Thank you Michael and Donny, It appears that we will need to go for a version upgrade. While I go through the 7.5.X releast notes, could you please let me know if there is any significant change in the latest version. Any known issues or changes in the configurations? Please let me know. Regards, Faiz ... View more

Hi All, Thank you for the response. Rick, I would go with your suggestion for now. Even I suspect something similar. Stephen, I see from the provided document that it applies to C160, but we are using C170 appliance. Moreover, we have already upgraded one appliance to this version. The problem is only with the second appliance. Valter, we are currently setting up the device in a DR location and we do not have the provision to set up a webserver and such as you suggested, at least at the moment. We are currently using a 4G router to do the upgrade. It could be related to the bandwidth. Let me try and do that from the CLI and see. I would post the result in here. Regards, Faiz ... View more

HI Jake, Thank you for the reply. Well, I do not have much expertise on switches. So, i did not completely understand the explanation in the provided link. From the explanation I understand that the configuration is for felxible NetFlow. We have currently enabled flow export on the interfaces that we are interested on. Do we need to change that and enable NBAR..? Regards, Faiz ... View more

Hi All, We still have this issue in our network. I see the following errors in IPS this time: evError: eventId=6822257491706  vendor=Cisco  severity=error    originator:       hostId:       appName: cidwebserver      appInstanceId: 1458    time: Aug 31, 2013 09:08:36 UTC  offset=180  timeZone=GMT+03:00    errorMessage: Throttled connect timed out [ClientPipe::connect] Messages, like this one, in the category - Connect timeout - were logged 12 times in the last 72492 seconds.  name=errSystemError  evError: eventId=6822257491707  vendor=Cisco  severity=error    originator:       hostId:     appName: cidwebserver      appInstanceId: 1458    time: Aug 31, 2013 09:08:36 UTC  offset=180  timeZone=GMT+03:00    errorMessage: - ct-sensorApp.1475 not responding, please check system processes - The connect to the specified Io::ClientPipe failed. Messages, like this one, in the category - ctlTrans Timeout - were logged 12 times in the last 72492 seconds.  name=errSystemError  It appears that the sensorApp is not responding. Can anyone assist. Regards, Faiz ... View more

Hi William, Thank you. I am aware of event action filters and have a few created already. However, I wanted to know why this signature is getting triggered in the first place. Moreover, it does not process the traffic if the signature triggers for a stream. I am trying to undestand what causes this. Especially for streaming traffic. Please assist. Regards, Faiz ... View more

Hi Tulgabat, Thank you for the reply. I am yet to dig deep in to the event and signature. I hope I can get more info then. However, we have identifed a common user ID that has been misused. This user was accesging youtube and such streaming sites extensively. We have now disabled this user and we have not faced this issue after that. However, we cannot conclude anything yet because this issue is intermittend and we need wait for a few days to see if that has helped. Regards, Faiz ... View more

Hi, Additional investigation shows that the signature TCP Drop - RST or SYN in Window is getting triggered in huge numbers. The traffic is from external IP addresses to Proxy IP, which is obviously for return traffic from internet. The signature description says that " If a packet in a stream causes this signature to produce an alert, processing will cease for that stream ". I suspect that is causing this issue. Please let me know. Regards, Faiz ... View more

Hi Erik, Thank you for the detailed response. I will try and carryout a packet captureas u sugested next time we face this issue. However, since we are operating the Proxy in one-armed design, will that be an issue? Since the traffic has to enter and exit a single interface will it cause any delay? What is the best practice considering that we have more than 30K users...? Please suggest. Regards, Faiz ... View more

Hi Erik, Are there any known issues with this version. I am searching but I cant find any issues associated with this particular version. I need to provide a supporting case to management with proper details in order to justify the upgrade. Please assist. Regards, Faiz ... View more

Hi Erik, Thank you for the reply. In the logs we see that the proxy is allowing the access. There are no blocks or such in the logs. Moreover, the problem is only with some sites. When we try to resolve these URLs from the proxy the do as well. There is no error message, but the page just loads and loads for ever. We have still not got a hold on this. I agree that we are running an older version of the code. I will plan for an upgrade soon. Regards, Faiz ... View more

Hi Trik, The details are as follows: Model: S670 Version: 7.1.4-053 Regards, Faiz ... View more