CVE-2021-1224

mediumpriority · track · 22EPSS 0.020 · 81 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

2.05% (81st) EPSS

CVSS 5 · medium

Is it mine?

202 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.11 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.11 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.11 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.11 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.11 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.12 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.12 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.12 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.12 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.12 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.13 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.13 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.13 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.13 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.13 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.14 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.14 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.14 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.14 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.14 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.15 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.15 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.15 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.15 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.15 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.16 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.16 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.16 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.16 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.16 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.2 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.2 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.2 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.2 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.2 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.3 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.3 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.3 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.3 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.4 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.4 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.4 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.4 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.4 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.5 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.5 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.5 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.5 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.5 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.6 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.6 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.6 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.6 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.6 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.7 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.7 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.7 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.8 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.8 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.8 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.8 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.9 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.9 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.9 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.9 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.9 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.10 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.10 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.10 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.10 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.10 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.10 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.11 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.2 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.2 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.2 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.2 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.2 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.2 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.3 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.3 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.3 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.3 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.3 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.4 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.4 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.4 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.4 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.4 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.4 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.5 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.5 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.5 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.5 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.5 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.5 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.6 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.6 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.6 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.6 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.6 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.6 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.7 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.7 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.7 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.7 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.7 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.7 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.8 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.8 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.8 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.8 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.8 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.8 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.9 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.9 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.9 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.9 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.9 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.9 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.0 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.0 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.0 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.0 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.0 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.0 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.0.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.0.1 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.0.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.0.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.0.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.0.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.1 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.6.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco UTD SNORT IPS Engine Softwarecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.11 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.11 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.11 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.11 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.11 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.12 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.12 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.12 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.12 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.12 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.13 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.13 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.13 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.13 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.13 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.14 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.14 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.14 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.14 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.14 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.15 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.15 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.15 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.15 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.15 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.16 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.16 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.16 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.16 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.16 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.2 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.2 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.2 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.2 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.2 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.3 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.3 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.3 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.3 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.4 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.4 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.4 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.4 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.4 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.5 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.5 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.5 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.5 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.5 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.6 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.6 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.6 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.6 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.6 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.7 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.7 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.7 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.8 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.8 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.8 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.8 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.9 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.9 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.9 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.9 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.9 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0 when installed on Cisco Firepower 1000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.10 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.10 when installed on Cisco Firepower 1000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.10 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.10 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.10 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.10 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.11 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.2 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.2 when installed on Cisco Firepower 1000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.2 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.2 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.2 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.2 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.3 when installed on Cisco Firepower 1000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.3 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.3 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.3 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.3 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.4 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.4 when installed on Cisco Firepower 1000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.4 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.4 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.4 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.4 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.5 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.5 when installed on Cisco Firepower 1000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.5 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.5 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.5 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.5 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.6 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.6 when installed on Cisco Firepower 1000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.6 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.6 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.6 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.6 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.7 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.7 when installed on Cisco Firepower 1000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.7 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.7 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.7 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.7 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.8 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.8 when installed on Cisco Firepower 1000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.8 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.8 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.8 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.8 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.9 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.9 when installed on Cisco Firepower 1000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.9 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.9 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.9 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.4.0.9 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.0 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.0 when installed on Cisco Firepower 1000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.0 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.0 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.0 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.0 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.0.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.0.1 when installed on Cisco Firepower 1000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.0.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.0.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.0.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.0.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.1 when installed on Cisco Firepower 1000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.6.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.
WorkaroundCisco UTD SNORT IPS Engine Softwarecisco_csaf
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco FTD Software Release 6.7.0 For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert. Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version. Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7. Log in to the Admin Portal for the FTD deployment. Navigate to Policies > Intrusion. Choose any system-provided policy, such as Balanced Security and Connectivity. Search for rule 129:2. Check the check box next to the rule to enable it. Choose Drop from the Action drop-down list. Add the intrusion policy to a rule in Access control policy.

cvss

Technical severity, 0–10. One row per scoring source.

5.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.05mediumAV:N/AC:L/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 1.4

v3.15.8mediumAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.15.8mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · ENISA EU

v3.15.8mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · psirt@cisco.com USexploitability 3.9 · impact 1.4

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.15.8mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · Cisco PSIRT US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-693USCWE-693US

affected products (202)

Products and version ranges known to be affected.

Cisco Firepower Threat Defenseall versionscert_bundDEcpe:/a:cisco:firepower:threat_defense
Cisco Router Cloud Services Router 1000Vall versionscert_bundDEcpe:/h:cisco:router:cloud_services_router_1000v
Cisco Router ISR 1000 Seriesall versionscert_bundDEcpe:/h:cisco:router:isr_1000_series
Cisco Router ISR 3000 Seriesall versionscert_bundDEcpe:/h:cisco:router:isr_3000_series
Cisco Router ISR 4000 Seriesall versionscert_bundDEcpe:/h:cisco:router:isr_4000_series
Cisco Router Integrated Services Virtual Routerall versionscert_bundDEcpe:/h:cisco:router:integrated_services_virtual_router
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Open Source Snortall versionscert_bundDEcpe:/a:snort:snort:-
Cisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)all versionscisco_csafUS
Cisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco Firepower 2100 Seriesall versionscisco_csafUS
Cisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco Firepower 4100 Seriesall versionscisco_csafUS
Cisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco Firepower 9000 Seriesall versionscisco_csafUS
Cisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco Secure Firewall Threat Defense Virtualall versionscisco_csafUS
Cisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)all versionscisco_csafUS
Cisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco Firepower 2100 Seriesall versionscisco_csafUS
Cisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco Firepower 4100 Seriesall versionscisco_csafUS
Cisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco Firepower 9000 Seriesall versionscisco_csafUS
Cisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco Secure Firewall Threat Defense Virtualall versionscisco_csafUS
Cisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)all versionscisco_csafUS
Cisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco Firepower 2100 Seriesall versionscisco_csafUS

showing 20 of 202

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-0339Snort: Mehrere Schwachstellen ermöglichen Umgehen von SicherheitsvorkehrungenDeutsch2021-01-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Snort und verschiedenen Cisco Produkten ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
cisco-sa-snort-tfo-bypass-MmzZrtesMultiple Cisco Products Snort TCP Fast Open File Policy Bypass Vulnerability2021-01-13csaf · cisco_csafUS
Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisco_csaf NVD CVE.org MITRE

published 2021-01-13modified 2026-08-11

references (14)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan