALUE
                  ---- --- ------ -----  | ---- --- ------ -----
The following CLI displays detailed information about the parameters set for the packet capture:

firepower-4225(local-mgmt)# show portmanager switch pktcap-rules software 
Software DB rule:1 
 Slot= 1
 Interface= 12
 Breakout-port= 0
 Protocol= 6
 Ethertype= 0x0000
 Filter_key= 0x00000040
 Session= 1
 Vlan= 0
 SrcPort= 0
 DstPort= 0
 SrcIp= 0.0.0.0
 DstIp= 0.0.0.0 
 SrcIpv6= ::
 DestIpv6= ::
 SrcMacAddr= 00:00:00:00:00:00
 DestMacAddr= 00:00:00:00:00:00
The following CLI displays detailed information on the FXOS port manager switch hardware TCAM rules:

firepower-4225(local-mgmt)# show portmanager switch pktcap-rules hardware 
Hardware DB rule:1 
 Hw_index= 15372
 Rule_id= 10241
 Cnc_index= 1
 Packet_count= 0
 Slot= 1
 Interface= 12
 Protocol= 6
 Ethertype= 0x0000
 Vlan= 0
 SrcPort= 0
 DstPort= 0
 SrcIp= 0.0.0.0
 DstIp= 0.0.0.0 
 SrcIpv6= ::
 DestIpv6= ::
 SrcMacAddr= 00:00:00:00:00:00
 DestMacAddr= 00:00:00:00:00:00
The following CLI displays detailed information on port-based packet drops for eight traffic classes/queues:

firepower-4225(local-mgmt)# show portmanager switch tail-drop-allocated buffers all
-------------------------------------------------------------------------------------------------
     |          |                          Per Port and Traffic Class                           |
Port | Per port | TC0     | TC1     | TC2     | TC3     | TC4     | TC5     | TC6     | TC7     |
-----|----------|---------|---------|---------|---------|---------|---------|---------|---------|
0/1  |10        |10       |0        |0        |0        |0        |0        |0        |0        |
0/2  |15        |5        |5        |5        |0        |0        |0        |0        |0        |
0/3  |0         |0        |0        |0        |0        |0        |0        |0        |0        |
0/4  |80        |0        |0        |0        |0        |0        |0        |0        |80       |
0/5  |0         |0        |0        |0        |0        |0        |0        |0        |0        |
0/6  |0         |0        |0        |0        |0        |0        |0        |0        |0        |
0/7  |200       |25       |25       |50       |0        |0        |25       |50       |25       |
0/8  |0         |0        |0        |0        |0        |0        |0        |0        |0        |
-------------------------------------------------------------------------------------------------


The following CLI displays dropped packet counts due to tti-lookup0:

firepower-4225(local-mgmt)# show portmanager switch default-rule-drop-counter tti-lookup0

Rule_id    cnc_index     packet_count     
-------------------------------------     
  1           1                4

FXOS CLI Security Services Mode Troubleshooting Commands

Use the following security services (ssa) mode FXOS CLI commands to troubleshoot issues with your system.

show app
Displays information about the applications attached to your Firepower 1000/2100 or Secure Firewall 3100 device.
For example:
    firepower /ssa # show app     
    Application:
        Name       Version    Description Author     Deploy Type CSP Type    Is Defa
    ult App
        ---------- ---------- ----------- ---------- ----------- ----------- -------
    -------
        ftd        6.2.0.131  N/A         cisco      Native      Application No
        ftd        6.2.0.140  N/A         cisco      Native      Application No
        ftd        6.2.0.175  N/A         cisco      Native      Application Yes
showapp-instance
Displays information about the verified app-instance status
    firepower-2120 /ssa # show app-instance
Application Name     Slot ID    Admin State     Operational State    Running Version Startup Version Cluster Oper State
-------------------- ---------- --------------- -------------------- --------------- --------------- ------------------
asa                  1          Enabled         Online               9.14.2          9.14.2          Not Applicable
showfault
Displays information about the fault message
firepower-2120 /ssa # show fault 
Severity  Code     Last Transition Time     ID       Description
--------- -------- ------------------------ -------- -----------
Cleared   F16589   2021-10-11T21:58:53.200     25140 [FSM:STAGE:RETRY:]: Waiting for chassis object ready(FSM-STAGE:sam:dme:SmSecSvcAutoDeployCSP:WaitForChassisM
oReady)
show failsafe-params

