Release Notes

Version 5.3.0.6 Sourcefire 3D System Release Notes 35
Known Issues
• In some cases, if your Defense Center and managed devices experience
high volumes of traffic, the system generates incorrect CPU health alerts.
(143986/CSCze95067)
• In some cases, if you edit the security zone of an interface on the Objects
Management page (Objects > Object Management) of a stacked device, the
system doesn’t allow you to apply the device configuration changes to the
stack. As a workaround, modify the security zone from the Device
Management page (Devices > Device Management) and apply the device
configuration changes to the stack. (144626/CSCze94847)
• In some cases, if you enable remote storage and create a scheduled email
alert response on your Defense Center, the scheduled email alert may
disable remote storage and remote storage backups may fail. As a
workaround, create local backups and manually place the backups into
remote storage. (145288/CSCze95993)
• In some cases, if you create an intrusion rule set to block Multiprotocol
Label Switching (MPLS) traffic and specify either a source IP address or a
destination IP address, the system does not block matching traffic.
(CSCur46880)
• If you cluster Series 3 devices and configure the shared Sourcefire
Resolution Protocol (SFRP) configuration so the primary device is
configured as the backup SFRP with a non-SFRP IP address and the
secondary device is configured as the active SFRP with a SFRP IP address,
both devices attempt to respond to Address Resolution Protocol (ARP)
requests for incoming addresses that matches rules in the applied network
analysis policy and experience a disruption in traffic. As a workaround,
ensure the primary device of a cluster is configured as an active SFRP with
an SFRP IP address. (CSCur55568)
• In some cases, if your Defense Center has a file list with
SHA-256 file
entries and you add a Defense Center in high availability configuration, the
secondary Defense Center in the high availability configuration deletes the
existing file list data. (CSCur57708)
• In some cases, if you create correlation rule configured to trigger from the
type an intrusion event occurs or a connection event occurs and select ingress
security zone, egress security zone, ingress interface, or egress interface as the
condition, the system does recognize the rule and does not trigger traffic
matching the rule. (CSCur59840)
• In some cases, if you create a new report template with a static time
window, the system may not correctly save the time. (CSCur61984)
• In some cases, if your system loses connectivity between the Defense
Center and device during policy apply, the Network Discovery Policy page
(Policies > Network Discovery) continuously displays
Applying to devices.
As a workaround, edit the network discovery policy and reapply.
(CSCur81583)