Network Security Platform 9.1.x Known Issues

Technical Articles ID: KB88813
Last Modified: 11/5/2020

Environment

McAfee Network Security Platform (NSP) 9.1.x

Summary

Recent updates to this article

Date	Update
November 5, 2020	Edited NSPMGR-9280.
October 13, 2020	Added NSP 9.1.7.83 information. Removed resolved issues.
August 17, 2020	Removed issue 176563 from the Manager known issues section.
July 27, 2020	Added issue TSNS-9117 to the M-series section.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

Contents
Click to expand the section you want to view:

Product release information

General Availability	Release Notes
October 13, 2020	NSP 9.1.7.83-9.1.5.102 Manager-NS-series Release Notes NSP 9.1.7.83-9.1.3.18 Manager-M-series Release notes NSP 9.1.7.83-9.1.7.27 Manager-Virtual IPS Release Notes
March 17, 2020	NSP 9.1.7.80-9.1.5.80 Manager - NS-Series Release Notes NSP 9.1.7.80-9.1.3.16 Manager - M-Series Release Notes NSP 9.1.7.80-9.1.3.63 Manager - NTBA Release Notes NSP 9.1.7.80-9.1.7.25 Manager - Virtual IPS Release Notes
July 23, 2019	NSP 9.1.7.77-9.1.3.20 Manager-NTBA Release Notes
May 14, 2019	NSP 9.1.7.77-9.1.7.22 Virtual IPS Release Notes NSP 9.1.7.77-9.1.3.14 M-Series Release Notes NSP 9.1.7.77-9.1.5.63 Manager-NS-series Release Notes
December 11, 2018	NSP 9.1.19.32-9.1.17.3 NS-Series Release Notes NSP 9.1.7.75-9.1.5.56 NS-Series Release Notes NSP 9.1.7.75-9.1.3.13 M-Series Release Notes NSP 9.1.7.75-9.1.7.19 Virtual IPS Release Notes NSP 9.1.7.75-9.1.3.12 NTBA Release Notes
August 7, 2018	NSP 9.1.19.6-9.1.17.2 NS-series Release Notes
July 10, 2018	NSP 9.1.7.73-9.1.5.40 NS-Series Release Notes NSP 9.1.7.73-9.1.7.13 Virtual IPS Release Notes NSP 9.1.7.73-9.1.3.11 M-Series Release Notes NSP 9.1.7.73-9.1.3.54 NTBA Release Notes
April 20, 2018	NSP 9.1.7.63-9.1.5.23 NS-series Release Notes NSP 9.1.7.63-9.1.3.9 M-series Release Notes NSP 9.1.7.63-9.1.7.12 Virtual IPS Release Notes
March 27, 2018	NSP 9.1.7.49-9.1.3.9 NTBA Release Notes
December 13, 2017	NSP 9.1.7.49-9.1.3.6 M-series, Mxx30-series, XC Cluster Release Notes NSP 9.1.7.49-9.1.3.7 NTBA Release Notes NSP 9.1.7.49-9.1.5.20 NS-series Release Notes
November 17, 2017	NSP 9.1.7.30 Manager Appliance (Linux) Release Notes
September 19, 2017	NSP 9.1.7.11-9.1.3.3 NTBA Release Notes
July 13, 2017	NSP 9.1.7.11-9.1.5.9 NS-Series Release Notes NSP 9.1.7.11-9.1.7.4 Virtual IPS Release Notes NSP 9.1.7.11-9.1.3.4 M-series, Mxx30-series, XC-Cluster Release Notes

Issue resolutions in updates and major releases are cumulative; Technical Support recommends that you install the latest version. To find the most recent release for your product, visit the Product Downloads site at https://www.mcafee.com/enterprise/en-us/downloads/my-products.html.

