Cisco ASA 5508-X, Configuration Manual

Page: 132 / 428

7-22
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 7 ASA FirePOWER Module
Monitoring the ASA FirePOWER Module
App. name: ASA FirePOWER
App. Status: Up
App. Status Desc: Normal Operation
App. version: 5.3.1-100
Data Plane Status: Up
Status: Up
DC addr: 10.89.133.202
Mgmt IP addr: 10.86.118.7
Mgmt Network mask: 255.255.252.0
Mgmt Gateway: 10.86.116.1
Mgmt web ports: 443
Mgmt TLS enabled: true
The following example shows the location of the ASA FirePOWER boot image that was used with the
sw-module module sfr recover command when installing the module.
hostname#
show module sfr recover
Module sfr recover parameters...
Boot Recovery Image: No
Image File Path: disk0:/asasfr-5500x-boot-5.3.1-44.img
Showing Module Statistics
Use the show service-policy sfr command to display statistics and status for each service policy that
includes the sfr command. Use clear service-policy to clear the counters.
The following example shows the ASA FirePOWER service policy and the current statistics as well as
the module status. In monitor-only mode, the input counters remain at zero.
ciscoasa# show service-policy sfr
Global policy:
Service-policy: global_policy
Class-map: my-sfr-class
SFR: card status Up, mode fail-close
packet input 2626422041, packet output 2626877967, drop 0, reset-drop 0, proxied 0
Monitoring Module Connections
To show connections through the ASA FirePOWER module, enter one of the following commands:
•
show asp table classify domain sfr
Shows the NP rules created to send traffic to the ASA FirePOWER module.
•
show asp drop
Shows dropped packets. The drop types are explained below.
•
show conn
Shows if a connection is being forwarded to a module by displaying the ‘X - inspected by service
module’ flag.