topic FPR 4100 Snort Memory high Utilization in Network Security

FPR 4100 Snort Memory high Utilization

behrouz6408021 — Mon, 10 May 2021 16:21:33 GMT

Hello

I have two Cisco FPR 4110 with FTD version 6.7

My problem is Memory used by snort even when there is no many traffic on firepower .

my configuration in the firepower are IPS with recommendation enabled and SSL Policy for traffic incoming from outside to my Server Zone and ACL Policy about 200

thank you for help me

Re: FPR 4100 Snort Memory high Utilization

info@songohan.ch — Thu, 23 Sep 2021 13:07:44 GMT

Is there a Solution, i also have the same Hardware with the same Release 6.7.

It startet after a Reboot from FTD and FMC.

Re: FPR 4100 Snort Memory high Utilization

Milos_Jovanovic — Fri, 24 Sep 2021 09:04:39 GMT

HI @behrouz6408021,

I would start with upgrading all of the components to more recent versions (patching to 6.7.0.2, VDB and SRU, and don't forget to check FXOS and Firmware).

If that doesn't help, I wold proceed with TAC case. There is an info in the release notes that bug CSCvt34894 is fixed in 6.7.0 (which looks like behvior you are facing), but we already saw that certain bugs are getting back with newer releases.

BR,

Milos

Re: FPR 4100 Snort Memory high Utilization

Herald Sison — Fri, 21 Oct 2022 02:20:59 GMT

hi Sir, i have this bug even i am using 7.0.4-55 version of my FTD via FMC

Re: FPR 4100 Snort Memory high Utilization

ConSupport — Mon, 06 Feb 2023 07:39:29 GMT

Did you got the solution?

Re: FPR 4100 Snort Memory high Utilization

Herald Sison — Mon, 06 Feb 2023 16:17:31 GMT

Hi Sir, i just upgraded my snort version 2 to version 3 and the high memory utilization is now normalize but other bugs came out particularly the Access Control Policy in URL blocking categories (phishing, malicious sites and malwares) once i enabled these categoriea all sites will be blocked. So far right now i have upgraded my FTD version to 7.0.5 and almost 5 days now i have not yet experienced any problem in terms of url blocking. Fingers crossed!