topic Hi Sir Rhomel, in Network Security

Sourcefire IPS 7120 failed to Upgrade Version

ralphbuot10 — Sun, 10 Mar 2019 13:45:47 GMT

Hi Everyone,

I have some trouble upgrading the Cisco SourceFire IPS 7120

I had a V.M Firesight version 5.4.1.3 and a Demo unit of IPS 7120 version 5.4.0.4
with IP of x.x.x.11

And now the actual unit of IPS 7120 version 5.4.0.1 with IP of x.x.x.12
is already inline on their production network accessible by Firesight
management.

I tried to update it to 5.4.0.4 but Error occur.

Please see attach file for the error.

Thank you in advance.

Hi Ralph,

rhomelvincenthalog — Tue, 07 Feb 2017 12:23:13 GMT

Hi Ralph,

1. Does it have FMC registered to it? If no, try to register to a FMC first, then from the FMC, upgrade it.

2. Does it have access control policy applied? try to apply at least System, Health & default Access Control Policy. that should work.

Vincent H.

Log into the cli of the 7120

Marvin Rhoads — Tue, 07 Feb 2017 15:20:56 GMT

Log into the cli of the 7120 and navigate to the /var/log/sf directory.

There should be a subdirectory for the attempted upgrade(s). Go into it and "tail status.log". The last entry there will tell you exactly where the failure occured. It may point to a further subdirectory and you can navigate there for even more details.

Most commonly, very old sensors are running Snort rules that are too out of date. Re-applying a current policy set with associated definitions from the managing FirePOWER Manager usually remedies that issue. (Vincent's recommendation takes care of that.)

Hi Sir Rhomel,

ralphbuot10 — Wed, 08 Feb 2017 07:38:52 GMT

Hi Sir Rhomel,

Yes the Sourcefire Sensor is registered to FMC and try to upgrade it thru FMC, I also try to local upgrade accessing my Sourcefire sensor but stil Upgrading failed.

I'll try to apply those policy before I upgrade.

Many Thanks,

Ralph

Thank you for this

ralphbuot10 — Wed, 08 Feb 2017 07:44:07 GMT

Thank you for this knowledgeable commands.

I'll try what Sir Vincent advice as what you also recommend, monitor it on CLI if the error will occur again and what will be the error.

Thank you.

Ralph