Query regarding Snort rule/FMC upgrade against Log4j vulnerability

[atsukane]

Query regarding Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021

As per the above critical advisory, I was looking at new Intrusion rule in the older FMC  that we have (running version 6.1.0.5) and noticed that download of the new rules have been failing due to certificate issue. 

“Download updates failed: Peer certificate cannot be authenticated with known CA certificates”

Is it possible to download the specific new rules manually, if so how?

If this is not possible, I’ve found that upgrading the FMC to 6.2.0 fixes the certificate issue affecting download from FMC.

In order to upgrade from 6.1.0.5 to 6.2.0, can I double check that:

• Direct upgrade from 6.1.0.5 to 6.2.0 is supported?
• Managed ASA5555 FirePOWER module is ver 6.0.1.4 and this is compatible with FMC ver 6.2.0?

We are looking to replace this ASA to FPR2140 which is managed on the newer build FMC so want to spend as little time and effort as possible. 

Please advise.

Many thanks,

[atsukane]

Ah, I'm guessing 'Update Intrusion Rules' is the bit I need to understand

 Firepower Management Center Configuration Guide, Version 6.4 - System Updates [Cisco Firepower Management Center] - Cisco

[atsukane · Accepted solution]

So updating to the latest Intrusion rules has worked and I can see the Log4j drop rules are in the policy.

[Heino Human]

hey mate

How do you see the events for those "Log4j" logs? 

[atsukane]

hi @Heino Human 

This might be of your interest:

https://blogs.cisco.com/security/protecting-against-log4j-with-secure-firewall-secure-ips

[Marvin Rhoads]

6.1.0.5 to 6.2.0 is a direct upgrade that is supported:

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/relnotes/Firepower_System_Release_Notes_Version_620/important_update_notes.html#id_38002

FMC 6.2.0 cannot manage an ASA Firepower service module running 6.0.1.4.

https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html#reference_A0CAB7C28A2B440F8F901D316D6684F4

[atsukane]

Thank you @Marvin Rhoads Not sure how I missed that 6.2.0 is not compatible with 6.0.1.4!