Firepower black lists and snort updates
Hi,
I am looking for some info about how a firepower appliance and ASA are pulling updates for Snort(IPS signatures) and black lists from CISCO servers, but I am unable to find anything relevant.
I am trying to understand if the appliance (managed device) needs direct access to the internet for the updates, or if it gets them though the Firepower Management Center, when updates are set to automatically.
Thanks!
@dan-belcic,
You'll need to make sure that you update the FMC FIRST before updating your devices.
For Snort, you'll looking to update the VDB (Vulnerability Database) or the Intrusion Rules... I always get the two mixed up--one updates Snort and the other are the Talos updates). Usually after updating, the update will restart Snort. So expect an interruption to your service.
You can download the VDB directly from the Support Site or via the FMC's download update link ( System > Updates > Product Updates). But you should update the FMC before doing the previous step.
The best guide out there is the following: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/System_Software_Updates.pdf
@Ronnie-Wong
Thanks!
