i have observer every 30mints time frame FMC is connecting to "intelligence.sourcefire.com" web site its showing as outbound connection and uploading the data. how do we stop or disable this activity in FMC.
FMC Need Internet Server access to update service database find below URL for reference .
you will get info that which URL need for which reason.
If you want to disable the periodic Security Intelligence feed (which greatly reduces the effectiveness of your Firepower security appliances) you do it under Objects > Object Management > Security Intelligence (as shown below).
Thank you Marvin Rhoads.
sorry to bothering on this I have few more doubts.
1.when the selected feed is updating every 30 mints, the feeds are downloading from the website(Security Intelligence) its inbound connection right ? or it push the old feeds to website(Security Intelligence) and then update the feeds?
2. in my case it is showing the out bound connection like from FMC to website(Security Intelligence).
3. where can we see the what data it is uploading to website(Security Intelligence)?
FMC initiates the communications and the new feeds are downloaded from Cisco at the site name you mentioned earlier. It is not uploading your data. You can see the downloaded feeds in the FMC server under /var/sf/iprep_download
Reference this thread: