FPR 4100 Snort Memory high Utilization

[behrouz6408021]

Hello

I have two Cisco FPR 4110 with FTD version 6.7

My problem is Memory used by snort even when there is no many traffic on firepower .

my configuration in the firepower are IPS with recommendation enabled  and SSL Policy for traffic incoming from outside to my Server Zone and ACL Policy about 200

thank you for help me

[info@songohan.ch]

Is there a Solution, i also have the same Hardware with the same  Release 6.7.

It startet after a Reboot from FTD and FMC.

[Milos_Jovanovic · Accepted solution]

HI @behrouz6408021,

I would start with upgrading all of the components to more recent versions (patching to 6.7.0.2, VDB and SRU, and don't forget to check FXOS and Firmware).

If that doesn't help, I wold proceed with TAC case. There is an info in the release notes that bug CSCvt34894 is fixed in 6.7.0 (which looks like behvior you are facing), but we already saw that certain bugs are getting back with newer releases.

BR,

Milos

[Herald Sison]

hi Sir, i have this bug even i am using 7.0.4-55 version of my FTD via FMC

[ConSupport]

Did you got the solution?

[Herald Sison]

Hi Sir, i just upgraded my snort version 2 to version 3 and the high memory utilization is now normalize but other bugs came out particularly the Access Control Policy in URL blocking categories (phishing, malicious sites and malwares) once i enabled these categoriea all sites will be blocked. So far right now i have upgraded my FTD version to 7.0.5 and almost 5 days now i have not yet experienced any problem in terms of url blocking. Fingers crossed!