Manager known issues

CRITICAL:

Reference Number	Related Article	Found in Version	Issue Description
NSPMGR-15341			Issue: Parsed tunnel traffic is disabled in the Manager on upgrading the Sensor from 8.1 to 9.1. NOTE: This issue occurs only when the parsed tunnel traffic is enabled using Sensor CLI in 8.1. Workaround: Click Devices, <Admin Domain Name>, Devices, <Device Name>. Click Setup, Advanced, Advanced Device Settings. Enable Inspect Tunneled Traffic.
NSPMGR-3774	KB91542	9.1.7.77	Issue: After you upgrade to Manager version 9.1.7.77, the Manager service fails to start. Workaround: Perform the following steps before you upgrade your Manager: Stop the Manager and Watchdog services. Open Control Panel, Administrative Tools, Services. In the Services window, view the Network Security Manager services and the Java processes. Stop any that are running. Run the Manager version 9.1.7.77 installer (setup.exe).

Non-critical:

Reference Number	Related Article	Found in Version	Issue Description
NSPMGR-9280		9.1	Issue: The following and similar errors are continuously seen in the Windows application event. Aborted connection xxxx to db: 'lf' user: '' host: 'localhost' (Got timeout reading communication packets). Workaround: This issue is cosmetic. No workaround is needed. But you can also stop the event output by performing the following: Open my.ini file in NSM_INSTALL_DIR\MariaDB. Add the following description at the end of the file. [mariadb] log_warnings=1 Restart Database service.
NSPMGR-2618		9.1	Issue: The Attack Log page fails to display correlated information of IPS attack and endpoint executables. This information includes the name, hash, and malware confidence.
NSPMGR-7952		9.1	Issue: You can't integrate NTBA with the NSM because the NTBA Direction drop-down list displays a blank value. This issue might happen when you add an NTBA to the Manager. Workaround: Delete the NTBA from the Manager. Run the deinstall command from the NTBA CLI. Add the NTBA to the Manager. Re-establish the trust between the Manager and NTBA with the command set sensor sharedsecretkey from the NTBA CLI.
NSPMGR-2510		9.1	Issue: In the Attack Log page, the ePolicy Orchestrator (ePO) console option in the Summary tab does not redirect to the proper ePO page.
NSPNTBA-143		9.1	Issue: The following categories of Next Generation Report do not work in NSM 9.1: Top Services by Bandwidth Default - Top 10 Conversations Default - Top Most Recent Connections Default - Top 10 Exporter Interfaces
NSPMGR-2472		9.1	Issue: The Attack count is not incremented for any blacklisted executable in the Endpoint Executables page.
NSPMGR-2438		9.1	Issue: [Manager Appliance Linux] The following diagnostic tools do not work in the Manager Appliance Linux: AlertStatistics DiagCollect FaultGen RuleEngineSensorInstall
NSPMGR-2411		9.1	Issue: [Manager Appliance Linux] Integration with McAfee Vulnerability Manager not supported in Manager Appliance Linux.
NSPMGR-8125		9.1	Issue: While you try to reboot Virtual IPS Sensors from the Manager, the reboot fails.
NSPMGR-8034		9.1	Issue: The Manager does not display properly on Microsoft Edge and Firefox v57 browsers. Workaround: Disable the touch-screen feature on your system. To disable the touch-screen feature on your Windows system, perform the following steps: Go to Device Manager. Search for Human Interface Devices. Right-click on HID-compliant touch screen and from the list of options displayed, click Disable. Close the browser instance and start again. Refresh the Manager and log on.
NSPMGR-2335		9.1	Issue: During a configuration update, you see your FO-pair Sensors display the following error: Geo IP location file download failure
NSPMGR-7895		9.1	Issue: After you quarantine the host, the quarantine page displays the vNSP Cluster name instead of the Virtual IPS Sensor name.

NS-Series known issues

CRITICAL:

Reference Number	Related Article	Found in Version	Issue Description
NSPSNSR-8236		9.1	Issue: Incorrect ATD counter values are displayed when you execute the CLI command show malware engine stats.
NSPSNSR-8232		9.1	Issue: When you execute the show malware engine stats CLI command, the ATD counter increments by a value of two. It increments by two for suspicious files when the result data is retrieved from the cache. This counter must only increment by 1.

