topic Re: HTTP traffic stops passing through IPS in Network Security

HTTP traffic stops passing through IPS

phamthecong — Tue, 26 Mar 2019 00:20:46 GMT

Hi All,

We have an inline IPS 4260 (version 7.1(7), sig ver 719) that works for a while and suddenly stops passing http traffic through. All other kinds of traffic inlucing https are still passing through as normal. Stop sending traffic to it for awhile then everything works fine. Does anyone have the same problem?

contacted TAC and been advised that sig1300.0 was disabled but the system was not reset that might cause prob. is that true that once we modified Normalizer sigs, we have to reset the appliance?

any help would be appreciated.

Regards,

Tao Lao

HTTP traffic stops passing through IPS

Julio Carvajal — Wed, 22 May 2013 00:20:27 GMT

Hello Tao,

We certainly do not recommend to modify the normalizer signatures as that could lead to issues as the one you are mentioning,

so are you saying that you reset the box and it worked? and you want to know why?

Or you have not done it and want to know if it could work for u?

Regards

HTTP traffic stops passing through IPS

phamthecong — Wed, 22 May 2013 00:38:32 GMT

thanks jcarvaja for the reply,

I have not reset it yet as it might cause a downtime. I want to know if reset could fix the prob.

i understand the implication of modifying the normalizer sigs but the sig1300.0 generates so many alerts that we could not handle it. so we have disabled the alert action of sig1300.0.

Regards,

tao lao

Re:HTTP traffic stops passing through IPS

Julio Carvajal — Wed, 22 May 2013 03:19:37 GMT

Hello,

Interesting enough.

Is http traffic flowing across your network normally right now?

Maybe you could send me the case number on a private message so I can take a look at it.

Sent from Cisco Technical Support Android App

Re: HTTP traffic stops passing through IPS

ROBERT MOON — Wed, 22 May 2013 04:04:03 GMT

I have the same issue with Cisco IPS 4260. Since I upgraded to the latest software, I'm running into issues with http traffic.

Http traffic will pass through the IPS unit and suddenly it will block all http traffic for about 10 - 15 minutes.

This happens so mutltiple times throught out the day that I currently bypassing the entire unit.

My case, this started after I upgraded the software and I didn't disable any sigs.

I would love to hear a solution for this issue.

Thanks,

Rob

Re: HTTP traffic stops passing through IPS

phamthecong — Wed, 22 May 2013 04:27:05 GMT

Hi Robert,

I dont have a solution yet but when turned the unit to run in asymmetry mode, the unit seems to be stable.

I initially ran into 100% inspection load issue then new firmware came out, upgraded it, ran into 99% missed packets issue. upgraded again, ran into this issue. heachache!!!

Tao Lao

Re: HTTP traffic stops passing through IPS

Julio Carvajal — Wed, 22 May 2013 16:43:34 GMT

Hello,

Yeah, I mean based on your network you will need to run on asymetric mode as the normalizer engine working in strict mode will cause a lot of issues due to the network design issues,

Regards

Note: I have answered your email