I85PREP
⌘ K
Cisco CBRFIR (300-215) study materials
Cisco CBRFIR (300-215) study resources

Cisco CBRFIR (300-215): Troubleshooting, Monitoring, and Operations

Cisco CBRFIR (300-215) · Work through your exam, one topic at a time.

All guide sections

Troubleshooting, Monitoring, and Operations

This domain tests whether you can find the right event, use the right tool, and trace a problem through the policy pipeline without guessing. Operational discipline matters more than memorized menus.

Monitoring surfaces

  • FMC provides the Health Monitor, Task Status, Audit Log, and dashboards. Health Monitor tracks device and policy health; Audit records configuration changes.
  • Event types include Connection, Security Intelligence, Intrusion, File, Malware, SSL, and User events. A blocked connection normally produces a Connection event; an exploit signature produces an Intrusion event.
  • Configure syslog, SNMP, and NetFlow Secure Event Logging through Platform Settings. Logging must also be enabled on the relevant access control rule.

Troubleshooting tools

  • Packet Tracer in FMC simulates a packet through prefilter, access control, NAT, SSL, and inspection, showing which rule matches.
  • Packet Capture on the FTD captures traffic at an interface. CLI commands include show conn, show interface, show route, and show running-config. The FTD expert mode provides Linux-level diagnostics.
  • Check in order: interface and routing, prefilter, access control, NAT, SSL, then intrusion or file inspection.

Worked example

A user reports that a website is blocked. You filter Connection events by the user source IP and destination. The event shows the traffic was blocked by access control rule 12. You open the access control policy and see rule 12 is a broad Block rule placed above the intended Allow rule. You move the Allow rule above rule 12 and deploy. If there had been no Connection event at all, you would check routing and interface status first, because traffic may never have reached the policy engine.

Operations

  • Use the FMC health monitor and audit logs during change windows. Verify NTP and time zones so event timestamps correlate across FMC, FTD, and syslog.
  • Back up FMC configuration and device configurations before upgrades. Check compatibility between FMC and FTD versions.

Traps that cost marks

  • Looking for a block in Intrusion events when it is a Connection event.
  • Forgetting that rule-level logging must be enabled.
  • Troubleshooting policy before confirming routing and interface status.
  • Ignoring time synchronization when correlating events.
  • Deploying a configuration change and checking events before deployment completes.