FMC Security Intelligence Sources

[mufasa099]

I've been experiencing a consistent issue with Cisco FMC Security Intelligence and I'm reaching out in hopes that someone might have encountered a similar problem and could provide some insights or potential solutions.

Background:
I have several sources set up that are based on URL imports for IPv4 addresses. Everything seems to function as expected initially, with the feeds downloading without any issues.

Problem:
After approximately 4-5 days, these feeds stop downloading new updates. The only way I've found to resolve this, albeit temporarily, is to pause and then resume them. This makes them start downloading again, but it's not a sustainable solution as I have to constantly monitor and manually intervene.

Troubleshooting Steps Taken:

1. Checked the URLs to ensure they are active and accessible.
2. Verified network connectivity and confirmed that there are no external factors preventing the feed download.

Questions:

1. Has anyone else experienced this specific problem with the Security Intelligence feeds?
2. Are there any known bugs or patches related to this issue?
3. Can anyone suggest any diagnostic steps or potential solutions to troubleshoot and resolve this issue?

Thank you in advance.

[Marius Gunnerud]

Please provide the FMC model and which version it is running.  And, how are you importing the URL list? is it through a custom Security Intelligence feed? if not, please provide in detail how this is being imported to the FMC.

[mufasa099]

Here are the FMC details:

Model Cisco Firepower Management Center for VMWare 300
Software Version 7.0.2 (build 88)
OS Cisco Firepower Extensible Operating System (FX-OS) 2.10.1 (build192)

Yes, I am importing using a custom URL list, as shown here:

As you can see it should update every 6 hours, the last update was done 18 hours ago.

Let me know if you need more information.

@MHM Cisco World 

[Marius Gunnerud]

How large are the files you are importing and how many entries are in the files?

[MHM Cisco World]

Exact what in my mind' 

Are file more than 150 mb?

[mufasa099]

The files are not that big, they have few hundred IPs only. It also stops importing STIX from Alienvault.

[MHM Cisco World]

Share more detail if you can 

Thanks 

MHM