Hi,
I have an ASA5516-X with FirePOWER module. The ASA is running version 9.6(1). The module is running 6.1.0-330.
There is only one ACP rule inspecting all traffic using an Intrusion Policy that was tuned by FireSight recommendations.
After experiencing Network Delay it was verified that SNORT was reaching 100% CPU utilization so the Policy-map was configured on the ASA to stop sending traffic to the FP module. After removing the traffic from FP the network went back to normal, but Snort is still spiking to 100% CPU.
This happened twice already. First with the 6.1.0 version, and now with 6.1.0-330.
The traffic is around 150Mb and Snort CPU is getting busy with no traffic. This tells me it's not just traffic overload that's causing it.
Any suggestions?
Thank you,
