topic Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module in Network Security

security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

engahmedsaied — Fri, 21 Feb 2020 14:43:23 GMT

Hello all,

after upgrading to version 6.2.2 we face the following error

security intelligence URL: memcap exceeded

also same error exist in 6.2.2.1

I saw similar bug but on FTD, we are not using FTD

we are using one virtual firepower management center to manage two ASAs with firepower module.

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

mikael.lahtela — Sat, 11 Nov 2017 20:14:52 GMT

Hi,

It's the same problem, I had a TAC case on a Firepower module and had the same recommendation for workaround.

Try tune your url, si and dns policy.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvg34306

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvf25058/?referring_site=bugquickviewredir

br, Mickel

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

zivanovichn — Wed, 22 Nov 2017 16:02:05 GMT

Why does this bug now say its "fixed" when there are no new releases addressing this. That's a bullsh!t answer from Cisco.

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

toddlammle — Thu, 23 Nov 2017 02:48:26 GMT

I discuss this www.lammle.com/about/blog

I have found that if you remove most of the URL and DNS objects (the layer 7 SI inspection), then the problem goes away. You can Create block rules in your ACP instead..

This problem is based on the lower RAM in the ASA such as 5506 and 5508, but I haven't seen this problem in 6.2.2 on higher end ASA's or 2100/4100/9300.

There cannot be a fix for this issue because it is a RAM issue, meaning that there are more SI objects now than what some ASA's can handle.

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

vaibhav.parlekar1 — Tue, 28 Nov 2017 22:19:33 GMT

Would be great if Cisco publishes the maximum no. of objects related to IP, URL & Domains that is supported based on the hardware appliance.

Vaibhav

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

toddlammle — Tue, 28 Nov 2017 23:31:09 GMT

I think they'd rather have you buy a 4100! 🙂

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

TCSPB — Tue, 23 Jan 2018 16:43:10 GMT

Cisco has a hotfix out for this. We received it from TAC and I installed it today and all issues with the errors are resolved.

I suggest opening a case with Cisco and getting the hotfix.

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

toddlammle — Tue, 23 Jan 2018 22:52:14 GMT

that is fantastic! Thank you!

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

toddlammle — Wed, 24 Jan 2018 21:58:39 GMT

hey, cisco doesn't know anything about this...

can you send me the hot fix if you got it? can you advise?

here is what cisco said:

I am Jashanjit Badwal from Cisco TAC and I’ll be assisting you with your case.

If I understand correctly, you have task notification health alerts stating that "Security Intelligence URL: memcap exceeded". From previous experience, unfortunately, this issue happens due to the total available memory in the appliance. What the alert means is that the appliance is not able to load all entries available in the memory and will only load partial SI entries. To overcome this issue, as you stated, we need to remove Security Intelligence categories by navigating to "Policies > Access Control > Edit the policy > Click on Security Intelligence tab" and remove the URL categories and DNS categories. The latter step frees up shared memory for SI to load more entries. At the time of this writing, there is no other documented workaround to apply besides the workaround already specified.

Best Regards,
Jashanjit Badwal

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

TCSPB — Wed, 24 Jan 2018 22:03:19 GMT

Sourcefire_3D_Defense_Center_S3_Hotfix_H-6.2.2.2-1.sh.REL.tar was the file I was given.

Not sure why they wouldn't be able to give it to you too. I installed it into the FMC, redeployed policy, and all the memcap errors were fixed.

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

toddlammle — Wed, 24 Jan 2018 22:04:07 GMT

Can you send me that?

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

TCSPB — Wed, 24 Jan 2018 22:06:15 GMT

I put a copy of the file in my post. Feel free to use it!

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

toddlammle — Wed, 24 Jan 2018 22:12:41 GMT

GOT IT! Thank you so much!

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

TCSPB — Wed, 24 Jan 2018 22:15:07 GMT

No problem! Hopefully it fixes the issues for you like it did for me!

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

toddlammle — Wed, 24 Jan 2018 22:15:51 GMT

I'll let you know shortly!

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

toddlammle — Wed, 24 Jan 2018 22:45:06 GMT

dang, it didn't fix it...

shoot...that was time consuming too...

I'll keep watching it and check it in the am

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

toddlammle — Wed, 24 Jan 2018 22:45:43 GMT

no go 😞

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

TCSPB — Thu, 25 Jan 2018 14:22:24 GMT

That's strange it worked for us. Our FMC is running 6.2.2.1 (build 73) and all our 5506X's are running Version 6.2.2 (Build 81).

Not sure why it didn't work for you.

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

toddlammle — Thu, 25 Jan 2018 14:24:34 GMT

yes, same code. I am not sure why either, and I tried it on multiple customers...

Re: security intelligence URL: memcap exceeded Alert in FMC related to one firepower module

toddlammle — Fri, 26 Jan 2018 18:31:26 GMT

It took about 24 hours but it is working now!! LOL