Symptom
++ Multiple snort cores may get generated during the injection of TLS messages over 9216 bytes:
Jan 11 01:30:51 FTDONE SF-IMS[7192]: [7192] pm:process [WARN] Process f4bf186e-9f96-11ec-b6a8-557c439d662d-d04 (61152) exited unexpectedly: 139 (0x0000008B)
Jan 11 01:41:21 FTDONE SF-IMS[7192]: [7192] pm:process [WARN] Process f4bf186e-9f96-11ec-b6a8-557c439d662d-d04 (59503) exited unexpectedly: 139 (0x0000008B)
Jan 11 01:51:20 FTDONE SF-IMS[7192]: [7192] pm:process [WARN] Process f4bf186e-9f96-11ec-b6a8-557c439d662d-d04 (53624) exited unexpectedly: 139 (0x0000008B)
Jan 11 02:01:21 FTDONE SF-IMS[7192]: [7192] pm:process [WARN] Process f4bf186e-9f96-11ec-b6a8-557c439d662d-d04 (44422) exited unexpectedly: 139 (0x0000008B)
Jan 11 02:12:20 FTDONE SF-IMS[7192]: [7192] pm:process [WARN] Process f4bf186e-9f96-11ec-b6a8-557c439d662d-d04 (42081) exited unexpectedly: 139 (0x0000008B)
++ May result to deployment failure with the below error:
"Jan 11 04:03:13 Timeout waiting for snort detection engines to process traffic: f4bf186e-9f96-11ec-b6a8-557c439d662d"
Jan 11 01:41:20 CY-IPS-01 SF-IMS[59503]: Validating mempool 0x14744a207318 :
Jan 11 01:41:20 CY-IPS-01 SF-IMS[59503]: Count 2 Fail
Jan 11 01:41:20 CY-IPS-01 SF-IMS[59503]: node->next: (nil)(~0xffffffffffffffff)
node->backup_next: (nil)(fail)
Conditions
++ Applies to FPR2100 appliances only, running any of the affected listed versions
++ Snort2 and Snort3 both are impacted
Workaround
Reboot of the FTD
Further Problem Description
1) To get this fix in, the snort version has to be upgraded. Hence FMC upgrade will also be required.
