Network Security Platform 9.2.x Known Issues

Technical Articles ID: KB90337
Last Modified: 7/8/2020

Environment

McAfee Network Security Platform (NSP) 9.2.x

Summary

Recent updates to this article

Date	Update
July 8, 2020	Removed NSPMGR-3243 from the Manager Non-critical issues section.
June 29, 2020	Added NSPSNSR-10301 to the NS-Series critical issues section.
April 28, 2020	Added NSPMGR-9560 to the Manager Non-critical issues section. Added April 28 Product Release Notes.
March 20, 2020	Updated 947790.
February 18, 2020	Added NSPMGR-3243 to the Manager Non-critical issues section.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

Contents
Click to expand the section you want to view:

Product release information

General Availability (GA)	Release Notes
April 28, 2020	NSP 9.2.9.55-9.2.5.163 Manager-NS-series Release Notes NSP 9.2.9.55-9.2.7.56 Manager-Virtual IPS Release Notes
August 13, 2019	NSP 9.2.9.53 - 9.2.5.88 Manager NS9500 Appliance Release Notes
July 30, 2019	NSP 9.2.9.12-9.2.5.153 Manager-NS-series Release Notes NSP 9.2.9.12-9.2.7.54 Manager-Virtual IPS Release Notes
April 12, 2019	NSP 9.2.9.8 - 9.2.5.34 Manager-NS3500 Release Notes NSP 9.2.9.8 - 9.2.5.52 Manager-NS9500 Release Notes NSP 9.2.7.31-9.2.7.26 Virtual IPS Release Notes
March 19, 2019	NSP 9.2.7.31-9.2.5.72 Manager-NS-series Release Notes NSP 9.2.7.31-9.2.7.26 Virtual IPS Release Notes
March 12, 2019	NSP 9.2.9.5-9.2.5.50 Manager-NS9500 Appliance Release Notes
February 12, 2019	NSP 9.2.9.3-9.2.5.34 NS-series Release Notes
September 18, 2018	NSP 9.2.7.22-9.2.5.27 NS-series Release Notes
September 11, 2018	NSP 9.2.7.22-9.2.7.20 Virtual IPS Release Notes
July 10, 2018	NSP 9.2.7.9-9.2.7.17 Virtual IPS Release Notes
May 8, 2018	NSP 9.2.7.9-9.2.7.12 Virtual-IPS Release Notes
March 13, 2018	NSP 9.2.7.9-9.2.5.6 NS-series Release Notes NSP 9.2.7.9-9.2.7.10 Virtual IPS Release Notes

Issue resolutions in updates and major releases are cumulative; Technical Support recommends that you install the latest version. To find the most recent release for your product, visit the Product Downloads site at http://www.mcafee.com/us/downloads/downloads.aspx.

Manager known issues

CRITICAL:

Reference Number	Related Article	Found in Version	Issue Description
1270723		9.2	Issue: In a Manager Disaster Recovery (MDR) pair, when you double-click a policy from the Inspection Options Policies page of the standby Manager, you are logged out of the Manager. Double-clicking a policy in the standby Manager only allows view access because objects in the standby Manager are synced from the active Manager. Workaround: You can view and optionally modify a policy using an active Manager's Inspection Options Policies page.
1269785		9.2	Issue: On a Linux-based Manager, the Deploy Pending Changes page displays that the device has changes pending even after being deployed multiple times.
1269083		9.2	Issue: [NS9500] The fault “Licenses required” is not cleared even after assigning a license to the Sensor.
1268789		9.2	Issue: [NS9500/NS3500] The Licenses report does not include information for Capacity Licenses.
1244598			Issue: Parsing of packets with Maximum Transmission Unit (MTU) higher than 1500 causes the Sensor to crash. Workaround: Configure the host system MTU to 1500.
1238686			Issue: Advanced Threat Defense integration does not establish from the Manager at the device level.
1236176	KB90549	9.2	Issue: Network Security Manager does not display Analysis reports for Advanced Threat Defense analyzed samples. Solution: This issue is fixed in Manager Hotfix 9.2.7.9.3.
1208547		9.1	Issue: You can't integrate Cloud Threat Defense with Manager Appliance on Linux.
1179927			Issue: When you access a malware policy for a malware alert from the Attack Log, it displays a blank malware policy.
1119525			Issue: No Flow usage graph is displayed when scanning UDP traffic. A graph must be displayed on the Flow usage tab when monitoring UDP traffic.
1087489			Issue: Unable to reboot or shut down VM100 Sensor from the Manager.
1026921			Issue: Host Threat Factor value shows as NULL on the High-risk Hosts dashboard.

