Cisco Cisco FirePOWER Appliance 8270

Version 5.3.0.4

Sourcefire 3D System Release Notes

28

Known Issues

In some cases, if your system includes an SSL Visibility Appliance (SSLVA) 

device and you create a file policy containing a Web Application category 

and a Block Malware rule, your first attempt to download a file identified as 

malware over HTTPS may fail. As a workaround, disable the file policy. 

(CSCus72505)

If you edit and reapply an access control policy, the system incorrectly 

marks the policy as out-of-date even if it is not. (CSCut08225)

If you create an intrusion policy containing more than one shared layer, the 

system automatically creates an Event View Override Layer for each shared 

layer, names the Event View Override Layers with duplicate names, and 

may experience system issues. As a workaround, edit the intrusion policies 

with multiple shared layers and manually change the name of the 

automatically generated override layers. (CSCut16772)

In some cases, if you update your device with Sourcefire Software for 

X-Series to Version 5.3.X, your previously configured security zones are not 

saved. As a workaround, recreate your security zone with an assigned 

interface and save the policy, then reassign the security zone within the 

applied policy and reapply to your device. (CSCut40810)

In some cases, if you apply an access control rule referencing a network 

object or group that has been previously deleted to a Defense Center in a 

high availability configuration, the system does not recognize the network 

object or group is deleted and experiences issues. As a workaround, delete 

the rule containing the deleted object or group and recreate, then apply 

policy. (CSCut54187)

In some cases, your 3D8xx device may experience an error and lose control 

and info channels. (CSCut98395)

Known Issues Reported in Previous Releases

The following is a list of known issues that were reported in previous releases of 

the Sourcefire 3D System:

In some cases, applying changes to your access control policy, intrusion 

policy, network discovery policy, or device configuration, or installing an 

intrusion rule update or update of the vulnerability database (VDB), causes 

the system to experience a disruption in traffic that uses Link Aggregation 

Control Protocol (LACP) in fast mode. As a workaround, configure LACP 

links in slow mode. (112070/CSCze87966)

In some cases, the system includes extraneous data about dropped packets 

in intrusion event performance graphs. (124934/CSCze87728)

If the system generates intrusion events with a Destination Port/ICMP Code 

of 

0

, the Top 10 Destination Ports section of the Intrusion Event Statistics 

page (Overview > Summary > Intrusion Event Statistics) omits port numbers 

from the display. (125581/CSCze88014)