topic Re: FMC connecting to amazon in Network Security

FMC connecting to amazon

kostasthedelegate — Mon, 29 Jul 2019 09:17:53 GMT

Hello,

I have a client reporting that the FMC is connecting the last couple of days to some IP ( i.e. 34.246.67.169) through https and maybe it is downloading. It is strange because it is something new and the bandwidth is consumed, foe ten or so minutes.

He tracked the IP to Amazon Europe.

I would like to ask if there is any communication between the FMC and Amazon.

How could I track this connection that concerns only the FMC?

Regards,

Konstantinos

Re: FMC connecting to amazon

balaji.bandi — Mon, 29 Jul 2019 11:38:59 GMT

FMC download updates from Cisco update server, need to check is this hosted on Amazon

As per my knowledge the IP belong to **.brightcloud.com) this is for webroot updates i guess.

Re: FMC connecting to amazon

kostasthedelegate — Mon, 29 Jul 2019 11:47:46 GMT

Hello Balaji,

Yes, I agree that this traffic could be updates from Cisco, but why they take up all the bandwidth?

I saw too about brightcloud, but how could I check if cisco is hosted in amazon?

Also, this is the DR where the IPS does not work yet.

Regards,

Konstantinos

Re: FMC connecting to amazon

Marvin Rhoads — Mon, 29 Jul 2019 12:05:16 GMT

As @balaji.bandi noted, the Amazon address is one location where the Brightcloud server (database.brightcloud.com - source for FMC's URL updates) is hosted.

We can see this in the following screen taken from Cisco Umbrella Investigate:

Re: FMC connecting to amazon

kostasthedelegate — Mon, 29 Jul 2019 12:21:39 GMT

Hello Marvin,

Ok so the FMC tries to download updates for its URL database.

Why do you think it consumes all the bandwidth?

Regards,

Konstantinos

Re: FMC connecting to amazon

balaji.bandi — Mon, 29 Jul 2019 13:23:01 GMT

what kind of bandwidth consumption we are talking ? its general incremental updates it will pull from that servers.

until you have initiated other software upgrades.

Re: FMC connecting to amazon

kostasthedelegate — Mon, 29 Jul 2019 13:28:03 GMT

It is taking up all the line.

Well it must be a provider issue, as it seems. There were problems so it timed out, that's why it kept retrying to download.

Thank you for your help

Regards,

Konstantinos

Re: FMC connecting to amazon

balaji.bandi — Mon, 29 Jul 2019 15:11:06 GMT

Hope you sorted the issue with provider by now. (on the side note more interested all line speed ? what speed it is ?)

if this is resolved marked as resolved so others can refer this as solution.

Re: FMC connecting to amazon

kostasthedelegate — Tue, 30 Jul 2019 05:13:18 GMT

Hello,

It was about 14 Mbps

Regards,

Konstantinos

Re: FMC connecting to amazon

balaji.bandi — Tue, 30 Jul 2019 07:10:06 GMT

14MBps is small amount for internet in this era, if that is the case you an shedule for non-peak hours to get updates.(this is not recommended, since you miss real time any zero attack scenarios)