FMC 6.6.1 Reputation issues

[kostasthedelegate]

Hello, 

I have upgraded to 6.6.1. 

I see an issue with URL Reputation. 

Apart the fact that FMC is using now Talos and the reputation of many sites (mostly Hellenic) have changed, i have another issue. 

When I look the URL in Analysis->Advanced-> Lookup URL, the reputation is Neutral. 

But the URL is blocked and in the events I see that the reputation is Unknown. 

What is the cause of this issue?

Has anyone seen it?

Regards, 

Konstantinos

[Casey Roettger]

Here it is months later and we just upgraded FMC and some SFR and FTD to 6.6.1 and are seeing the same issue for a handful of sites currently.  cn.ca is an example.   Did you open a tac and get this resolved?  I have TAC opened but not much action so far.  

[kostasthedelegate]

Hello, 

I actually opened a ticket and the summary is as follows

The thing with 6.5 and on is that they use Talos for URL matters. Talos has different markings. 

So what cisco suggested was to invert the URL categories. Before we allowed certain categories, so they told us to make rules with block instead. 

This change worked.

Hope this help a little. 

Regards, 

Konstantinos

[Chakshu Piplani]

This might be related to a defect, please check if the symptoms/conditions match

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx41440

Please subscribe to the defect for updates.

If you do have a TAC SR opened and the symptoms/conditions match, get your SR attached to the case.

Regards,

Chakshu

Do rate helpful posts!