FMC tags valid URLs into Spam, Exploits or Malicious Sites

[kish02]

Hi,

Outbound traffic to the internet on our network are being blocked. FMC tags valid URLs into Spam or Malicious Sites or Exploits.

Im using FMC 7.0.1 (build 84) and FTD Version 7.0.1. Any idea? Thanks.

Sample logs

 

[marce1000]

 - Check the URL filtering  policies : https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/url_filtering.html

 M.

[brewnet84]

I am seeing the same thing running FTD 7.0.4 (build 55) and FMC of same version. I did a pending deployment and despite no changes actual deployed the categories flipped back and traffic started passing. I had been running these versions without issue for almost a week. The exact time I experienced this is 9/14 2pm - 7pm CST.

After

[Jose-Net · Accepted solution]

Seems a problem with Snortv3 as per bug https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa85492

Ive reverted to Snortv2 and seems to have fixed the problem.

[Herald Sison]

Hi Sir, In my situation i can revert to Snort 2 but i will also face the same problem with High Memory Utilization-Snort, that is the main reason why i upgraded to Snort 3. I have reached to TAC already and they suggested to upgrade to FMC and FTD 7.0.5. 

https://www.cisco.com/c/en/us/td/docs/security/firepower/70/relnotes/firepower-release-notes-700/bugs.html

Have you tried or experienced the 7.0.5? or anyone here experienced it? need some feedback on this version.

Thanks