The fail-safe mode for the threat defense application on Firepower 1000/2100 or Secure Firewall 3100 is activated due to continuous boot loop, traceback, etc. The following parameters control the activation of the fail-safe mode:

  • Max Restart—maximum number of times that an application should restart in order to activate the fail-safe mode.

  • Current Reboot Count—number of times the application continuously restarted.

  • Restart Time Interval (secs)—the amount of time in seconds, during which the Max Restart counter should be reached in order to trigger the fail-safe mode. If the application restarts 'Max Restart' or more times within this interval, the fail-safe mode is enabled.

For example:
firepower-2120-failed(local-mgmt)# show failsafe-params 
Max Restart: 8
Current Reboot Count: 0
Restart Time Interval(secs): 3600

When the system is in the fail-safe mode:

  • The system name is appended with the "-failed" string:

    firepower-2120-failed /ssa #
  • The output of the "show failsafe-params" command in the local-mgmt command shell contains a warning message:
    firepower-2120-failed(local-mgmt)# show failsafe-params 
    Max Restart: 1
    Current Reboot Count: 1
    Restart Time Interval(secs): 3600
    WARNING: System in Failsafe mode. Applications are not running!
  • Operation State of the application is Offline:

    firepower-2120-failed /ssa # show app-instance 
    Application Name     Slot ID    Admin State     Operational State    Running Version Startup Version Cluster Oper State   Cluster Role
    -------------------- ---------- --------------- -------------------- --------------- --------------- -------------------- ------------
    asa                  1          Enabled         Offline <=====       9.16.2.3        9.16.2.3        Not Applicable       None

Secure Firewall 1200/3100/4200 CLI Monitoring Mode Troubleshooting Commands

Use the following CLI commands to troubleshoot issues.

show
Displays the state of memory leak, process wise.
For example:
FPR3100 /monitoring/sysdebug/mem-leak-logging # show detail
        Process        Status    Stacktrace
    -------------- --------- ------------
    statsAG        Disabled    Off
    dcosAG         Disabled    Off
    portAG         Disabled    Off
    appAG          Disabled    Off
    eventAG        Disabled    Off
    npuAG          Disabled    Off
    sessionmgrAG   Disabled    Off
    svcmonAG       Disabled    Off
    serviceOrchAG  Disabled    Off
    dme            Disabled    Off
    envAG          Disabled    Off
 

Note


By default, mem-leak is disabled for all UCSM processes, and stacktrace is disabled You must enable mem-leak for the specified process to debug the memory leak issues, and enable the stacktrace for more information on the issue.


Packet Capture for Secure Firewall 3100/4200

The Packet Capture tool is a valuable asset for use in debugging connectivity and configuration issues and for understanding traffic flows through your devices. You can now use the Packet Capture CLIs to log traffic that is going through specific interfaces on your Secure Firewall 3100/4200 devices.

You can create multiple packet capture sessions, and each session can capture traffic on multiple interfaces. For each interface included in a packet capture session, a separate packet capture (PCAP) file will be created.

Guidelines and Limitations for Packet Capture

The Packet Capture tool has the following limitations:

  • Packet Capture on Secure Firewall 3100/4200 series devices can capture up to 300 Mbps.

  • Packet capture sessions can be created even when there is not enough storage space available to run the packet capture session. You should verify that you have enough storage space available before you start a packet capture session.