Non-critical:

Reference Number	Related Article	Found in Version	Issue Description
NSPMGR-9560		9.2	Issue: In ePO, the trust establishment between the Network Security Manager and the HIP Sensor trust fails when extension is stopped and restarted.
NSPMGR-8341		9.2	Issue: Assigning capacity license and editing a stack can't be performed from the secondary Manager in an MDR pair. Perform these actions only from the primary Manager.
NSPMGR-8312		9.2	Issue: If you have modified the proxy SSL decryption settings at the domain level, you must select the SSL key option for configuration update at the device level.
NSPMGR-8256		9.2	Issue: The clear ssl proxy stats CLI command does not clear all SSL proxy related statistics.
NSPMGR-3895		9.2	Issue: When you swap a member Sensor from one stack to another stack within the same Manager, the older stack must be deleted in the Manager.
NSPMGR-3800		9.2	Issue: The Device Manager page does not load when any of the member Sensors in a stack goes down for the first time.
NSPMGR-3791		9.2	Issue: After you create a stack in the Manager, you can't manage the stack unless all member Sensors have established trust with the Manager.
NSPMGR-3751		9.2	Issue: You must manually deploy the changes when certain configurations for the stack are changed.
NSPMGR-3686		9.2	Issue: Port Throughput Usage functionality might not work because a static ports list is shown.
NSPMGR-3646		9.2	Issue: During high malware traffic, alerts from the Sensor are only listed in the Manager Attack Log after a delay.
NSPMGR-8286		9.2	Issue: [AWS] The protected group allows you to remove all subnets. Any subnet added after this action is not saved. Workaround: Delete the protected group. Re-create the protected group. Add the required subnets.
1261987		9.1	Issue: If you log on with a read-only user ("Policy Read only" applied, but not "Policy Edit") you can't view Inspection Policy.
1268013		9.2	Issue: In the System Faults page, the informational fault does not specify the Interface Module type after inserting the QSFP28 100 gigabit Interface Module.
1264290		9.2	Issue: You see Unsupported response port R1 displayed in the Manager Port Details tab in the Physical Ports page.
1263784		9.2	Issue: The alert channel flaps when the Sensor capacity is changed. You see the exception: The “<Sensor name> Experience a SNMP error during set/get, Change the STATUS to DISCONNECTED” in the ems.log. Workaround: On the NSM, open File Explorer and navigate to C:\Program Files\McAfee\Network Security Manager\App\config. Locate the ems.properties file. Right-click and open it in Windows Notepad. Scroll down to the end of the file and add the line: iv.core.ControlChannel.maxInitialSNMPACKWaitTime=10000 Save your changes to the ems.properties file and restart the Manager service.
1248213		9.2	Issue: When you use the 4-port RJ-45 Interface Module, you see the unsupported Inline Fail Open – Active operational mode displayed.
1231371		9.2	Issue: After upgrading to 9.2, Snort engine configurations are not inherited at Admin Domain level.
1229614		9.2	Issue: [Azure] When you push the Private GTI Cloud Certificate to NSP running in an Azure environment, you see the error: CANNOT Found the ne HA-cluster from NE cache by name. Return null.
1229584		9.2	Issue: The file hashes page crashes when deleting records from the blacklist or whitelist when the number of entries exceeds 159 entries.
1229033		9.2	Issue: UDS validation result fails when importing only snort rules.
1228758		9.1	Issue: When your account password expires, you are not redirected to the password reset page.
1228391		9.2	Issue: After upgrading the Manager, the private GTI configurations can't be updated to the Sensor.
1225280		9.2	Issue: [Azure, AWS] New HA controllers can't be created with the same name as previously terminated HA controllers.
1223943		9.2	Issue: After importing chain certificates, incorrect key length for the parent certificates is displayed.
1223906		9.2	Issue: [Azure] When two HA controllers are rebooted at the same time, the service IP address is disassociated and fails to associate again.
1222161		9.1	Issue: The Attack Log page does not display the IP address for the Too many inbound TCP SYN attack.
1220348		9.1	Issue: The Attack Log page fails to display correlated information of IPS attack and endpoint executables. This information includes the name, hash, and malware confidence.
1220328		9.1	Issue: You can't integrate NTBA with the Manager because the NTBA Direction drop-down list displays a blank value. This issue might happen when you add an NTBA to the Manager. Workaround: Delete the NTBA from the Manager. Run the deinstall command from the NTBA CLI. Add the NTBA to the Manager. Re-establish the trust between the Manager and NTBA using the command set sensor sharedsecretkey from the NTBA CLI.
1220266		9.1	Issue: Update to an UDS is successful even if the UDS has an error.
