We had the same problem - please check and update your firewall settings to the following information from Cisco:
Cisco is releasing new improvements to our Security Intelligence Operations infrastructure that will enable greater scalability and efficacy to all of your Cisco security products. As part of this effort, there is a scheduled change to the IPv4 addresses for two hosts used in retrieving reputation updates from Cisco.com for Cisco Web, Email, and IPS appliances, as well as for the CX and Botnet Traffic Filter capabilities of the ASA.
By default, Cisco security technologies use DNS to locate the appropriate update servers. However, some environments may have configured static IP addresses in their access control. If you have configured IP-based access control to permit outbound connections for updates from Cisco, you will need to modify your rules to support the new IP addresses.
Changes will be implemented between February 21, 2013 and March 30, 2013.
If the following IP addresses have been added to your access control policy:
update-manifests.ironport.com: 204.15.82.17 on port 443
updates-static.ironport.com: 204.15.82.16 on port 80
Please add the following IP addresses to your access control policy by February 21, 2013:
update-manifests.ironport.com 208.90.58.5 on port 443
updates-static.ironport.com 208.90.58.25 on port 80
Another note confirm this setting also:
downloads-statis.ironport.com: 204.15.82.8
The original IPs addresses will be deprecated by April 30, 2013. If you do not modify necessary access controls, your Cisco security technologies will not be able to receive reputation updates.
Should you have any questions, please contact your local Cisco Support Team.
