Urgent ESA Issue - 2022-08-08-1
Incident Report for Security: Urgent Notices
Resolved
This incident has been resolved. For customers running ESA and SMA versions 14.x, there will be a banner on the GUI reminding to update the CPQ certificate via the provided workaround for the SMA (Secure Email and Web Manager). If you require further assistance, please contact the Cisco Systems Technical Assistance Center (TAC).
Posted Aug 09, 2022 - 13:03 EDT
Update
See below.
Posted Aug 08, 2022 - 17:54 EDT
Update
We appreciate our customers' patience and apologize for the duplicate updates. The latest status is that the investigation is complete and the source of the issue has been identified to be related to certificates for CPQ connectivity. Customers who are running SMA 13.x and higher must run the CLI command "updatepvocert" on the SMA to restore delivery of emails from ESA to SMA.
Posted Aug 08, 2022 - 16:39 EDT
Update
Investigation is complete and the source of the issue has been identified to be related to certificates for CPQ connectivity.
Posted Aug 08, 2022 - 16:26 EDT
Update
Investigation is complete and the source of the issue has been identified to be related to certificates for CPQ connectivity.
Posted Aug 08, 2022 - 16:20 EDT
Identified
Investigation is complete and the source of the issue has been identified to be related to certificates for CPQ connectivity.
Posted Aug 08, 2022 - 16:16 EDT
Investigating
Issue History:
2022-08-08 01:00 ET – Initial document created
2022-08-08 03:20 ET - Workaround section updated
2022-08-08 15:30 ET - Root cause identified, workaround/solution section updated

Problem Description:
Multiple customers have reported seeing connectivity errors between Cisco ESA and SMA impacting delivery of Policy, Virus and Outbreak Quarantine emails.

Problem Symptoms:
ESA will generate alerts as below
08 Aug 2022 xx:xx:xx Quarantine: Could not connect to the SMA xx.xx.xx.xx

Workaround/Solution:
Investigation is complete and the source of the issue has been identified to be related to certificates for CPQ connectivity.

Connectivity from the SMA to the ESA has been successfully addressed through a cloud update received at the ESA. To address the delivery of emails from the ESA to the SMA please issue the CLI command "updatepvocert" on SMA 13.x and higher. For customers running SMA 11.x or 12.x, please upgrade to 13.x or above.

For More Information:
If you require further assistance, or if you have any further questions regarding this issue, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

Open a service request on Cisco.com
By email
By telephone

Please follow the link below to stay updated on this incident using our community forum:
https://community.cisco.com/t5/security-urgent-notices/urgent-esa-issue-2022-08-08-1/ta-p/4665516
Posted Aug 08, 2022 - 01:04 EDT
This incident affected: General Maintenance.