1213651		9.1	Issue: In the Attack Log page, the ePolicy Orchestrator (ePO) console option in the Summary tab does not redirect to the proper ePO page.
1213616		9.1	Issue: The Manager does not generate a Host Intrusion Prevention event and the event details are not displayed in the Threat Explorer page.
1213608		9.1	Issue: The attack log displays the "label.NetworkObject.undefined" error message in the alert details panel under the Summary tab.
1211665		9.1	Issue: The following categories of Next Generation Report do not work in Manager 9.1: Top Services by Bandwidth Default - Top 10 Conversations Default - Top Most Recent Connections Default - Top 10 Exporter Interfaces
1211323		9.1	Issue: The Attack count is not incremented for any blacklisted executable in the Endpoint Executables page.
1209208		9.1	Issue: [Manager Appliance Linux] The following diagnostic tools do not work in the Manager Appliance Linux: AlertStatistics DiagCollect FaultGen RuleEngineSensorInstall
1208237		9.1	Issue: [Manager Appliance Linux] When executing dbadmin.sh, an exception is generated and database backup and restore fails.
1207832		9.1	Issue: [Manager Appliance Linux] Integration with McAfee Vulnerability Manager not supported in Manager Appliance Linux.
1202643		9.1	Issue: While trying to reboot Virtual IPS Sensors from the Manager, the reboot fails.
1201735		9.1	Issue: When multiple Controller upgrade files are downloaded, the file name usually has a numeric suffix. If this suffix contains a space in the file name, the controller upgrade fails. Workaround: The Controller upgrade download file must not contain any space or numerals.
1201310		9.1	Issue: When you disable the Packet Log Encryption feature, the channel flaps. Workaround: You must keep the Packet Log Encryption option enabled. Select Devices, <Admin Domain Name>, Devices, <Device Name>, Setup, Advanced, Alerting Options. Make sure that the Packet Log Encryption option is enabled.
1197570		9.1	Issue: The Manager does not display properly on Microsoft Edge and Firefox v57 browsers. Workaround: Disable the touch-screen feature on your system. To disable the touch-screen feature on your Windows system, perform the following steps: Go to Device Manager. Search for Human Interface Devices. Right-click on HID-compliant touch screen and from the list of options displayed, select Disable. Close the browser instance and start again. Refresh the Manager and log on.
1196389		9.1	Issue: In an AWS MDR pair, the Controller communicates with the Secondary Manager even after converting the Manager to standalone.
1184565		9.1	Issue: After you quarantine the host, the quarantine page displays the vNSP Cluster name instead of the Virtual IPS Sensor name.
1183813		9.1	Issue: After a .jar upgrade, the Manager logon session ends and shows the logon page after rebooting the NTBA Appliance from the NTBA page. Workaround: Even when the Manager is logged out, the NTBA Appliance reboots in the background. Manual reboot of the NTBA Appliance is not required.
1179954			Issue: Policy update at domain level for Default Detection policy does not work.
1176563			Issue: The Scheduler intermittently fails to pick files submitted to the cloud to get the report.
1175848			Issue: Port module removed from the Sensor is displayed in the Physical Ports page while creating a failover pair.
1174187			Issue: The information "i" icon does not appear in the Malware Files page against the malware confidence. Workaround: This information is available in the Attack Log page.
1171604			Issue: Callback Activity alerts generated before an upgrade will not appear after upgrading to 9.1.
1170425			Issue: The Tag Endpoints option in the Other Actions menu in the Attack Log displays OSC instead of ISC.
1162743			Issue: The option to collect a diagnostic trace is not available.
1161012			Issue: Names of the data type are sorted but the sort arrow is not displayed in the Traffic Received / Sent tab when you go to the Devices, <Admin Domain Name>, Devices, Troubleshooting, Traffic Statistics page.
1160967			Issue: Performance charts for Throughput and Flow Usage do not display data when Performance Monitoring is enabled.
1114216			Issue: Gateway Anti-Malware (GAM) 2013 is shown as the active version even when no Gateway Anti-Malware engine is configured on the Sensor.
1113349			Issue: The malware files are not deleted when the Manager is in standby mode.
947790			Issue: When the Manager forwards alert messages to the syslog server, Host sweep alerts display a mismatch in the Network Protocol ID.
905270			Issue: Submission ID for Advanced Threat Defense (ATD) reports are not displayed on the Malware Detections page.
897937			Issue: The Manager does not trigger alerts for custom rules that use the ssl_version field.
832573			Issue: The Last Event column on the dashboard of the suspicious host, incorrectly lists the risk score scheduler time.