Non-critical:

Reference Number	Related Article	Found in Version	Issue Description
NSPSNSR-5009		9.1	Issue: When the SSL decryption feature is enabled, the total number of TCB decreases more than expected.
NSPSNSR-8719		9.1	Issue: GTI File Reputation stops working with high traffic load.
NSPSNSR-4061		9.1	Issue: The count of attacks detected during SSL flow is always displayed as zero.
NSPSNSR-8235			Issue: Invalid string is seen in Layer 7 data alerts generated for office engine.
NSPSNSR-8195			Issue: The value of the Cache Nodes utilized counter is not reduced when the Advanced Threat Defense cache purge is started.
NSPSNSR-7937			Issue: Hitless reboot does not work because multiple datapath processors stop responding (crash).
NSPSNSR-7935			Issue: In rare scenarios, some files are not processed for malware scanning.
NSPSNSR-7932			Issue: Packet (pkt) direction is not set correctly when flow information is sent from the front-end processor to the datapath processor. The direction is unknown.
NSPSNSR-7542			Issue: APK files with extension vnd.android.package-delta are not processed for malware detection.
NSPSNSR-6916
NSPSNSR-6837			Issue: Redirection to the Guest Access portal fails for inter-VLAN routing.
NSPSNSR-3069			Issue: Connection limiting host count is as low as 128k, whereas it must be more than 256k for NS-Series Sensors.
NSPSNSR-2972			Issue: RX/TX counters are updated slowly.

Virtual IPS known issues

Non-critical:

Reference Number

Found in
Version

Issue Description

M-series, Mxx30-series, and XC-Cluster known issues

CRITICAL:

Reference Number	Related Article	Found in Version	Issue Description
NSPSNSR-8236		9.1	Issue: Incorrect Advanced Threat Defense counter values are displayed for show malware engine stats CLI command.
NSPSNSR-7945			Issue: [M-series, Mxx30-series] In rare scenarios, the datapath processor becomes unresponsive, which causes the Sensor to enter auto-recovery mode.

Non-critical:

Reference Number	Related Article	Found in Version	Issue Description
NSPSNSR-8234			Issue: The non-default value for atdcache purge interval does not work.
NSPSNSR-8199			Issue: The ATD cache is not displayed in the output of the malwarecache status CLI command.
NSPSNSR-8195			Issue: The value of the Cache Nodes utilized counter is not reduced when the ATD cache purge is started.
NSPSNSR-7928			Issue: [M-series] Two flows on the M-3050 Sensor are stuck in the time wait state for over 23 days.
NSPSNSR-7542			Issue: APK files with the vnd.android.package-delta extension are not processed for malware detection.
NSPSNSR-6614			Issue: [M-series, Mxx30-series] DNS object-based rule does not work post auto-recovery with the layer 7 processor suspended to trigger the recovery.
NSPSNSR-6576			Issue: [M-series, Mxx30-series] Layer7 DDoS JavaScript challenge does not work.
713210			Issue: [M-series, Mxx30-series] SSL attacks are detected while running IPv6 traffic, but without VLAN tags.
691838			Issue: [M-series, Mxx30-series] ARP packets are continuously sent to the NTBA Appliance when the Sensor is switched to Layer 2 mode.

Network Threat Behavior Analysis Appliance known issues

CRITICAL:

