topic Wow thank you for the help I in Network Security

FireSIGHT low bandwidth high latency to remote sensor.

Rellish83 — Sun, 10 Mar 2019 13:41:09 GMT

All,

I'm having an issue pushing an Access and Intrusion Policy to a remote sensor over a Satellite link with high latency and low bandwidth. Latency is about ~700ms and bandwidth is about 116k, I know state of the art right. It is experiencing RPC timeouts when pushing the policy updates. I know the DC is trying to push this policy as ng_apply_pack.tgz which is about 19mb. I can run this command on the DC “time sfmgr –c “PUTFILE /var/tmp/testfile500k /var/tmp/testfile500k” –u (UUID of sensor)” and will be successful, if i try and make it any bigger it fails. When adding the -t option for the RPC even at 2000sec it will still fail at a 1mb file. Any ideas or suggestions would be greatly appreciated it. Running DC 5.4.1.7 and Senor 5.4.0.8.

Thanks

Hi

Dennis Perto — Wed, 16 Nov 2016 08:25:51 GMT

If you have tried to edit the RPC settings on the Management Center and it did not work, then I would recommend that you upgrade to Firepower 6.X.

Instead of pushing the config form the MC, the sensor will pull.

If you want to play with RPC

Dennis Perto — Wed, 16 Nov 2016 08:27:17 GMT

If you want to play with RPC timeouts, you can try this.
If it fails, you are on your own.

Step 1: Create the file /etc/sf/rpc_timeout.conf on the DC:

admin@DC:~$ sudo touch /etc/sf/rpc_timeout.conf

Step 2: Edit the file to include the following lines with the default values:

rpc_timeout 120;
command_timeout 240;
wait_timeout 600;

Step 4: Increase or decrease the timeout values as needed. For example:

rpc_timeout 128;
command_timeout 785;
wait_timeout 842;

Changing these values overrides the default timeouts.

rpc_timeout = Overrides the default of 120 seconds for RPC (Remote Procedure Calls)
command_timeout = Overrides the default of 240 seconds for file copy operations
wait_timeout = Overrides the default of 600 seconds for distributed calls and Policy applies from a Master Defense Center.

Thanks for the response. I

Rellish83 — Wed, 16 Nov 2016 18:33:41 GMT

Thanks for the response. I have tried to adjust those RPC timeouts and I am still unsuccessful in transferring the policies. I will not be able to upgrade to 6.X until I upgrade the memory on the Defense Centers.

If you have a FS/DC750,

Dennis Perto — Thu, 17 Nov 2016 09:13:21 GMT

If you have a FS/DC750, DC1500 or DC3500 you can order a free memory upgrade here:
http://www.cisco.com/c/en/us/support/docs/field-notices/640/fn64077.html

Wow thank you for the help I

Rellish83 — Thu, 17 Nov 2016 16:34:41 GMT

Wow thank you for the help I did not know this was a free option. Really appreciate the support I will see if this can fix the issue.