Hello Alejandro,
Based on the logs shared your CASE engine on the ESA seems to be failing to update and download. You can check on the same with "asstatus" command. I suspect that your firewall (or another security device, proxy, IPS..) is causing this network issue. Could you please check with your firewall team if ports 80 and 443 are completely open (both directions) and the traffic is not modified/filtered.
Common causes for the update failure, but are not limited to:
General lack of network connectivity
Firewall blocking access to update server
Failure to look up the IP for the update server
We need to insure that you have connectivity to our servers on the following ports in the firewall :
downloads.ironport.com 80
updates.ironport.com 80
update-manifests.ironport.com 443
Cisco offers static servers for the sites that have strict firewall requirements. It is important to note that if you configure the update and upgrade settings on your appliance with the use of this static method, all the information is needed in the firewalls as well.
Here are the hostnames, IP addresses, and ports that are involved in the upgrade and update process:
downloads-static.ironport.com: 208.90.58.105 on port 80
update-manifests.ironport.com: 208.90.58.5 on port 443
updates-static.ironport.com: 208.90.58.25 on port 80
Complete these steps in order to change the upgrade and update settings on the AsyncOS:
1. Navigate to the Service Updates tab of the Security Services page.
2. Click Edit Update Settings....
3. Select Local Update Servers from the Update Servers (images) field.
4. Enter
http://downloads-static.ironport.com in the Base URL (all services except McAfee Anti-Virus definitions and IronPort AsyncOS upgrades) field and set the Port to 80. Leave the Authentication Settings field blank.
5. Enter updates-static.ironport.com in the Host (McAfee Anti-Virus definitions, PXE Engine updates, IronPort AsyncOS upgrades) field.
6. Ensure that the Update Servers (list) field is set to IronPort Update Servers.
7. Update the Proxy Servers settings if required.
8. Click Submit.
9. Click Commit Changes.
10. Click Commit Changes again in order to confirm.
Also, please find below the link which provided you with the information on the ports that need to be opened on your firewall for ESA to communicate without any issues:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_11_1_appendix_0101111.pdfI hope the above will be able to resolve the issue at your end.
Cheers,
Pratham
