Cisco Cisco Firepower Management Center 4000 Release Notes

Version 5.2.0.2

Sourcefire 3D System Release Notes

23

Issues Resolved in Version 5.2.0.2

When navigating from a Custom Analysis dashboard widget to an event 

viewer page, a message now appears to clarify any potential event count 

differences between the two pages. (106867)

Resolved an issue where, in some cases, the system generated errors on 

packets when an interface returned to a routed configuration after being 

temporarily configured as a switched interface. (106986)

Improved the system’s ability to identify intrusion policy validation errors. 

(107105)

Resolved an issue where, in some cases, intrusion policies did not save 

when inline normalization allowed TCP options that contained both commas 

and blank spaces. (108289)

Status icons on the Device Management page (Devices > Device 

Management) now indicate whether a device in a clustered configuration is in 

a degraded state. (108908)

Improved the performance of the 

content

 keyword in intrusion rules. 

(109059, 118112)

Resolved an issue where custom HTTP response pages for Interactive 

Block access control rules did not appear consistently or allow users to 

bypass successfully. (109186, 110109, 110110, 111661)

Resolved an issue where threshold values of 86400 seconds (24 hours) for 

the packet view in the event viewer could not be saved successfully. 

(109187)

Resolved an issue where, in some cases, the system incorrectly identified a 

correlation policy as active. (110111)

Added a new troubleshooting option to the Performance Statistics 

configuration. (110470)

Resolved an issue where intrusion rules did not generate events if they 

defined SIP methods in the 

sip_method

 keyword that were not already 

defined in the SIP preprocessor. (110532)

Resolved an issue where two passive interfaces on appliances with 

identical access control policy and rule settings, but in different security 

zones, could produce different connection events from the same traffic. 

(110575)

Resolved an issue where, after completing an access control or intrusion 

policy apply, the system generated extraneous process status health alerts. 

(110578, 120317)

Resolved an issue where, in some cases, the primary device in a stack 

appeared perpetually active in the device management portion of the user 

interface. (110702)

Resolved an issue where, in some cases, the system experienced issues 

with task status reporting during access control policy apply on a Defense 

Center managing clustered devices. (110704)