Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Dv
01-23-2019
Dv
Cisco Employee
I Ping, Therefore I am!! For a living, I help packets moving in the network.
Only reason I'm here is to learn. I try to answer to questions on FirePOWER (NGIPS/NGFW), AMP & Firewall.
Recent Badges
Stats
Member since
08-20-2015
71
Posts
71
Helpful
12
Solutions
03-08-2018
08:41 AM
Hi, For the Firepower Threat Defense on the FXOS chassis, redundant interfaces are not supported. Same is mentioned in the user guide as well. Regards, Dv
... View more
02-20-2018
07:12 AM
I'm not sure if there would be AMP for iOS. Cisco Security Connector is the way forward for us on iOS here: https://blogs.cisco.com/security/cisco-security-connector-built-for-ios-11 I checked with PM as well if AMP for iOS is on roadmap and answer is no.
... View more
02-20-2018
02:05 AM
Hi,
Not 100% sure but we do have 1-2 cases where customer faces the same issue. Hard part is you wont be able to grab the logs since it makes the system totally unusable. Only way to get access to PC is just uninstall in safe mode.
I'd suggest you provide us the memory dump (through TAC case) following this article when system freezes: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard
I tried reproducing this issue in lab but no luck. There is indeed something we need to see and dump logs would be our way to get to the depth of this issue.
Regards, Dv
... View more
11-01-2017
06:10 PM
Hi Bob,
You can create an alert filter and subscribe to it. That way you would be notified to that specific filtered alerts. Go to Analysis->Event->Filter the event (Subscribe).Take a look to snapshot attached.
Regards,
Dv
... View more
08-17-2017
06:46 AM
Hi Ben,
As soon as you uninstall the connector, AMP cloud gets a query from endpoint and it removes it from the database. Automatically your license count gets synced as well.
If the entry stays on the console(somehow), better remove it manually as Jetsy said.
Regards,
Dv
... View more
08-14-2017
09:47 PM
Hi Eric,
Yes. Windows8 and higher if they have fast boot enabled then this issue is obvious to be seen. We've a doc info filed for it. https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvf55782/?reffering_site=dumpcr
So restarted from shutdown option doesnt actually reboot the PC. So try disabling the fastboot enable option or run this command on CMD: shutdown /r
Let me know if you've any query.
Regards,
Dv
... View more
07-11-2017
04:07 AM
No. It can not. You can block the files as per the type but not the size.
Regards,
Dv
... View more
07-05-2017
02:11 PM
What kind of scan it is? Automatic scan you've configured in policy? if yes, is it full or flash or custom scan? When you say it affects the performance, you mean CPU or Disk activity goes high? It crashes the system?
Verify the scheduled scan by editing the policy: File > Scheduled Scans
A Full scan will scan the processes running, the registry entries, and all the files on disk. This scan is very resource-intensive and should not be performed on a regular basis. So avoid full scan every time.
There is another scan by policy, verify if you've this configured:
https://console.amp.cisco.com/help/en/wwhelp/wwhimpl/js/html/wwhelp.htm
If you open up a TAC case with diagnostic file attached, that would be great.
... View more
06-28-2017
05:20 PM
Hi Sir,
Without firePOWER in picture, can you try sending an email with a file of size 20 MB and see if that's successful. (best way to quickly verify if it's firePOWER issue or some other device in the network).
If without firePOWER it is successful then please let us know a few details:
Do you have file policy inspection enabled? If yes then over which protocols? When you send file with 20MB file what file event you see?
Regards,
Dv
... View more
08-20-2015
10:00 PM
When we add static route from Sourcefire CLI, chances are they may disappear when we reboot the SFR module. There is another way, we can add static routes permanently. Steps to Add Static Routes: Step 1: Login to the Command Line Interface (CLI) of the appliance. Step 2: Access the network-device directory as root user. --> sudo su – (become root) --> cd /etc/sysconfig/network-devices Step 3: Execute the following command to create the necessary configuration file: touch ifcfg-static-routes ( in case ifcfg-static-routes is missing inside network-devices directory) Step 4: Execute the following command to add a static route: echo '<device> <type> <network> <subnet_prefix> <gateway>' >> /etc/sysconfig/network-devices/ifcfg-static-routes Step 5: Execute the following command to load the new static routes: /etc/rc.d/init.d/routes restart ------------------------------------------------------------------------------------------------------- Eg: echo 'eth0 ipv4 10.10.10.0 255.255.255.0 10.10.10.1’ >> /etc/sysconfig/network-devices/ifcfg-static-routes
... View more
- Tags:
- ASA-SFR
- Static-Routes
Labels:
03-08-2018
Hi,For the Firepower Threat Defense on the FXOS chassis, redundant
interfaces are not supported. Sam...
02-20-2018
A network analysis policy governs how traffic is decoded and
preprocessed so that it can be further ...
Created by
Dv
in Advanced Threats
02-20-2018
02-20-2018
I'm not sure if there would be AMP for iOS. Cisco Security Connector is
the way forward for us on iO...
02-20-2018
Hi, Not 100% sure but we do have 1-2 cases where customer faces the same
issue. Hard part is you won...
11-01-2017
Hi Bob, You can create an alert filter and subscribe to it. That way you
would be notified to that s...
08-17-2017
Firesight license is separate SKU and is not included with
ASA5515-FPWR-K9. Version 6.0 onwards, by ...
08-17-2017
No risk as long as you're deleting the entry which we don't need and
lying there for no good.
08-17-2017
Hi Anouar, Please go to the CLI of the device, become root and run this
command: Command: mysql -pad...
08-17-2017
Due to bug CSCze87645, portscan processor behavior will be unexpected.
It may trigger an intrusion e...
08-17-2017
Hi Ben, As soon as you uninstall the connector, AMP cloud gets a query
from endpoint and it removes ...
08-15-2017
Hi Anouar, Login to the CLI of both FTD and run the command show
managers. There shouldn't be any ma...
08-14-2017
Hi Eric, Yes. Windows8 and higher if they have fast boot enabled then
this issue is obvious to be se...
Public Statistics
| Date Registered | 08-20-2015 09:21 PM |
| Date Last Visited | 01-23-2019 12:40 PM |
| Total Messages Posted | 71 |
| Total Helpful Votes Received | 71 |
Helpful Votes From