NS-series known issues

CRITICAL:

Reference Number	Related Article	Found in Version	Issue Description
NSPSNSR-10301	KB93037	9.2	Issue: [NS9100] - The Sensor reboots after you upgrade to 9.2.5.163, during a signature file push or Gateway Anti-Malware update.
1248148		9.2	Issue: Inspection for customized whitelisted domain names generates alerts.
1224279		9.2	Issue: Sensor sends incorrect source and destination IP addresses or ports for snort alerts.
1221463		9.2	Issue: [SNORT] Suricata is not detecting alerts when the traffic has 2 VLAN tags or MPLS tag.
1116819		9.1	Issue: Incorrect ATD counter values are displayed when you execute the CLI command show malware engine stats.
1116440		9.1	Issue: When you execute the show malware engine stats CLI command, the ATD counter increments by a value of two for suspicious files when the result data is retrieved from the cache. This counter must only increment by 1.

Non-critical:

Reference Number	Related Article	Found in Version	Issue Description
NSPSNSR-8959		9.2	Issue: When proxy SSL decryption mode is enabled, the SSL packets on SPAN ports create a loop within the system and skip inspection.
NSPSNSR-5213		9.2	Issue: IP address range can't be configured in a Sensor for SSL decryption.
1260141		9.2	Issue: [NS3500] Monitoring ports flap intermittently. Workaround: Disable and enable the monitoring ports.
1254976		9.2	Issue: [NS9500] Even after removing the failover link, the failover link status is displayed as UP in the Sensor CLI.
1254733		9.2	Issue: [NS3500] Management port speed is displayed incorrectly in the Sensor CLI.
1225446		9.2	Issue: Sensor Snort IDs are sent in the failed rules file instead of Global Snort IDs.
1225226		9.2	Issue: The Sensor prioritizes HTTP traffic over SSL traffic when outbound SSL decryption is enabled.
1224334		9.2	Issue: Outbound SSL implementation shows outbound flows as configurable through Manager.
1223587		9.2	Issue: Rules with IPv4 address range can't be created
1220239		9.2	Issue: [SNORT] Snort attack packet detected by Suricata can't be exported from attack log.
1198188		9.1	Issue: GTI File Reputation stops working with high traffic load.
1185957		9.1	Issue: The count of attacks detected during SSL flow is always displayed as zero.
1173916			Issue: Layer 7 data collection remains enabled although it is disabled from the Policy page, which leads to low performance of the device.
1116785			Issue: Invalid string is seen in Layer 7 data alerts generated for office engine.
1114124			Issue: The value of the Cache Nodes utilized counter is not reduced when the Advanced Threat Defense cache purge is started.
1083605			Issue: Hitless reboot does not work as multiple datapath processors stop responding (crash).
1083506			Issue: In rare scenarios, some files are not processed for malware scanning.
1082986			Issue: Packet (pkt) direction is not set correctly when flow information is sent from the front-end processor to the datapath processor. (Packet direction is unknown.)
1025365			Issue: APK files with extension vnd.android.package-delta are not processed for malware detection.
1019974			Issue: During split file download, XDP files are not extracted.
940106			Issue: Redirection to the Guest Access portal fails for inter-VLAN routing.
847172			Issue: Connection limiting host count is as low as 128k, whereas it must be more than 256k for NS-series Sensors.
783323			Issue: RX/TX counters are updated slowly.
537012			Issue: [Snort] The Sensor does not raise an alert when a space is part of the content matching rule. Workaround: Separate into multiple content keywords in a single rule.

Virtual IPS known issues

CRITICAL:

Reference Number	Related Article	Found in Version	Issue Description
1239818		9.2	Issue: When the configuration update file is large, the update fails intermittently in a KVM environment.
1229740		9.2	Issue: You can't upgrade an IPS-VM600 Sensor model deployed on an ESXi server from 8.1, 8.3, and 9.1 to 9.2.

Non-Critical:

Reference Number	Related Article	Found in Version	Issue Description
1253631		9.2	Issue: [AWS] Unable to establish tunnel with virtual machines until Sensor reboot. Tunnel is not established between the protected virtual machine and the Sensor on port 9797. Workaround: To initiate the TCP handshake, restart the Sensor.
1203688		9.1	Issue: At times, the OVA file for Virtual IPS Sensor returns error while deploying using VMware Center. Workaround: First deploy the latest Virtual IPS Sensor 8.3 OVA, and then upgrade the Virtual IPS Sensor to 9.1.
1232168		9.2	Issue: [Azure] After you deploy the Network Security Manager through Azure Marketplace, the Manager desktop displays incorrect values for the deployment ID and internal IP address.

Related Information

To contact Technical Support, log on to the ServicePortal and go to the Create a Service Request page at https://support.mcafee.com/ServicePortal/faces/serviceRequests/createSR:

If you are a registered user, type your User Id and Password, and then click Log In.
If you are not a registered user, click Register and complete the required fields. Your password and logon instructions will be emailed to you.

Affected Products

Known Issue/Product Defect
Network Security Manager 9.2.x
Network Security Sensor Appliance 9.2.x

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Network Security Platform 9.2.x Known Issues

Environment

Summary

Related Information

Affected Products

Glossary of Technical Terms

Title

Title

Featured Solutions

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

Network Security Platform 9.2.x Known Issues

Environment

Summary

Related Information

Affected Products

Glossary of Technical Terms

Choose your region

Title

Title