SourceFire 3D8250 : Network Disruption while adding Access control policy

stuartgeddes — Tue, 12 Mar 2019 12:40:02 GMT

Hi guys,

I am managing 4 IPS 3D8250s using FireSight. I moved all the IPS appliances from default access control policy to a custom Access control policy. While moving the appliances to this policy ( adding the appliances under the tab "Targets" and by clicking "save and apply") I lose access to the network. The outage is around 5-10 mins. Is this a normal behavior ??

The IPS appliances are configured as L2 fail-open. All the traffic passes through these Appliances.

IPS : SourceFire 3D8250
Version : 5.3.0.3

FireSight : Defense Center 1500
Version : 5.3.1.1

Appreciate your help !!

Thanks and Regards,
Stuart

Hi Stuartgeddes,Normally

vrgaikwad — Wed, 29 Apr 2015 05:43:32 GMT

Hi Stuartgeddes,

Normally there wont be any network outage due to access control policy installation but during policy installation sourcefire appliances do not inspect the traffic and bypass it but I have not observed network outage. I have heard that Firewall Fail-over can happened due to Access control policy installation if your sensor is directly connected to firewall. Due to load Defense center console can become unresponsive for some time.

topic Hi Stuartgeddes,Normally in Network Security

SourceFire 3D8250 : Network Disruption while adding Access control policy

Hi Stuartgeddes,Normally