  • For packet capture sessions on a single-wide 4x100Gbps or 2x100Gbps network module (part numbers FPR-NM-4X100G and FPR-NM-2X100G respectively), if the module adminstate is set to off, the capture session is automatically disabled with an “Oper State Reason: Unknown Error.” You will have to restart the capture session after the module adminstate is set to on again.

    With all other network modules, packet capture sessions continue across module adminstate changes.

  • Does not support multiple active packet capturing sessions.

  • There is no option to filter based on source or destination IPv6 address.

  • Filters are not effective on packets that cannot be understood by the internal switch (for example Security Group Tag and Network Service Header packets).

  • You cannot capture packets for an EtherChannel as a whole. However, for an EtherChannel allocated to a logical device, you can capture packets on each member interface of the EtherChannel.

  • You cannot copy or export a PCAP file while the capture session is still active.

  • When you delete a packet capture session, all packet capture files associated with that session are also deleted.

Creating or Editing a Packet Capture Session

Procedure


Step 1

Enter packet capture mode:

firepower-4215 # scope packet-capture

Step 2

Create a filter.

firepower-4215 /packet-capture/filter* # set <filterprop filterprop_value

Table 1. Supported Filter Properties

ivlan

Inner VLAN ID (vlan of packet while ingressing port)

ovlan

Outer VLAN ID

srcip

Source IP Address (IPv4)

destip

Destination IP Address (IPv4)

srcport

Source Port Number

destport

Destination Port Number

protocol

IP Protocol [IANA defined Protocol values in decimal format]

ethertype

Ethernet Protocol type [IANA defined Ethernet Protocol type value in decimal format. For eg: IPv4 = 2048, IPv6 = 34525, ARP = 2054, SGT = 35081]

srcmac

Source Mac Address

destmac

Destination Mac Address

You can apply filters to any of the interfaces included in a packet capture session.

Step 3

To create or edit a packet capture session:

firepower-4215 /packet-capture # enter session session_name

Step 4

Specify the length of the packet that you want to capture for this packet capture session:

firepower-4215 /packet-capture/session* # set session-pcap-snaplength session_snap_length_in_bytes

The specified snap length must be between 64 and 9006 bytes. If you do not configure the session snap length, the default capture length is 1518 bytes.

Step 5

Specify the physical source ports that should be included in this packet capture session.

You can capture from multiple ports and can capture from both physical ports and application ports during the same packet capture session. A separate packet capture file is created for each port included in the session. You cannot capture packets for an EtherChannel as a whole. However, for an EtherChannel allocated to a logical device, you can capture packets on each member interface of the EtherChannel.

Note

 

To remove a port from the packet capture session, use delete instead of create in the commands listed below.

  1. Specify the physical port.

    firepower-4215 /packet-capture/session* # create {phy-port | phy-aggr-port} port_id

    Example:

    Example:

    
    firepower-4215 /packet-capture/session* # create phy-port Ethernet1/1
    firepower-4215 /packet-capture/session/phy-port* # 
    
    
  2. Capture packets on a subinterface.

    firepower-4215 /packet-capture/session/phy-port* # set subinterface id

    You can only capture packets for one subinterface per capture session, even if you have multiple subinterfaces on one or more parents. Subinterfaces for EtherChannels are not supported. If the parent interface is also allocated to the instance, you can either choose the parent interface or a subinterface; you cannot choose both.

    Example:

    firepower-4215 /packet-capture/session/phy-port* # set subinterface 100
    firepower-4215 /packet-capture/session/phy-port* # 
    
    
  3. For container instances, specify the container instance name.

    firepower-4215 /packet-capture/session/phy-port* # set app-identifier instance_name

    Example:

    firepower-4215 /packet-capture/session/phy-port* # set app-identifier ftd-instance1
    firepower-4215 /packet-capture/session/phy-port* # 
    
    
  4. (Optional) For capturing the mac-filter dropped packets from switch, specify the mac-filter drop.

    firepower-4215 /packet-capture/session/phy-port* # set drop {mac-filter | disable}

    • disable —To disable capture of packets dropped from switch.