Reference Number	Related Article	Found in Version	Issue Description
1185552		9.1	Issue: After you upgrade the Manager from SHA-1 to SHA-2, the alert channel connected to the NTBA Appliance goes to a state of: Error in mutual trust. Workaround: Log on to the NTBA Appliance command line with administrator credentials. Type deinstall and press Enter. Type set sensor sharedsecretkey and press Enter to re-establish the trust between NTBA and Manager. When the NTBA Appliance comes up, the integration between NTBA and IPS is de-established. Perform a configuration update to the NTBA Appliance from the Manager. Use the Sensor CLI to confirm if the McAfee NTBA Communication status is up.
	Release Notes	9.1	Issue: To upgrade to NTBA 9.1, you must upgrade to NTBA 8.3.4.58 first before you perform the 9.1 upgrade. Solution: See the release notes listed in the Related Article column for further information.
1234108			Issue: When you initially deploy NTBA with a T-VM Appliance on ESXi 5.1, you see the error MySQL went away in the NTBA sensor.dgb logs. Workaround: Reboot the NTBA Appliance and then run the installdb command from the NTBA command line.
1208616		9.1	Issue: After you upgrade to the latest version of NTBA Appliance software, the trust between NTBA and Manager fails. Workaround: Log on to NTBA with administrator credentials, type set sensor sharedsecretkey and press Enter. Now update the NTBA configuration from the Manager. The NTBA Communication status is now re-established.
1167939		9.1	Issue: After you upgrade to the latest version of NTBA Appliance software, Gateway Anti-Malware Engine DAT files must be downloaded manually because of the software upgrade. Workaround: Log on to NTBA with administrator credentials, type download antimalware updates and press Enter.
1111146		9.1	Issue: The NTBA callback activity alerts are not displayed in Attack Log.
1119003		9.1	Issue: The DNS name is not displayed in the Threat Explorer page under the Top Applications panel.
936666		9.1	Issue: When you execute the installntba command, T-600 and T-1200 NTBA appliances take about 15–17 minutes to reboot for the first time after fresh installation from a USB drive.
737171		9.1	Issue: The Illegal File policy violation alert is not triggered even when configured criteria are met.
694869		9.1	Issue: NetFlow direction is incorrectly processed. The result is invalid reporting of the illegal website access alert for URL-related communication rules.

Non-critical:

Reference Number	Related Article	Found in Version	Issue Description
NSPMGR-8281		9.1	Issue: The Attack Log, Description tab, Alert Details panel, does not display details for the NTBA Communication rule match alert.
NSPMGR-8285		9.1	Issue: When you click the information icon for an NTBA alert in the alert details panel in the Attack Log page, the Vulnerability Assessment and Endpoint Security Events tabs are displayed twice.
1210758		9.1	Issue: The Top URL monitor in the Dashboard page does not show data for all given time frames.
1206315		9.1	Issue: When the NTBA database is corrupted, if you select the Endpoint Executables tab, it displays the following error: error loading executable
1168345		9.1	Issue: The system health status is displayed as Uninitialized state after you execute installdb in NTBA. Workaround: Execute reset-config and then re-establish trust between the Manager and NTBA. To re-establish the trust between NTBA and Manager, log on to NTBA with administrator credentials, type resetconfigset sensor sharedsecretkey, and press Enter.
1114429			Issue: The Threat Explorer page shows unrelated Top Malware files when any hyperlink is clicked.
918977			Issue: NTBA fails to show the current host IP address under load when you click View Agent Connectivity.
917256			Issue: NTBA fails to start ratinglib when DNS is unreachable as the NTBA Appliance is booted.
813375			Issue: Host Threat Factor value does not increase in accordance with the triggered antimalware alerts.

Network Security Platform Signature Set known issues

Non-Critical:

Reference Number	Related Article	Found in Version	Issue Description
1262051		9.1	Issue: McAfee recommends that you do not use the 9.8.33.6, 9.8.33.8, 9.8.34.1, and 9.8.35.3 signature sets in a production environment.

Related Information

To contact Technical Support, log on to the ServicePortal and go to the Create a Service Request page at https://support.mcafee.com/ServicePortal/faces/serviceRequests/createSR:

If you are a registered user, type your User Id and Password, and then click Log In.
If you are not a registered user, click Register and complete the required fields. Your password and logon instructions will be emailed to you.

Affected Products

Known Issue/Product Defect
Network Security Manager 9.1.x
Network Security Sensor Appliance 9.1.x
Network Threat Behavior Analysis Appliance 9.1.x

Languages:

This article is available in the following languages:

German
English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Network Security Platform 9.1.x Known Issues

Environment

Summary

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Network Security Platform 9.1.x Known Issues

Environment

Summary

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title