I have a 4215, running 5.0.4-S149. In an attempt to update it to S191 (and then later S192) I noticed that packets start getting dropped, inbound and outbound, while running at that signature level. Connectionless protocols seem to work ok. However connection oriented protocols (ssh, smtp) see dropped connections after about 10 seconds or so.
The sensor sits inline between my Checkpoint firewall and 2611XM router. There is no assymetric routing going on. I don't see any new signatures getting fired off in the event viewer, however I do see an increase in 1300 and 3109.
After reading the false positive statement from cs-mars on sig 3109, it states:
"This signature may cause false positive alarms if the sensor misses certain packets in a SMTP session. This may be caused by the sensor dropping packets due to performance reasons or asymetric routing patterns in the network being monitored."
I think the sensor isn't able to keep up with the traffic when I update to that signature level. I did notice that the memory utilization went from the 48% it normally sits at to around 75-80% when at S192.
Any ideas? Does anyone know how to see if the IDS is dropping packets?
I recently ran into an issue on ISE 2.3 Patch 5 when trying to modify a Hotspot Guest Portal that had been created in the ISE Portal Builder.
The support people with the ISEPB team gave me the answer, so I thought I'd save someone a...
The Security team is pleased to announce the Cisco Firepower Threat Defense 6.2.3 Attack Lab v1.2, available in all datacenters.
The lab is aimed at technical decision makers, security engineers and CSOs with an interest in security technology. Th...
How to create a CSR using openssl
A CSR is a Certificate Signing Request and it is the first step of many steps in creating an X.509 certificate. When a CSR is created, the first thing that happens is that a private key is generated which is stored ...
Thanks to @Arne Bier for this document.
Setting up SMS notifications for Sponsored Guest access can be quite trivial. In the case of MessageMedia (an Australian SMS provider) it was one line of configuration in ISE. The...