topic Re: FMC Security Intelligence Sources in Network Security

FMC Security Intelligence Sources

mufasa099 — Sat, 22 Jul 2023 16:48:39 GMT

I've been experiencing a consistent issue with Cisco FMC Security Intelligence and I'm reaching out in hopes that someone might have encountered a similar problem and could provide some insights or potential solutions.

Background:
I have several sources set up that are based on URL imports for IPv4 addresses. Everything seems to function as expected initially, with the feeds downloading without any issues.

Problem:
After approximately 4-5 days, these feeds stop downloading new updates. The only way I've found to resolve this, albeit temporarily, is to pause and then resume them. This makes them start downloading again, but it's not a sustainable solution as I have to constantly monitor and manually intervene.

Troubleshooting Steps Taken:

Checked the URLs to ensure they are active and accessible.
Verified network connectivity and confirmed that there are no external factors preventing the feed download.

Questions:

Has anyone else experienced this specific problem with the Security Intelligence feeds?
Are there any known bugs or patches related to this issue?
Can anyone suggest any diagnostic steps or potential solutions to troubleshoot and resolve this issue?

Thank you in advance.

Re: FMC Security Intelligence Sources

Marius Gunnerud — Sat, 22 Jul 2023 17:02:54 GMT

Please provide the FMC model and which version it is running. And, how are you importing the URL list? is it through a custom Security Intelligence feed? if not, please provide in detail how this is being imported to the FMC.

Re: FMC Security Intelligence Sources

MHM Cisco World — Sat, 22 Jul 2023 17:09:40 GMT

Share more detail if you can

Thanks

MHM

Re: FMC Security Intelligence Sources

mufasa099 — Sat, 22 Jul 2023 18:14:13 GMT

Here are the FMC details:

Model Cisco Firepower Management Center for VMWare 300
Software Version 7.0.2 (build 88)
OS Cisco Firepower Extensible Operating System (FX-OS) 2.10.1 (build192)

Yes, I am importing using a custom URL list, as shown here:

As you can see it should update every 6 hours, the last update was done 18 hours ago.

Let me know if you need more information.

@MHM Cisco World

Re: FMC Security Intelligence Sources

Marius Gunnerud — Sun, 23 Jul 2023 12:59:49 GMT

How large are the files you are importing and how many entries are in the files?

Re: FMC Security Intelligence Sources

MHM Cisco World — Sun, 23 Jul 2023 13:01:32 GMT

Exact what in my mind'

Are file more than 150 mb?

Re: FMC Security Intelligence Sources

mufasa099 — Sun, 23 Jul 2023 14:37:34 GMT

The files are not that big, they have few hundred IPs only. It also stops importing STIX from Alienvault.