[rancid] FXOS on FirePower 4140

[Chris Stromsoe]

On Fri, 8 Feb 2019, Erik Muller wrote:

> The current fxos module assumes FTD on a 2100 platform (and I'm 
> currently testing support for ASA on 2100).  My understanding is that 
> the 4100 and 9300 have a bit of a different architecture from the 2100, 
> but I've not touched those to be able to say how exactly they differ.
>
> It looks like the initial login layer on the 4100 must be different. 
> Is there any other "connect" option from either the initial login layer 
> or the fxos layer, where the actual firewall functions are exposed?

It looks like logging in to the 4100 drops you straight into fxos.

Options for connect are

fw# connect
   adapter     Mezzanine Adapter
   cimc        Cisco Integrated Management Controller
   fxos        Connect to FXOS CLI
   local-mgmt  Connect to Local Management CLI
   module      Security Module Console


The connect command is not available after running "connect fxos".  You 
have to "exit" to return to the initial layer.



> On a 2100 the first layer you connect to is the FTD application (similar to 
> legacy ASA platform), with a simple ">" prompt and a config syntax like:
>> show running-config
> : Serial Number: J..........
> : Hardware:   FPR-2130, 14854 MB RAM, CPU MIPS 1200 MHz, 1 CPU (12 cores)
> :
> NGFW Version 6.2.3.4
> !
> hostname firepower
> ...
> !
> interface Ethernet1/1
> nameif border1
> ...
>
> After that in the fxos layer, the config is more like the the UCS FI:
> > connect fxos
> Cisco Firepower Extensible Operating System (FX-OS) Software
> xxx-fw01# sho configuration
> scope org
>     enter bios-policy SRIOV
>         set acpi10-support-config acpi10-support platform-default
> ...


The login layers on the 4100 seems to be reversed when compared to the 
2100 with ftd.

The initial login layer on the 4100 resembles the 2100 after having run 
"connect fxos", and has a limited command list.

Running "connect fxos" on the 4100 resembles the initial login layer on 
the 2100, and has an extensive command list.

I've copied all of the fxos definitions in rancid.types.base to fxos-ftd 
and updated router.db for my 2100/FTD devices.  I removed the fxos entries 
that don't run on the 4100 and re-ordered the commands.  I have a working 
configuration for the 4140, though none of the output from "show 
running-config" is getting picked up.  Maybe using WriteTermFTD isn't 
right for that.

fxos;command;fxos::RunCommand;term len 0
fxos;command;fxos::RunCommand;connect fxos; prompt changes
fxos;command;fxos::ShowInventory;show inventory
fxos;command;fxos::WriteTermFTD;show running-config
fxos;command;fxos::RunCommand;exit; prompt changes
fxos;command;fxos::ShowFirmware;show system firmware detail
fxos;command;fxos::ShowChassis;show chassis detail
fxos;command;fxos::ShowChassis;show chassis inventory detail
fxos;command;fxos::ShowChassis;show chassis environment expand detail
fxos;command;fxos::WriteTerm;show configuration




-Chris