Talos Connectivity Problem

[Ditter]

Hi to all ,

i am getting many messages as the following:

Severity: critical
Module: Talos Communication
Description: 3 modules failed:

• * URLDB- Failed to retrieve beaker inventory
• * LSP- Failed to retrieve beaker inventory

My subscription is active (it expires in 2026).  

Any ideas about why is this happening?   Is it a problem that has to do with Talos?

Please note that this is the first time i get this message. 

The only change i did some days ago was to change the "Cached URLs Expire" which was set to never and i changed it to "week" but i do not think that my issue has something to do with it.

Any ideas,

Thanks, 

Ditter.

[JF Anctil]

Hi Jon,

We had those errors here too, but dont seem related to talos connectivity problem. We've recently test log sending to SCC and we had some options checked on Integrations / Cisco security cloud to "send events to cloud" but the Cisco Security Cloud was disabled. We unchecked the options to send logs and errors disappeared. 

[Jon Are Endrerud]

Did a disconnect - reconnect to cloud and everything back to normal.

[HQuest]

So, is this related and/or limited to 7.7.0-91? I see there is now a disclaimer "If you are already running 7.7.0-89. Do not upgrade/install the newly posted image (7.7.0-91). Reach out to Cisco TAC for a workaround." at the software download section.

[Marvin Rhoads]

@HQuest that is unrelated and due to a separate issue related to NAT in site-site VPNs.

[Ditter]

@BACANEL @Marvin Rhoads Thanks both,  i restarted only the two processes mentioned by Bacanel.  I did not restart (fireamp & CloudAgent but the warnings messages stopped by restarting the first two processes (talosagent and beaker3):

Thanks,

Ditter

[JF Anctil]

FYI : 

VDB 406 is not released yet but it worked with this GeoDB database update.

Update : The script is running only on the active FMC. My secondary FMC has the new GeoDB update but has not run the script to renew the certificate.

Update2 : Same for VDB Update. The script is not running on secondary FMC so the certificate is still not renewed.

[Loebmann]

Hello everyone,

 I have installed the GeoDB and VDB 406 and restarted the vFMC, but the error message remains the same. Does anyone else have this?

 Thanks

[Ditter]

Still the same error with me although it seemed to have stopped. I have already upgraded to VDB 406 but i still get :

Health Monitor Alert from fmc
Time: Sat Apr 12 11:05:31 UTC 2025 UTC
Severity: critical
Module: Talos Communication
Description: 1 modules failed:

• * LSP- Failed to retrieve beaker inventory

I haven't rebooted the FMC. Doo in need to reboot it ?

Thanks,

Ditter

[marce1000]

 - @Ditter             FYI : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwo63951

    M.

[Ditter]

@marce1000 Thanks , had already followed this bug instruction both the temp step as well as the more persistent one.

But the messages about talos communication were still coming, magically they stopped today at 4:22 am (CET) 

To be frank i do not know if they will start again.

Thanks,

Ditter

[andrew.butterworth]

I'm not sure if this is related, but I suspect it is.

I've got a HA pair of on-box managed vFTD's running 7.7.0 and they cannot update the SRU.  Clicking the Updates, Intrusion Rule, Update From Cloud button initiates the download, but it almost immediately fails with the error "Snort 3 cloud update failed: No response from the update server or connection timeout. Please try again."

The /ngfs/var/log/sf/talos_agen.log file has lots of these 

TalosAgent:WARN: main.go:main.main.func4:237 2025/04/24 17:19:04 periodic catalog download failed: <nil>. attempt: 5
TalosAgent:INFO: enrich.go:talosagent.cisco.com/pkg/enrich.QueryTaxonomyCatalogsMetadata:250 2025/04/24 17:19:09 QueryTaxonomyCatalogsMetadata() started.
TalosAgent:INFO: enrich.go:talosagent.cisco.com/pkg/enrich.QueryTaxonomyCatalogsMetadata:265 2025/04/24 17:19:09 QueryTaxonomyCatalogsMetadata request:
{
  "app_info": {
    "device_id": "0050569F0B17",
    "product_family": "secure_firewall",
    "product_id": "75A",
    "product_version": "7.7.0"
  }
}
TalosAgent:INFO: enrich.go:talosagent.cisco.com/pkg/enrich.QueryTaxonomyCatalogsMetadata:273 2025/04/24 17:19:09 QueryTaxonomyCatalogsMetadata() failed.
TalosAgent:ERROR: main.go:main.main.func4:252 2025/04/24 17:19:09 periodic catalog download: failed to query taxonomy catalog metadata: rpc error: code = Internal desc = Internal error occurred: Request failure: connection error: received fatal alert: CertificateExpired

Manually uploading the latest SRU .tar file doesn't initiate the install.

I'm not sure how to resolve.

[erdyer]

7.7 deprecates Snort2 which is what the SRUs are for so it's likely related to that.  Snort3 uses the LSPs and those should still be working fine on 7.7.

[andrew.butterworth]

Thank you erdyer.  Manually uploading the latest LSP package seems to have solved it.  It looks like clicking the 'Intrusion Rule, Update From Cloud' button attempts to download the SRU package even though Snort 3 is enabled.

[erdyer]

You're welcome.  I think this is something that they'll need to work on for the first update in the 7.7 line.  I just happened to notice the behavior in my lab setup but we'll be seeing more tickets opened for this once the adoption rate of 7.7 picks up.

[dyakovsky]

I tried this workaround. I also installed VDB 406 and GeoDB 2025-04-03-094. But the certificate still did not update. Customer Success Network is enabled. Any ideas?
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 46240369 (0x2c19271)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, ST = California, L = San Jose, O = Cisco Systems Inc., OU = Security, CN = Keymaster CA 2
Validity
Not Before: Jan 30 22:32:39 2024 GMT
Not After : Mar 30 22:32:39 2025 GMT
Subject: CN = SFW76EVAL-prod-01, C = US, ST = California, L = San Jose, O = Cisco, OU = Security
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)