topic Re: FMC tags valid URLs into Spam, Exploits or Malicious Sites in Network Security

FMC tags valid URLs into Spam, Exploits or Malicious Sites

kish02 — Thu, 15 Sep 2022 05:32:00 GMT

Hi,

Outbound traffic to the internet on our network are being blocked. FMC tags valid URLs into Spam or Malicious Sites or Exploits.

Im using FMC 7.0.1 (build 84) and FTD Version 7.0.1. Any idea? Thanks.

Sample logs

Re: FMC tags valid URLs into Spam, Exploits or Malicious Sites

Mark Elsen — Thu, 15 Sep 2022 10:36:43 GMT

- Check the URL filtering policies : https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/url_filtering.html

Re: FMC tags valid URLs into Spam, Exploits or Malicious Sites

brewnet84 — Fri, 16 Sep 2022 02:50:27 GMT

I am seeing the same thing running FTD 7.0.4 (build 55) and FMC of same version. I did a pending deployment and despite no changes actual deployed the categories flipped back and traffic started passing. I had been running these versions without issue for almost a week. The exact time I experienced this is 9/14 2pm - 7pm CST.

After

Re: FMC tags valid URLs into Spam, Exploits or Malicious Sites

Jose-Net — Fri, 16 Sep 2022 10:44:02 GMT

Seems a problem with Snortv3 as per bug https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa85492

Ive reverted to Snortv2 and seems to have fixed the problem.

Re: FMC tags valid URLs into Spam, Exploits or Malicious Sites

Herald Sison — Thu, 15 Dec 2022 11:35:56 GMT

Hi Sir, In my situation i can revert to Snort 2 but i will also face the same problem with High Memory Utilization-Snort, that is the main reason why i upgraded to Snort 3. I have reached to TAC already and they suggested to upgrade to FMC and FTD 7.0.5.

https://www.cisco.com/c/en/us/td/docs/security/firepower/70/relnotes/firepower-release-notes-700/bugs.html

Have you tried or experienced the 7.0.5? or anyone here experienced it? need some feedback on this version.

Thanks