topic I had this at one of my in Network Security

ASA-SSM-20 Error: AutoUpdate exception: HTTP connection failed

N3t W0rK3r — Sun, 10 Mar 2019 13:36:20 GMT

Autoupdate has been working for years, but now is not.

I have verified that the sensor is establishing a connection with the peer at https://72.163.4.161//cgi-bin/front.x/ida/locator/locator.pl

CCO creds have not changed.

What is going here? I have two sensors behaving this way, btw.

Thanks.

John

I had this at one of my

Marvin Rhoads — Wed, 27 Apr 2016 19:10:14 GMT

I had this at one of my customers. I dug into it and found the following:

Cisco updated their SSL certificates earlier this year to use SHA2 signed certificates. They are signed by a different Root CA (Verizon if I recall correctly) and the IPS system image needs to be updated to the latest version (7.3(5)) in order to trust the certificates from that root CA.

This is mentioned in the IPS 7.3(5) release notes:

http://www.cisco.com/c/en/us/td/docs/security/ips/7-3/release/notes/release7-3-5.html#pgfId-1381236

You need IPS 7.3(5) to use auto update, global correlation, and network participation after migration of the SHA-2 Certificates on the Cisco web sites.

Hello John,

Jetsy Mathew — Thu, 28 Apr 2016 08:38:27 GMT

Hello John,

Could you please specify what all auto updates you are referring to ? Is it includes the product updates and SRU updates also ?

Regards

Jetsy

Thanks Marvin... I will take

N3t W0rK3r — Thu, 28 Apr 2016 15:10:34 GMT

Thanks Marvin... I will take a look at this and see if it applies to my platform.

Cheers.

John

Hello Jetsy,

N3t W0rK3r — Thu, 28 Apr 2016 15:21:10 GMT

Hello Jetsy,

The updates I'm referring to are signature updates accessed via the URL referenced in the first message.

My platforms are ASA-SSM-20 and ASA-SSM-40. Running version 7.1(7)E4 on both IPS modules.

Thanks,

John