Network Security Platform 9.2.x Known Issues

Technical Articles ID: KB90337
Last Modified: 6/2/2021

Environment

McAfee Network Security Platform (NSP) 9.2.x

Summary

Recent updates to this article

Date	Update
June 2, 2021	Updated NSPMGR-15892.
February 10, 2021	Updated Release notes for Feb 9 release; Reference numbers to new system.
February 5, 2021	Updated terms used for lists.
July 8, 2020	Removed NSPMGR-3243 from the Manager Non-critical issues section.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

Contents
Click to expand the section you want to view:

Product release information

General Availability (GA)	Release Notes
February 9, 2021	NSP 9.2.9.60-9.2.5.190 Manager-NS-series Release Notes NSP 9.2.9.60-9.2.7.65 Manager-Virtual IPS Release Notes
April 28, 2020	NSP 9.2.9.55-9.2.5.163 Manager-NS-series Release Notes NSP 9.2.9.55-9.2.7.56 Manager-Virtual IPS Release Notes
August 13, 2019	NSP 9.2.9.53 - 9.2.5.88 Manager NS9500 Appliance Release Notes
July 30, 2019	NSP 9.2.9.12-9.2.5.153 Manager-NS-series Release Notes NSP 9.2.9.12-9.2.7.54 Manager-Virtual IPS Release Notes
April 12, 2019	NSP 9.2.9.8 - 9.2.5.34 Manager-NS3500 Release Notes NSP 9.2.9.8 - 9.2.5.52 Manager-NS9500 Release Notes NSP 9.2.7.31-9.2.7.26 Virtual IPS Release Notes
March 19, 2019	NSP 9.2.7.31-9.2.5.72 Manager-NS-series Release Notes NSP 9.2.7.31-9.2.7.26 Virtual IPS Release Notes
March 12, 2019	NSP 9.2.9.5-9.2.5.50 Manager-NS9500 Appliance Release Notes
February 12, 2019	NSP 9.2.9.3-9.2.5.34 NS-series Release Notes
September 18, 2018	NSP 9.2.7.22-9.2.5.27 NS-series Release Notes
September 11, 2018	NSP 9.2.7.22-9.2.7.20 Virtual IPS Release Notes
July 10, 2018	NSP 9.2.7.9-9.2.7.17 Virtual IPS Release Notes
May 8, 2018	NSP 9.2.7.9-9.2.7.12 Virtual-IPS Release Notes
March 13, 2018	NSP 9.2.7.9-9.2.5.6 NS-series Release Notes NSP 9.2.7.9-9.2.7.10 Virtual IPS Release Notes

Issue resolutions in updates and major releases are cumulative; Technical Support recommends that you install the latest version. To find the most recent release for your product, go to the Product Downloads site.

Manager known issues

CRITICAL:

Reference Number	Related Article	Found in Version	Issue Description
NSPMGR-3581		9.2	Issue: On a Linux-based Manager, the Deploy Pending Changes page displays that the device has changes pending even after being deployed multiple times.
NSPMGR-7847		9.2	Issue: When you access a malware policy for a malware alert from the Attack Log, it displays a blank malware policy.
NSPMGR-7484		9.2	Issue: No Flow usage graph is displayed when scanning UDP traffic. A graph must be displayed on the Flow usage tab when monitoring UDP traffic.

Non-critical:

