topic I had the same issue, and it in Network Security

Firepower CPU Saturate

h.infotronique1 — Tue, 12 Mar 2019 13:14:56 GMT

Hello,

I have some issue with my ASA 5512x Firepower with module SFR; I install it and it work fine, but this day i have a problem with saturation of his CPU in the Firesight Management I see the CPU of module SFR very high it achieve 99,87% in this situation it block all my navigation internet and also the access of the diffrent server i can't do anything; for information i put just two rules one to block a social netwok and the second to block an anonymous site.

in the ASA ASDM the trafic of the diffrent interface i have don't pass the trafic 20000 Kbps

thanks.

What version are you in?

Claudiu Cismaru — Mon, 09 Jan 2017 09:58:54 GMT

What version are you in?

Do you have IPS policies, file policies on those 2 rules?

the version of SFR that i use

h.infotronique1 — Mon, 09 Jan 2017 11:00:56 GMT

the version of SFR that i use is 5.4.0-764

i have no IPS policy no file policy i just use the default policy for the moment!! and i delete those rule i made now the CPU idecate 59.76% !!

What version is the FMC?

Claudiu Cismaru — Mon, 09 Jan 2017 11:11:53 GMT

What version is the FMC?

First of all, you should use the latest available software. 5.4.0 is the beginning of 5.4 branch, which is pretty old now.

Before doing any other troubleshooting, I recommend to upgrade to latest 5.4.1.x on FMC and 5.4.0.x on SFR module.

Hi,

h.infotronique1 — Mon, 09 Jan 2017 13:19:49 GMT

Hi,

thanks for your reply ,

for the FMC do you mean Firesight cause i use a VM that i upload from cisco web site it was the version Sourcefire_Defense_Center_Virtual64_VMware-ESXi-5.4.0-763

thanks.

Sorry for delay.

Claudiu Cismaru — Wed, 18 Jan 2017 11:41:38 GMT

Sorry for delay.

On the FMC UI you have in System -> Updates the versions which you can update to.

Hi,

ccg-security — Wed, 01 Feb 2017 07:28:01 GMT

Hi,

You can download it on cisco website if your account has privileged access to download any ios version. Then import your downloaded version to FMC and point to to any sensor or FMC you wish to download.

Best Regards!

I had the same issue, and it

sistematico — Wed, 08 Feb 2017 16:52:24 GMT

I had the same issue, and it never get resolve I contact Cisco and they create a hotfix for me, aparently there is a bug which make the CPU and memory go high, also when you have this issue you can disable firepower on the ASA by deleting the Firepower policy from ASDM or from the CLI and everything will get back to normal.

thanks for your replies,

h.infotronique1 — Tue, 28 Feb 2017 07:59:39 GMT

thanks for your replies,

I do update my Fireght and then i restart him and it's ok, but now i see that he reach saturate point all days at 6pm to 7pm i dont understand why?

To me that sounds like FMC is

Dennis Perto — Thu, 02 Mar 2017 21:02:35 GMT

To me that sounds like FMC is updating something from 6.00pm. 🙂