SNORT Inspection Policy Deployment Failures in Cisco FMC
A network administrator is configuring SNORT inspection policies and is seeing failed deployment messages in Cisco FMC. What information should the administrator generate for Cisco TAC to help troubleshoot?
Community Insight
The question tests whether you know that FMC-side deployment failures require the FMC troubleshoot file, while show tech and device troubleshoot files are for FTD CLI-level issues. The trap is assuming the managed device is at fault.
When SNORT inspection policy deployment fails in Cisco FMC, the administrator should generate a troubleshoot file from the FMC for Cisco TAC. This page explains why the FMC troubleshoot file, not a device show tech or device troubleshoot, is the right diagnostic artifact for failed deployment messages.
A frequent wrong answer is selecting a show tech or troubleshoot file for the FTD device, because failed deployment originates from the FMC’s policy compilation and deployment process, not from the device’s runtime state.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct option is C because failed deployment messages in Cisco FMC are generated by the FMC's policy compilation and deployment process, not by the managed FTD's runtime. As japm1801 explained, deployment failures originate from FMC and the configuration error "remains in the FMC" even though the FTD is the target. Cisco's FMC troubleshooting guide confirms that a troubleshoot file generated from the FMC captures the relevant logs, database state, and policy deployment details that Cisco TAC needs. Doris8000 also linked the Cisco guide for the FMC troubleshoot file. Therefore, generating an FMC troubleshoot file is the correct diagnostic step before opening a TAC case.Why the Other Options Are Wrong
Option A is wrong because a device troubleshoot file targets the FTD's runtime and data plane, not the FMC's policy compilation errors; donciga pointed to a data path troubleshooting document, but that guide addresses packet flow issues rather than failed policy deployments. Option B is wrong because "show tech" is a CLI command on the FTD that collects device-level diagnostics such as CPU, interfaces, and processes, which does not contain the FMC's deployment error logs. Option D is wrong because FMC does not use the "show tech" CLI command; the FMC's diagnostic artifact is the troubleshoot file, not a show tech file. Thus, only the FMC troubleshoot file directly addresses the SNORT inspection policy deployment failure.Community Comment Notes
Community votes and comments show a clear majority for option C, with japm1801 noting that the configuration error remains in the FMC and Doris8000 linking the Cisco guide for the FMC troubleshoot file. Cisco_2022 also selected C, reinforcing that FMC-side diagnostics are expected. NoOn3x acknowledged ambiguity between A and C, but the practical TAC workflow for deployment failures starts with the FMC troubleshoot file. donciga's support for A is based on a data path troubleshooting document that does not cover deployment failures, so it should not override the FMC-focused answer.Official Reference
Exam Strategy
For 300-710 deployment questions, always identify where the error is surfaced and which component owns the failing process. If the failure is in FMC policy deployment, collect the FMC troubleshoot file; if it is a device runtime or data plane issue, use FTD show tech or device troubleshoot.
Frequently Asked Questions
Why is an FTD troubleshoot file not the right choice for failed SNORT deployments?
Deployment failures are generated and logged by the FMC policy compilation engine, so the FMC troubleshoot file contains the relevant error details for TAC.
When should I collect a show tech file from the FTD instead?
Use FTD show tech for device-level issues such as data plane problems, crashes, or CLI errors, not for FMC-side deployment failures.