Reference Number	Related Article	Found in Version	Issue Description
NSPMGR-16798 NSPMGR-15892		9.2	Issue: The SQL Server stops reponding when the virtual machine is set to dynamic HDD allocation.
NSPMGR-3800		9.2	Issue: The Device Manager page does not load when any of the member Sensors in a stack goes down for the first time.
NSPMGR-3791		9.2	Issue: After you create a stack in the Manager, you can't manage the stack unless all member Sensors have established trust with the Manager.
NSPMGR-3751		9.2	Issue: You must manually deploy the changes when certain configurations for the stack are changed.
NSPMGR-3686		9.2	Issue: Port Throughput Usage functionality might not work because a static ports list is shown.
NSPMGR-8286		9.2	Issue: [AWS] The protected group allows you to remove all subnets. Any subnet added after this action is not saved. Workaround: Delete the protected group. Re-create the protected group. Add the subnets needed.
NSPMGR-3330		9.2	Issue: You see Unsupported response port R1 displayed in the Manager Port Details tab in the Physical Ports page.
NSPMGR-3319		9.2	Issue: The alert channel flaps when the Sensor capacity is changed. You see the exception: The “<Sensor name> Experience a SNMP error during set/get, Change the STATUS to DISCONNECTED” in the ems.log. Workaround: On the NSM, open File Explorer and navigate to C:\Program Files\McAfee\Network Security Manager\App\config. Locate the ems.properties file. Right-click and open it in Windows Notepad. Scroll down to the end of the file and add the line: iv.core.ControlChannel.maxInitialSNMPACKWaitTime=10000 Save your changes to the ems.properties file and restart the Manager service.
NSPMGR-3024		9.2	Issue: When you use the 4-port RJ-45 Interface Module, you see the unsupported Inline Fail Open – Active operational mode displayed.
NSPMGR-2801		9.2	Issue: After upgrading to 9.2, Snort engine configurations are not inherited at Admin Domain level.
NSPMGR-2773		9.2	Issue: [Azure] When you push the Private GTI Cloud Certificate to NSP running in an Azure environment, you see the error: CANNOT Found the ne HA-cluster from NE cache by name. Return null.
NSPMGR-2772		9.2	Issue: The file hashes page crashes when deleting records from the block list or allow list when the number of entries exceeds 159 entries.
NSPMGR-2758		9.2	Issue: After upgrading the Manager, the private GTI configurations can't be updated to the Sensor.
NSPMGR-2694		9.2	Issue: [Azure, AWS] New HA controllers can't be created with the same name as previously terminated HA controllers.
NSPMGR-2669		9.2	Issue: After importing chain certificates, incorrect key length for the parent certificates is displayed.
NSPMGR-2646		9.1	Issue: The Attack Log page does not display the IP address for the Too many inbound TCP SYN attack.
NSPMGR-7952		9.1	Issue: You can't integrate NTBA with the Manager because the NTBA Direction drop-down list displays a blank value. This issue might happen when you add an NTBA to the Manager. Workaround: Delete the NTBA from the Manager. Run the deinstall command from the NTBA CLI. Add the NTBA to the Manager. Re-establish the trust between the Manager and NTBA using the command set sensor sharedsecretkey from the NTBA CLI.
NSPMGR-2510		9.1	Issue: In the Attack Log page, the ePolicy Orchestrator (ePO) console option in the Summary tab does not redirect to the proper ePO page.
NSPMGR-2472		9.1	Issue: The Attack count is not incremented for any block listed executable in the Endpoint Executables page.
NSPMGR-2438		9.1	Issue: [Manager Appliance Linux] The following diagnostic tools do not work in the Manager Appliance Linux: AlertStatistics DiagCollect FaultGen RuleEngineSensorInstall
NSPMGR-2411		9.1	Issue: [Manager Appliance Linux] Integration with McAfee Vulnerability Manager not supported in Manager Appliance Linux.
NSPMGR-8125		9.1	Issue: While trying to reboot Virtual IPS Sensors from the Manager, the reboot fails.
NSPMGR-8107		9.1	Issue: When you disable the Packet Log Encryption feature, the channel flaps. Workaround: You must keep the Packet Log Encryption option enabled. Select Devices, <Admin Domain Name>, Devices, <Device Name>, Setup, Advanced, Alerting Options. Make sure that the Packet Log Encryption option is enabled.
NSPMGR-8125		9.1	Issue: The Manager does not display properly on Microsoft Edge and Firefox v57 browsers. Workaround: Disable the touch-screen feature on your system. To disable the touch-screen feature on your Windows system, perform the following steps: Go to Device Manager. Search for Human Interface Devices. Right-click on HID-compliant touch screen and from the list of options displayed, select Disable. Close the browser instance and start again. Refresh the Manager and log on.
NSPMGR-2349		9.1	Issue: In an AWS MDR pair, the Controller communicates with the Secondary Manager even after converting the Manager to standalone.
NSPMGR-7895		9.1	Issue: After you quarantine the host, the quarantine page displays the vNSP Cluster name instead of the Virtual IPS Sensor name.
NSPMGR-2293		9.1	Issue: After a .jar upgrade, the Manager logon session ends and shows the logon page after rebooting the NTBA Appliance from the NTBA page. Workaround: Even when the Manager is logged out, the NTBA Appliance reboots in the background. Manual reboot of the NTBA Appliance is not needed.
NSPMGR-2239			Issue: The information "i" icon does not appear in the Malware Files page against the malware confidence. Workaround: This information is available in the Attack Log page.
NSPMGR-2225			Issue: Callback Activity alerts generated before an upgrade will not appear after upgrading to 9.2.
NSPMGR-2158			Issue: Names of the data type are sorted but the sort arrow is not displayed in the Traffic Received / Sent tab. This tab is at the Devices, <Admin Domain Name>, Devices, Troubleshooting, Traffic Statistics page.
NSPMGR-7701			Issue: Performance charts for Throughput and Flow Usage do not display data when Performance Monitoring is enabled.
NSPMGR-5696			Issue: Submission ID for Advanced Threat Defense (ATD) reports are not displayed on the Malware Detections page.
NSPMGR-1206			Issue: The Last Event column on the dashboard of the suspicious host, incorrectly lists the risk score scheduler time.

