Network Management

NCM Configs download but not completely for Cisco FTD

When downloading configurations from Cisco Firepower Threat Defense (FTD) with NCM, the config download stops part‑way through and is not fully saved in the NCM Config Archive. The session trace shows the download stopping after the enrollment terminal line under the trustpoint configuration. Updating the Cisco Firepower device template to use exact prompt matching resolves the issue.

First published date

3/11/2026 2:57 PM

Last published date

3/11/2026 2:57 PM

Overview

Symptoms

  • NCM config download completes without error, but the resulting configuration file is truncated.

  • The configuration stops after the crypto ca trustpoint section, specifically at the enrollment terminal line.

  • No obvious error is reported in the NCM job; only the output is incomplete.

 

Example session trace

Excerpt around the point where the capture stops:

[1845b767] [03/04/2026 16:24:01.194] -->snmp-server host-group management obj-10.210.46.0 poll version 3 Solarwinds 
[1845b767] [03/04/2026 16:24:01.195] -->no snmp-server location 
[1845b767] [03/04/2026 16:24:01.196] -->no snmp-server contact 
[1845b767] [03/04/2026 16:24:01.197] -->snmp-server community ***** 
[1845b767] [03/04/2026 16:24:01.198] -->no sysopt connection permit-vpn 
[1845b767] [03/04/2026 16:24:01.199] -->crypto ipsec security-association pmtu-aging infinite 
[1845b767] [03/04/2026 16:24:01.200] -->crypto ca certificate map PCBMKD-MAP 10 
[1845b767] [03/04/2026 16:24:01.202] --> subject-name attr ou eq mkd 
[1845b767] [03/04/2026 16:24:01.204] -->crypto ca trustpoint 1CAchainProcreditGroup 
[1845b767] [03/04/2026 16:24:01.205] --> enrollment terminal 
[1845b767] [03/04/2026 16:24:01.206] --> keypair <Default-RSA-Key>

After this point, no additional lines are captured in the downloaded configuration.

Product section

Network Configuration Manager

Cause

FTD’s CLI behavior around the enrollment terminal trustpoint command and subsequent certificate/key input can confuse NCM’s prompt detection if exact prompt matching is not enabled in the device template.

Without UseExactPromptMatch, NCM may misinterpret output around this section as a prompt transition or end of output, causing the config download to stop prematurely.

Resolution

There are two supported ways to resolve the issue:

Option 1 – Add UseExactPromptMatch to the existing Cisco Firepower template

  1. On the SolarWinds server, open the Cisco Firepower device template XML file in a text editor.

  2. Within the <Commands> block, add the following line:

<Command Name="UseExactPromptMatch" Value="true"/>

  1. Save the file.

  2. In the SolarWinds web console, go to NCM Settings → Device Templates and confirm the template is updated.

  3. Re‑run a manual config download from Config Management for the affected FTD node.

  4. Verify that the configuration in the NCM Config Archive is now complete past the enrollment terminal line.

Option 2 – Use a full Cisco Firepower FTD template with exact prompt matching

If you prefer a complete, explicit device template, you can use the following example template (or import it as a new device template):

<Configuration-Management
  Device="Cisco Firepower Threat Defense FTD"
  SystemOID="1.3.6.1.4.1.9.1.2320"
  AutoDetectType="BySystemOid">

  <Commands>
    <!-- Enter diagnostic CLI, then enable -->
    <Command Name="EnableCommand"
             Value="system support diagnostic-cli${CRLF}enable" />

    <Command Name="MenuBased" Value="false" />
    <Command Name="UseExactPromptMatch" Value="true"/>
    <Command Name="UseVirtualPromptForCommands" Value="true" />

    <Command Name="Startup"  Value="startup-config" />
    <Command Name="Running"  Value="running-config" />

    <!-- IMPORTANT: lowercase 'show' -->
    <Command Name="DownloadConfig" Value="show ${ConfigType}" />

    <Command Name="Version" Value="show version" />
  </Commands>
</Configuration-Management>

Steps:

  1. Save the XML above as a new template file (for example Cisco Firepower Threat Defense FTD).

  2. Place it in the NCM device templates directory.

  3. In the web console, go to NCM Settings → Device Templates and assign this template to the affected FTD node(s).

  4. Perform a new Running and/or Startup config download.

  5. Confirm that the full configuration, including and beyond the enrollment terminal section, is now captured.

Validation

After applying either option:

  1. Run a manual config download from Config Management for the Cisco FTD node.

  2. Compare:

    • The downloaded config in NCM Config Archive, and

    • A direct CLI show running-config from the device.

  3. They should now match, with no truncation at the trustpoint enrollment terminal line.

If the configuration is still truncated:

  • Capture a new NCM session trace for the device.

  • Confirm the updated device template is assigned and in use.

  • Check for any additional interactive prompts or unusual output around PKI / trustpoint configuration that might require further template tuning.