topic you should check if you have in Network Security

Defense Center generates alerts on "URL filtering download failure"

Nazmul Rajib — Tue, 12 Mar 2019 12:34:30 GMT

I am receiving the following health alerts continuously on my Sourcefire Defense Center running software version 5.2. How can I stop this alert?

URL filtering download failure

ReasonThis issue may occur on

Nazmul Rajib — Wed, 09 Jul 2014 16:41:35 GMT

Reason

This issue may occur on a Sourcefire appliance after the URL filtering license is removed or expired. It affects all appliances running software version 5.2.x.

Solution

This issue is resolved in software version 5.3.0. Please update the software version of your Sourcefire appliance to 5.3.0 or greater to resolve this issue.

Well the issue is back on 5.4

Tomasz Joniak — Tue, 06 Oct 2015 15:54:53 GMT

Well the issue is back on 5.4.1.2, and TAC has no answer. If anyone ever had this and figured out what it may be, please let me know.

Thanks

Tomasz

I have same issue with Same

mcdvikram — Wed, 07 Oct 2015 01:19:12 GMT

I have same issue with Same version 5.4.1.2 . Module URL Filtering Monitor: URL Filtering download failure . Any update from Cisco TAC ?..

I have same issue with

Morten S Linnemann — Thu, 08 Oct 2015 12:01:50 GMT

I have same issue with version 5.3.1.5 URL Filtering download failure any updates??

I got the same URL Filtering

vangkilde — Sun, 20 Dec 2015 22:34:27 GMT

I got the same URL Filtering download failure on a version 6.0.0 (build 1005).

Something new about this issue?

URL filtering download

Nikhil Vaidya — Thu, 07 Jan 2016 14:00:04 GMT

URL filtering download failures can be due to a variety of reasons: connectivity, packet malformation along the path, etc.. Please open a TAC case so that they can review your logs to identify why the download failed and provide you with a solution

I have the same error and TAC

kpendleton1 — Fri, 11 Mar 2016 14:51:12 GMT

I have the same error and TAC hasn't figure why the downloading is having an error. This seems like a problem that would come from a $200 dollar device without a good manufacture. This is the first I've experience this type of service from an Cisco device.

Hi kpendleton

vangkilde — Mon, 14 Mar 2016 09:48:34 GMT

Hi kpendleton

After establishing a scheduled (daily) update the FireSight got the correct URL updated. This is still version 6.0.

Afterwards I've updated with patch 6.0.0.1 and the update runs correctly.

i have the same issue , i am

Muhammad.Eissa — Sat, 26 Mar 2016 11:11:16 GMT

i have the same issue , i am running 6.0.1

also i get this from the syslog for some connectons

Sinkhole: Unknown, URLCategory: Unknown, URLReputation: Risk unknown

I have this issue also, 5506

Michael Proctor — Wed, 18 May 2016 16:50:34 GMT

I have this issue also, 5506 running 6.01. Did anyone ever get a resolution?

where can i set it for Daily

it-management — Mon, 29 Aug 2016 14:57:10 GMT

where can i set it for Daily Download?

At "Updates\Rule Updates"?

When i watch here

hhttp://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/117956-technote-sourcefire-00.html

I just found places to activate not to set a schedule...

check my attachment , its on

Muhammad.Eissa — Tue, 30 Aug 2016 08:06:06 GMT

check my attachment , its on V 6

but as i remember its close to it

Hm.. I configured this, but

it-management — Tue, 30 Aug 2016 14:54:13 GMT

Hm.. I configured this, but no rules are downloaded...

I try the 4 steps of Cloud Connectivity Issues, at:

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118852-technote-firesight-00.html

everything ok, but I still get:

"URL filtering download failure"

and Syslogs say:

Aug 30 2016 16:05:18 IRSFIREPOWER SF-IMS[18786]: [18790] CloudAgent:cloud_config [INFO] Peer with active URLFiltering: eea1c65c-644b-11e6-a895-f5552129ae4f

When I watch at: /var/sf/cloud_download

an wenn I search for bdcb or .bin files i dont found anything...

(???)

i had same as your issue ,

Muhammad.Eissa — Wed, 31 Aug 2016 23:31:05 GMT

i had same as your issue , but i found out that i add the IP of the FirePOWER under one of my rules that dont allow him to get updates . so i allowed him for all and that ssolved the issue for me.

Note : i had other issues with FireSIGHT Virtual Appliance it self and solved it by redeploy new one.

The System is just a

it-management — Thu, 01 Sep 2016 12:54:50 GMT

The System is just a testsystem so far, ich wanted to set it productive these days, when i put all settings to any-any then i got no Download, too... 😞

you should check if you have

Muhammad.Eissa — Thu, 01 Sep 2016 23:39:44 GMT

you should check if you have proxy in ur network , if you have one you should configure the firepower for it , if not then you should contact your reseller or cisco TACto help out in this.

Hm...ok, we've set the proxy

it-management — Tue, 06 Sep 2016 10:07:52 GMT

Hm...ok, we've set the proxy at the Firepower, for weeks... so it seems, i need to open a ticket... 😕

Hi ,

Aastha Bhardwaj — Wed, 07 Sep 2016 11:58:20 GMT

Hi ,

Try this :

Escalate the privilege to root on Defense center : sudo su

Root > curl –vvk database.brightcloud.com
Root> curl –vvk service.brightcloud.com

See what do you get , also check /var/log/messages and you will see errors related to cloud lookups . For proxy the IP of the Firesight Manager and the sensor need to be whitelisted on the proxy.

Regards,

Aastha Bhardwaj

Rate if that helps!!!