NS-series known issues

CRITICAL:

Reference Number	Related Article	Found in Version	Issue Description
NSPSNSR-10941		9.2	Issue: [NS9300] The Sensor remains down when non-certified McAfee connectors are used for interconnecting the primary and secondary Sensors (NS9300P-NS9300S).
NSPSNSR-4325		9.2	Issue: Sensor sends incorrect source and destination IP addresses or ports for snort alerts.
NSPSNSR-4290		9.2	Issue: [SNORT] Suricata is not detecting alerts when the traffic has 2 VLAN tags or MPLS tag.

Non-critical:

Reference Number	Related Article	Found in Version	Issue Description
NSPSNSR-10958		9.2	Issue: [NS9100] The Sensor fails when the "Pre-attack bytes to capture" configuration is set to a value higher than the default value (128 bytes).
NSPSNSR-10849		9.2	Issue: After the communication channel between the Sensor and McAfee Advanced Threat Defense is down, the communication channel fails to reconnect automatically. Workaround: Reconfigure the Sensor and Advanced Threat Defense in the Manager.
NSPSNSR-9005		9.2	Issue: The clear ssl proxy stats CLI command does not clear all SSL proxy related statistics.
NSPSNSR-8959		9.2	Issue: When proxy SSL decryption mode is enabled, the SSL packets on SPAN ports create a loop within the system and skip inspection.
NSPSNSR-5213		9.2	Issue: IP address range can't be configured in a Sensor for SSL decryption.
NSPSNSR-6916		9.2	Issue: When the Manager forwards alert messages to the syslog server, Host sweep alerts display a mismatch in the Network Protocol ID.
NSPSNSR-9449		9.2	Issue: [NS3500] Monitoring ports flap intermittently. Workaround: Disable and enable the monitoring ports.
NSPSNSR-10394		9.2	Issue: [NS3500] Management port speed is displayed incorrectly in the Sensor CLI.
NSPSNSR-4344		9.2	Issue: Sensor Snort IDs are sent in the failed rules file instead of Global Snort IDs.
NSPSNSR-4339		9.2	Issue: The Sensor prioritizes HTTP traffic over SSL traffic when outbound SSL decryption is enabled.
NSPSNSR-4326		9.2	Issue: Outbound SSL implementation shows outbound flows as configurable through Manager.
NSPSNSR-4314		9.2	Issue: Rules with IPv4 address range can't be created
NSPSNSR-4278		9.2	Issue: [SNORT] Snort attack packet detected by Suricata can't be exported from attack log.
NSPSNSR-8719		9.1	Issue: GTI File Reputation stops working with high traffic load.
NSPSNSR-3990			Issue: Layer 7 data collection remains enabled although it is disabled from the Policy page, which leads to low performance of the device.
NSPSNSR-8235			Issue: Invalid string is seen in Layer 7 data alerts generated for office engine.
NSPSNSR-8195			Issue: The value of the Cache Nodes utilized counter is not reduced when the Advanced Threat Defense cache purge is started.
NSPSNSR-7937			Issue: Hitless reboot does not work as multiple datapath processors stop responding (crash).
NSPSNSR-7935			Issue: In rare scenarios, some files are not processed for malware scanning.
NSPSNSR-7932			Issue: Packet (pkt) direction is not set correctly when flow information is sent from the front-end processor to the datapath processor. (Packet direction is unknown.)
NSPSNSR-7542			Issue: APK files with extension vnd.android.package-delta are not processed for malware detection.
NSPSNSR-6837			Issue: Redirection to the Guest Access portal fails for inter-VLAN routing.
NSPSNSR-3069			Issue: Connection limiting host count is as low as 128k, whereas it must be more than 256k for NS-series Sensors.
NSPSNSR-2972			Issue: RX/TX counters are updated slowly.

Virtual IPS known issues

CRITICAL:
No known issues.

Non-Critical:

Reference Number	Related Article	Found in Version	Issue Description
NSPSNSR-6916		9.2	Issue: When the Manager forwards alert messages to the syslog server, Host sweep alerts display a mismatch in the Network Protocol ID.
NSPSNSR-4641		9.2	Issue: [AWS] Unable to establish tunnel with virtual machines until Sensor reboot. Tunnel is not established between the protected virtual machine and the Sensor on port 9797. Workaround: To initiate the TCP handshake, restart the Sensor.

Signature Set known issues

CRITICAL:

Reference Number	Related Article	Found in Version	Issue Description
NSPNAD-1721			Issue: During split file download, XDP files are not extracted.

Non-Critical:
No known issues.

Related Information

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Affected Products

Known Issue/Product Defect
Network Security Manager 9.2.x
Network Security Sensor Appliance 9.2.x

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Knowledge Center

Network Security Platform 9.2.x Known Issues

Environment

Summary

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Network Security Platform 9.2.x Known Issues

Environment

Summary

Related Information

Affected Products

Languages:

Choose your region

Title

Title