HTTP traffic stops passing through IPS

[phamthecong]

Hi All,

We have an inline IPS 4260 (version 7.1(7), sig ver 719) that works for a while and suddenly stops passing http traffic through. All other kinds of traffic inlucing https are still passing through as normal. Stop sending traffic to it for awhile then everything works fine. Does anyone have the same problem?

contacted TAC and been advised that sig1300.0 was disabled but the system was not reset that might cause prob.  is that true that once we modified Normalizer sigs, we have to reset the appliance?

any help would be appreciated.

Regards,

Tao Lao

[Julio Carvajal]

Hello Tao,

We certainly do not recommend to modify the normalizer signatures as that could lead to issues as the one you are mentioning,

so are you saying that you reset the box and it worked? and you want to know why?

Or you have not done it and want to know if it could work for u?

Regards

[phamthecong]

thanks jcarvaja for the reply,

I have not reset it yet as it might cause a downtime. I want to know if reset could fix the prob.

i understand the implication of modifying the normalizer sigs but the sig1300.0 generates so many alerts that we could not handle it. so we have disabled the alert action of sig1300.0.

Regards,

tao lao

[Julio Carvajal]

Hello,

Interesting enough.

Is http traffic flowing across your network normally right now?


Maybe you could send me the case number on a private message so I can take a look at it.

Sent from Cisco Technical Support Android App

[ROBERT MOON]

I have the same issue with Cisco IPS 4260.  Since I upgraded to the latest software, I'm running into issues with http traffic.

Http traffic will pass through the IPS unit and suddenly it will block all http traffic for about 10 - 15 minutes.

This happens so mutltiple times throught out the day that I currently bypassing the entire unit.

My case, this started after I upgraded the software and I didn't disable any sigs.

I would love to hear a solution for this issue.

Thanks,

Rob

[phamthecong]

Hi Robert,

I dont have a solution yet but when turned the unit to run in asymmetry mode, the unit seems to be stable.

I initially ran into 100% inspection load issue then new firmware came out, upgraded it, ran into 99% missed packets issue. upgraded again, ran into this issue. heachache!!!

Tao Lao

[Julio Carvajal]

Hello,

Yeah, I mean based on your network you will need to run on asymetric mode as the normalizer engine working in strict mode will cause a lot of issues due to the network design issues,

Regards

Note: I have answered your email