I had to convert a Cisco ASA 5506 to FTD the other day and baffled because no matter what I did the management interface was admin down / down. This is a problem in FTD since you can’t simply type a no shut and you can’t join it to a FMC without the management interface.

It looked like this from the CLI, if you haven’t seen system support diagnostic-cli before, it gives you the classic ASA CLI back for operational commands.

> system support diagnostic-cli
Attaching to Diagnostic CLI ... Press 'Ctrl+a then d' to detach.
Type help or '?' for a list of available commands.

firepower>
firepower> en
Password:
firepower#
firepower# sh int ip br
Interface IP-Address OK? Method Status Protocol
Virtual0 127.1.0.1 YES unset up up
GigabitEthernet1/1 unassigned YES unset administratively down down
GigabitEthernet1/2 unassigned YES unset administratively down down
GigabitEthernet1/3 unassigned YES unset administratively down down
GigabitEthernet1/4 unassigned YES unset administratively down down
GigabitEthernet1/5 unassigned YES unset administratively down down
GigabitEthernet1/6 unassigned YES unset administratively down down
GigabitEthernet1/7 unassigned YES unset administratively down down
GigabitEthernet1/8 unassigned YES unset administratively down down
Internal-Control1/1 127.0.1.1 YES unset up up
Internal-Data1/1 unassigned YES unset down up
Internal-Data1/2 unassigned YES unset down down
Internal-Data1/3 unassigned YES unset up up
Internal-Data1/4 169.254.1.1 YES unset up up
Management1/1 unassigned YES unset administratively down up

How did I fix it? Voodoo? Smash a PIX in front of it so the misbehaving ASA knows my power? Actually the issue is the config-register has been modified on this box and FTD doesn’t like it.

We can fix it by booting into rommon, then we need to use confreg to make sure it is set to 0x00000001, apparently at some point “ignore system configuration” was enabled in my case.

> reboot
This command will reboot the system. Continue?
Please enter 'YES' or 'NO': yes

Broadcast messagStopping Cisco ASA5506-X Threat Defense......ok
Shutting down sfifd... [ OK ]
Clearing static routes
Unconfiguring default route [ OK ]
Unconfiguring address on br1 [ OK ]
Unconfiguring IPv6 [ OK ]
Downing interface [ OK ]
Stopping xinetd:
Stopping nscd... [ OK ]
Stopping system log daemon... [ OK ]
Stopping Threat Defense ...
Stopping system message bus: dbus. [ OK ]
Un-mounting disk partitions ...
mdadm: stopped /dev/md0
Stopping OpenBSD Secure Shell server: sshdstopped /usr/sbin/sshd (pid 3988)
.
Stopping Advanced Configuration and Power Interface daemon: stopped /usr/sbin/acpid (pid 3992)
acpid: exiting

acpid.
Stopping system message bus: dbus.
Deconfiguring network interfaces... ifdown: interface br1 not configured
done.
Sending all processes the TERM signal...
Sending all processes the KILL signal...
Deactivating swap...
Unmounting local filesystems...
Rebooting...
Rom image verified correctly


Cisco Systems ROMMON, Version 1.1.8, RELEASE SOFTWARE
Copyright (c) 1994-2015 by Cisco Systems, Inc.
Compiled Thu 06/18/2015 12:15:56.43 by builders


Current image running: Boot ROM0
Last reset cause: PowerCycleRequest
DIMM Slot 0 : Present

Platform ASA5506 with 4096 Mbytes of main memory
MAC Address: 38:0e:4d:3d:97:a9


Use BREAK or ESC to interrupt boot.
Use SPACE to begin boot immediately.
Boot interrupted.

rommon 1 > confreg

Configuration Register: 0x00000041
Configuration Summary
[ 0 ] password recovery
[ 1 ] display break prompt
[ 2 ] ignore system configuration
[ 3 ] auto-boot image in disks
[ 4 ] console baud: 9600
boot: ...... auto-boot index 1 image in disks

do you wish to change the configuration? y/n [n]: y
disable "password recovery"? y/n [n]: y
disable "display break prompt"? y/n [n]:
disable "ignore system configuration"? y/n [y]:
disable "auto-boot image in disks"? y/n [n]:
change console baud rate? y/n [n]:
select specific image in disks to boot? y/n [n]:

Configuration Register: 0x00000001
Configuration Summary
[ 0 ] password recovery
[ 1 ] display break prompt
[ 2 ] auto-boot image in disks
[ 3 ] console baud: 9600
boot: ...... auto-boot index 1 image in disks

do you wish to change the configuration? y/n [n]:

You must reset or power cycle for new config to take effect
rommon 2 > reset

Resetting .......

Once the FTD came back up the management interface was happy.