Cisco ASA 5508-X, Configuration Manual

Page: 133 / 428

7-23
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 7 ASA FirePOWER Module
Examples for the ASA FirePOWER Module
The show asp drop command can include the following drop reasons related to the ASA FirePOWER
module.
Frame Drops:
•
sfr-bad-tlv-received—This occurs when ASA receives a packet from FirePOWER without a Policy
ID TLV. This TLV must be present in non-control packets if it does not have the Standby/Active bit
set in the actions field.
•
sfr-request—The frame was requested to be dropped by FirePOWER due a policy on FirePOWER
whereby FirePOWER would set the actions to Deny Source, Deny Destination, or Deny Pkt. If the
frame should not have been dropped, review the policies on the module that are denying the flow.
•
sfr-fail-close—The packet is dropped because the card is not up and the policy configured was
‘fail-close’ (rather than ‘fail-open’ which allows packets through even if the card was down). Check
card status and attempt to restart services or reboot it.
• sfr-fail—The FirePOWER configuration was removed for an existing flow and we are not able to
process it through FirePOWER it will be dropped. This should be very unlikely.
•
sfr-malformed-packet—The packet from FirePOWER contains an invalid header. For instance, the
header length may not be correct.
• sfr-ha-request—This counter is incremented when the security appliance receives a FirePOWER HA
request packet, but could not process it and the packet is dropped.
•
sfr-invalid-encap—This counter is incremented when the security appliance receives a FirePOWER
packet with invalid message header, and the packet is dropped.
•
sfr-bad-handle-received—Received Bad flow handle in a packet from FirePOWER Module, thus
dropping flow. This counter is incremented, flow and packet are dropped on ASA as the handle for
FirePOWER flow has changed in flow duration.
•
sfr-rx-monitor-only—This counter is incremented when the security appliance receives a
FirePOWER packet when in monitor-only mode, and the packet is dropped.
Flow Drops:
• sfr-request—The FirePOWER requested to terminate the flow. The actions bit 0 is set.
•
reset-by-sfr—The FirePOWER requested to terminate and reset the flow. The actions bit 1 is set.
• sfr-fail-close—The flow was terminated because the card is down and the configured policy was
'fail-close'.
Examples for the ASA FirePOWER Module
The following example diverts all HTTP traffic to the ASA FirePOWER module, and blocks all HTTP
traffic if the module fails for any reason:
hostname(config)# access-list ASASFR permit tcp any any eq 80
hostname(config)# class-map my-sfr-class
hostname(config-cmap)# match access-list ASASFR
hostname(config-cmap)# policy-map my-sfr-policy
hostname(config-pmap)# class my-sfr-class
hostname(config-pmap-c)# sfr fail-close
hostname(config-pmap-c)# service-policy my-sfr-policy global