Security Intelligence Custom DNS feeds

Dan Eyster — Tue, 12 Mar 2019 13:51:59 GMT

One of my customers is looking to configure a custom DNS feed in FMC. He asked me the question what happens if the server hosting the crashes? Does FMC lose this information? Also, if they remove an entry from the feed, does it remove it from FMC?

I have a feeling I know the answers, but wanted to double check for sure.

Thanks,

Dan

Re: Security Intelligence Custom DNS feeds

mikael.lahtela — Thu, 09 Aug 2018 16:20:49 GMT

Hi,

I think firepower will continue using the old feed until it recognizes a new feed.
Tested this on my unit and when I removed the feed from hosting server, it's still blocking the same entry.

From FMC documentation.
"If the system downloads a corrupt feed or a feed with no recognizable entries, the system continues using the old feed data (unless it is the first download). However, if the system can recognize even one entry in the feed, it uses the entries it can recognize."

Note: There is a slight delay after the feed is updated before devices starts to use it.

br, Mikael

topic Re: Security Intelligence Custom DNS feeds in Network Security

Security Intelligence Custom DNS feeds

Re: Security Intelligence Custom DNS feeds