ASA Sourcefire Module Bandwidth degradation

[milin160791]

Dear Team,

I have just implemented ASA 5516-x with Firepower services with 9.5.2(5) IOS and Sourcefire module with 6.0 release.

Within taken downtime everything was working fine but when the users came on production time, we are facing high bandwidth degradation issue, internet stops working suddenly. Then, I rebooted firewall again and bypassed traffic from sourcefire module and now it is working fine.

Also when enabling sourcefire module, many https sites are loading very slow (Slowness of internet access, evenif SSL policies are not applied)

So, I would like know is there any specific bug with in 9.5.2(5) IOS or anything else ?

Regards,

Milin M. Mistry

[thilton68]

Hi Milin

I am experiencing the same issue with some SSL content.  Specifically one I have identified is https://tfl.gov.uk . ; We have found that does actually load but very very slowly using chrome but the page stays blank using IE.

The connection events indicate correctly with allow.

regards

TH

[milin160791]

Dear Team,

Anyone has successfully implemented ASA-Next-Gen-FW with Firepower module without any issues..??

If yes, please give your inputs like for which Firewall IOS and with Which Sourcefire module version it is stable and how to overcome known issues and put our firewall in stable state.

Your help will be highly appreciated.

Regards,

Milin.

[ciscosupporttek]

Hello,

I had a similar problem. After some time, begin to open the page very slowly.

The cause found on the border router, which is set after the ASA, it overflowed NAT translation. It creates a lot of compounds that Firesight shows how the Block, but they still are. The problem is decided limitation nat translation tcp-timeout to 2 hours.

But the Firepower module must not miss the connections that it blocks.

Regards,

Denis.

[hoffa2000]

Hi

I've been running the ASA9.4, Firepower 5.4.x track for half a year now and I've been very happy. I've had some stability issues but those were related to a well defined bug CSCut39253 and easily mitigated. So far I'd say the Firepower platform is some of the best security "services" I've seen so far.

Now the Firepower 6.x track is another matter, for me my upgrade attempt was a complete failure with a few white web pages and sometimes web code as result for my users. Not to mention the CSCuz04979, broken Context Explorer, bug which became a deal breaker for me. The erratic web results my users were getting could have been solved by tweaking the rule set but the Context Explorer could not wait for a patch.

I had to revert back to 5.4 on both FMC and modules. Too bad since the 6.x GUI felt more refined and the option to nest access control rules was really useful for me.

/Fredrik