SR520 IOS Content Filter with Trend Micro

[markher182]

I have gone through a lot of stuff with an SR520 and content filtering.  It seems to be very problematic. Originally Cisco stated they would not support Content Filtering on the SR520 then they decided to support it.  I currently have one SR520 that seems to have stopped filtering anything, including the blacklists.  Everything looks right to me but I am no expert with ZBFs.  If anyone has any insight as to what might be the problem.  I have included a Show Tech to this discussion

[mirober2 · Accepted solution]

Hello,

The device is configured with the following incorrect line:

ip host trps.trendmicro.com 216.99.133.100

This will force the router to resolve trps.trendmicro.com to 216.99.133.100, which is incorrect. This was an older server that was decommissioned by Trend Micro. The trps.trendmicro.com host should resolve to either 216.104.8.100 or 150.70.74.51.

I would recommend removing that line with a 'no ip host trps.trendmicro.com 216.99.133.100' and adding 'ip domain-lookup'. This will allow the router to dynamically resolve trps.trendmicro.com in case the IP addresses change again in the future. To test, you can do 'ping trps.trendmicro.com' from the device to make sure it resolves correctly.

Once you remove the offending line, check the output of 'show ip trm subscription status'. If your subscription status does not show as "active", you'll need to run 'trm register' to activate the license and get things working again.

Hope that helps.

-Mike

[markher182]

Mike, that was exactly the problem!  Thank you!