Troubleshoot Management Connectivity on a Data Interface

This topic helps you troubleshoot the loss of management connectivity when using a data interface for manager access instead of the dedicated Management interface.

If you use a data interface for manager access instead of the dedicated Management interface, exercise caution when changing the interface and network settings for the Firewall Threat Defense in the Cloud-Delivered Firewall Management Center to avoid disrupting the connection. If you change the management interface type after adding the Firewall Threat Defense to the Cloud-Delivered Firewall Management Center (switching between data and Management interfaces), misconfiguration of interfaces and network settings can result in loss of management connectivity.

Use the following methods to troubleshoot management connectivity:

  • View management connection status: Check the status in the Devices > Device Management page or use sftunnel-status-brief at the CLI.

  • View network information: Use show network to verify Management and manager access data interface settings.

  • Check registration: Use show managers to confirm registration completion.

  • Ping the manager: Use ping or ping system to test connectivity.

  • Capture packets: Use capture on the nlp_int_tap interface to trace management traffic.

  • Check interface status: Use show interface detail for the nlp_int_tap interface.

  • Check routing and NAT: Use show route and show nat to verify routing and internal NAT rules.

  • Check DDNS: Use debug ddns and related commands to verify DDNS updates. 


        > sftunnel-status-brief
        PEER:10.10.17.202
        Registration: Completed.
        Connection to peer '10.10.17.202' Attempted at Mon Jun 15 09:21:57 2020 UTC
        Last disconnect time : Mon Jun 15 09:19:09 2020 UTC
        Last disconnect reason : Both control and event channel connections with peer went down
      

        > show network
        ===============[ System Information ]===============
        Hostname                  : FTD-4
        Domains                   : cisco.com
        DNS Servers               : 72.163.47.11
        DNS from router           : enabled
        Management port           : 8305
        IPv4 Default route
        Gateway                 : data-interfaces
        ...
Note

At the Firewall Threat Defense CLI, check that the Cloud-Delivered Firewall Management Center registration was completed. Note that this command will not show the current status of the management connection.

Refer to https://cisco.com/go/fmc-reg-error for Cloud-Delivered Firewall Management Center log file information.