Firesight drops SQL well known traffic

[jfigueroa8]

Good day

I just implement the Firesight solution, and I'm having issues because the Firesight drops SQL traffic. This traffic is well known and it´s part of our day to day traffic.

I would like to know how can I classify these traffic as well know o something to make the Firsight stop blocking the SQL traffic between our servers.

Stay pending for an answer, thanks a lot.

[yogdhanu]

Hi

It might to due to any IPS rules. I would suggest enable logging on all the rules in access control policy where IPS policy is applied and in default rule as well.

Then check the IPS events in analysis>Intrusion>events to see if any signature related to SQL is getting fired up.

Based on which signature is causing it, further analysis can be done to see if its false positive or expected.

Rate if helps.

Yogesh

[Ed Padilla Jr]

Just "trust" this specific traffic from IP and Port with a Access Control Rule. Then do further investigation of why the details this is happening.

To be or Not to be