Cisco ESA External Threat Feeds integration

[barbara.ilic]

Dear all,

I have configured External Threat Feeds on ESA appliances. I have integrated AilenVault open source TAXII server. However, I have two appliances which are connected to a cluster. On one appliance poll is successful every one hour. But on second appliance I got this error message:

"A failure was encountered for the source 'AlienVault'. Reason for failure Remote call to the External Threat Feed Engine failed."

Did anyone got same message and how to solve that? And how is it possible if my machines are in cluster, that on one polling is succesful, but on another isn't?

[barbara.ilic]

This is the message which I get:

• Machine: 'ciscoesa1.xxx. A failure was encountered for the source 'AlienVault'. Reason for failure Remote call to the External Threat Feed Engine failed.
• Machine: 'ciscoesa2.xxx. A poll was initiated for the source 'AlienVault' successfully.

I will repeat, machines are connected in a cluster.