    • mac-filter —To capture switch mac-filter drop

    Note

     
    The mac-filter option is supported only for the ingress packet capture direction and the default option is always disable.
  5. (Optional) Apply the desired filter.

    firepower-4215 /packet-capture/session/phy-port* # set {source-filter} filtername

    Note

     

    To remove a filter from a port, use set source-filter "" .

  6. Repeat the steps above as needed to add all desired ports.

Step 6

Specify the application source ports that should be included in this packet capture session.

You can capture from multiple ports and can capture from both physical ports and application ports during the same packet capture session. A separate packet capture file is created for each port included in the session.

Note

 

To remove a port from the packet capture session, use delete instead of create in the commands listed below.

  1. Specify the application port.

    firepower-4215 /packet-capture/session* # create app_port module_slot link_name interface_name app_name

    Syntax Description

    module_slot

    Security module in which the application is installed.

    link_name

    Any user descriptive name referring to the interface, for example, link1, inside_port1, etc.

    interface_name

    Interface attached to the application where packets need to be captured from, for example, Ethernet1/1, Ethernet2/2

    app_name

    Application installed on the module - ftd

  2. (Optional) Apply the desired filter.

    firepower-4215 /packet-capture/session/phy-port* # set {source-filter} filtername

    Syntax Description

    filtername

    The filter name from the ‘create filter’ command under packet-capture scope

    Note

     

    To remove a filter from a port, use set source-filter "" .

  3. Repeat the steps above as needed to add all desired application ports.

Step 7

If you want to start the packet capture session now:

firepower-4215 /packet-capture/session* # enable

Newly created packet-capture sessions are disabled by default. Explicit enabling of a session activates the packet capture session when the changes are committed. If another session is already active, enabling a session will generate an error. You must disable the already active packet-capture session before you can enable this session.

Step 8

Commit the transaction to the system configuration:

firepower-4215 /packet-capture/session* # commit-buffer

If you enabled the packet capture session, the system will begin capturing packets. You will need to stop capturing before you can download the PCAP files from your session.


Example

firepower-4215 # scope packet-capture 
firepower-4215 /packet-capture # create session ftd1inside
firepower-4215 /packet-capture* # create filter interface1vlan100
firepower-4215 /packet-capture/filter* # set ivlan 100
firepower-4215 /packet-capture/filter* # set srcIP 6.6.6.6
firepower-4215 /packet-capture/filter* # set destIP 10.10.10.10
firepower-4215 /packet-capture/filter* # exit
firepower-4215 /packet-capture/session* # create phy-port Ethernet1/1
firepower-4215 /packet-capture/session/phy-port* # set drop mac-filter
firepower-4215 /packet-capture/session/phy-port* # set src-filter interface1vlan100
firepower-4215 /packet-capture/session/phy-port* # exit
firepower-4215 /packet-capture/session* # enable
firepower-4215 /packet-capture/session* # commit-buffer
firepower-4215 /packet-capture/session #

Deleting Packet Capture Sessions

You can delete an individual packet capture session if it is not currently running or you can delete all inactive packet capture sessions.

Procedure


Step 1

Enter packet capture mode:

firepower-4215 # scope packet-capture

Step 2

To delete a specific packet capture session:

firepower-4215 /packet-capture # delete session session_name

Step 3

To delete all inactive packet capture sessions:

firepower-4215/packet-capture # delete-all-sessions

Step 4

Commit the transaction to the system configuration:

firepower-4215 /packet-capture* # commit-buffer


Example

firepower-4215 # scope packet-capture 
firepower-4215 packet-capture # delete session asa1inside
firepower-4215 packet-capture* # commit-buffer
firepower-4215 packet-capture #