Release Notes

Version 5.2.0.2 Sourcefire 3D System Release Notes 21
Issues Resolved in Version 5.2.0.2
• Resolved an issue where traffic matched an access control policy block rule
and the system evaluated it against the access control policy default action
configured as an intrusion policy. (124732)
• Resolved a synchronization issue where, in rare cases, clusters lost their
clustered status. (125497)
• Resolved an issue where accessing the intrusion rule editor from the packet
view (Analysis > Intrusion > Events) caused the system to display an error
message and log the attempt as an unauthorized action. (125770)
• Resolved an issue with the Sourcefire Data Correlator where complex
queries slowed the system’s ability to process new connection events.
(125754)
• Updated Sourcefire documentation to reflect that when you reimage a
device from Version 4.10.x to Version 5.1, if the device has interfaces
configured to fail open, they will revert to a non-bypass (fail closed)
configuration at first boot and remain closed until you configure bypass
mode for them. (125957)
• Improved performance statistics logging to more accurately reflect packet
counts per time interval. (126437)
• Resolved an issue where the device management page showed managed
devices running an outdated version. (126564)
• Resolved an issue where, in some cases, system updates failed to
download when you used a NLTM authenticated proxy server. (126872)
Issues Resolved in Previous Updates
Previously resolved issues are listed by version.
Version 5.2.0.1
• The About page (Help > About) and Advanced display option for the Appliance
Information dashboard widget now show the current version of Snort
running on a Defense Center. (121228, 123403, 124615)
• Resolved an issue where, during an update, a device in a clustered, inline
deployment could fail over incorrectly. (123239)
• Resolved an issue where, in some cases, device configuration apply to a
stack failed if it contained a NAT policy that referenced invalid interfaces.
(123540)
• Resolved an issue where, in some cases, intrusion events displayed
incorrect VLAN ID information. (123696)
• Resolved an issue where, in some cases, access control policy apply did not
succeed on a cluster with both state sharing and Inspect Local Router Traffic
enabled. (123710)