Firepower rulee update

[sahrizal123]

Hi,

I have cisco 5516x with firepower.

My firepower install at FMC version 5.4.1.

Below my question.

1. what is the best practice to update the rule ( System > Update > Rule Updates  ) by weekly basis or monthly ?

2. Any impact during the rule update?

3. how rollback in case any issue.

[yogdhanu]

Hello,

Its recommended to update the rules weekly basis as they are released to make sure you are covered by latest security update.

There is no direct impact during the update. Once the update is downloaded, its stored in FMC but not yet applied on sensor/FTD unless you have selected to deploy policy also with auto update.

Once you deploy the policy again, new updates are installed along with the deployment.

You can track the changes as well. Check an old forum update (related)

https://supportforums.cisco.com/t5/firesight-system-3d-system/firesight-rule-update/td-p/2777508

But there is not official/easy way of rollback. But in case its absolutely required, you can reach out to TAC and it can be done although not recommended.

Hope it helps,

Yogesh

[sahrizal123]

Thank you Yogesh, noted will update weekly basis.

[sahrizal123]

Hi Yogesh,
Should we upgrade VDB version on weekly basis too ?
Any impact after upgrade VDB version ?


Below is current software :

Model Virtual Defense Center 64bit
Serial Number None
Software Version 5.4.1 (build 59)
OS Sourcefire Linux OS 5.4.0 (build126)
Snort Version 2.9.7 GRE (Build 178)
Rule Update Version 2016-12-01-001-vrt
Rulepack Version 1812
Module Pack Version 2083
Geolocation Update Version None
VDB Version build 211 ( 2014-07-18 02:21:53 )

[Marvin Rhoads]

@sahrizal123,

---

My firepower install at FMC version 5.4.1.

You should really upgrade your Firepower software. Your version is quite old and there are many bug fixes and new features in the 3 major and many minor releases since 5.4.x.

[sahrizal123]

Thank you Marvin, we will upgrade after updated the Rule.
Now pending maintenance window.

[sahrizal123]

Hi Marvin,
What is the different between manage device and defence centre.
As my understanding defence centre is FMC.
I have read somewhere that FMC and manage device only need one version older.

[yogdhanu]

Hi

You are correct about the naming convention.

FMC is defence center and managed device could be your SFR module or hardware SFR box also called sensor.

I would really suggest to update the VDB as well as current VDB is 294.

VDB is for application awareness and yes as SRU (snort rules) update, you should update the VDB as well.

Everything else remains same for VDB as well where you need to apply the access control policy first to push the new VDB changes to managed device

Hope it helps,

Yogesh

[sahrizal123]

Hi Yogesh,

Thank you.
Is this correct ?
Software Version 5.4.1 (build 59) <--- FMC
OS Sourcefire Linux OS 5.4.0 (build126) <--- Manage device

[yogdhanu]

Hi Sahrizal,

Yes, that would be correct.

[D@1984]

I have few questions regarding the SRU & VDB upgrade that would be grateful if someone could help me with:

1- for both SRU& VDB upgrade, doesn't matter what version of FMC/ FIREPOWER  we are in: 

FMC:

SOFTWARE VERSION: 6.2.3

SNORT VERSION: 2.9.12

VDB VERSION: BUILD 291

FirePOWER module: 6.2.3

2-Do I need malware license to get the weekly basis updates? 

3-

Thanks

Thanks

[Marvin Rhoads]

1. SRU and VDB updates are generally independent of your FMC and Firepower versions.

2. Malware (AMP) license is required only for File policies. They inspect files using cloud-based analysis of a SHA-256 hash of the file. (or AMP private cloud for some customers with that product). It does not affect or interact with the SRU or VDB or entitlement to those.

SRU and VDB updates do require a current IPS subscription (known as "Threat" for FTD devices) to be entitled to download them (although there's not any technical enforcement of that requirement).

[D@1984]

many thanks. How/where FMC get the updates from if I set to have weekly updates automatically?

Just want to make sure there is no firewall, etc in between to block the updates. 

[Marvin Rhoads]

The SRU and VDB updates should be coming from support.sourcefire.com.

Details and troubleshooting instructions can be found here:

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118791-technote-firesight-00.html

[Marvin Rhoads]

Cisco has a good explanation of the naming as it has changed across the releases since they acquired Sourcefire back in 2013. You can find it here:

https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html#reference_9C7ED89DF14645BDA166E80F7BDA5FB7

As of release 6.2, Firepower Management Center cannot manage devices running anything prior to 6.1.

FMC 6.1 could manage both 5.x and 6.x devices.