topic Re: No AutoUpdate feature working on ASA-SSM-20 in Network Security

No AutoUpdate feature working on ASA-SSM-20

ConfederacionHJ — Sun, 10 Mar 2019 12:10:51 GMT

Hi!

Autoupdate feature is not working on ASA-SSM-20 module.

We have configure:

https://www.cisco.com//cgi-bin/front.x/ida/locator/locator.pl

And/Or:

https://198.133.219.25//cgi-bin/front.x/ida/locator/locator.pl

And/Or:

https://www.cisco.com/cgi-bin/front.x/ida/locator/locator.pl

And/Or:

https://198.133.219.25//cgi-bin/front.x/ida/locator/locator.pl

We get this errors on the ASA-SSM-20 module:

evError: eventId=1280563964539644086 vendor=Cisco severity=error
originator:
    hostId: sensor1
    appName: mainApp
    appInstanceId: 356
time: nov 17, 2010 08:15:45 UTC offset=60 timeZone=GMT+01:00
errorMessage: AutoUpdate exception: Receive HTTP response failed [3,212] name=errSystemError

evError: eventId=1280563964539644079 vendor=Cisco severity=error
originator:
    hostId: sensor1
    appName: mainApp
    appInstanceId: 356
time: nov 17, 2010 08:10:02 UTC offset=60 timeZone=GMT+01:00
errorMessage: http error response: 400 name=errSystemError

Any Ideas?

Re: No AutoUpdate feature working on ASA-SSM-20

Jennifer Halim — Wed, 17 Nov 2010 08:46:38 GMT

How is your ASA SSM module connected? The port on the module needs to be connected to your network, and that needs to have Internet connectivity. You would need to check that the ip address/subnet assigned for your module is NATed on the ASA (if the ASA is the default gateway to the Internet), and if you have any access-list that would also need to allow the traffic.

The correct auto update URL is:

https://198.133.219.25//cgi-bin/front.x/ida/locator/locator.pl

(ie: the second and forth URL you posted earlier).

Re: No AutoUpdate feature working on ASA-SSM-20

ConfederacionHJ — Wed, 17 Nov 2010 08:54:50 GMT

Hi!. The module is connected and has network connectivity. They have an external NTP server configured and this is working fine. On the ASA has a rule to allow http/https/ntp conectivity and the ASA reflects connections, also Global Correlation is working OK (update-manifest.ironport.com) ....but ... If connected directly to the IPS via SSH and tried to ping and/or trace to any external IP network (internet) has no response

But if I sniff with Wireshark on internal and external interfaces of the ASA, I see traffic flowing between IPS and 198.133.219.25 server. Here's a snapshot of wireshark

Re: No AutoUpdate feature working on ASA-SSM-20

Jennifer Halim — Wed, 17 Nov 2010 09:50:29 GMT

What is the version of the SSM module, and also what is the current signature pack? I am assuming that your SSM module license has not expired yet.

Re: No AutoUpdate feature working on ASA-SSM-20

ConfederacionHJ — Wed, 17 Nov 2010 09:56:38 GMT

Product ID: ASA-SSM-20

Version: 7.0(4)E4 (650 days)

License Expiration Date: 29/08/2012

Actual Signature Version on ASA-SSM-20: S530 (updated via manual download to a PC and manual upload to ASA-SSM-20 via IME option)

Actual Signature Version Release: S531

Re: No AutoUpdate feature working on ASA-SSM-20

Jennifer Halim — Wed, 17 Nov 2010 10:59:02 GMT

Well, the license has expired (expired: 29/08/2010), that is why auto update does not work anymore. You would need to purchase the subscription license to be able to update the signature pack to the latest.

Re: No AutoUpdate feature working on ASA-SSM-20

ConfederacionHJ — Wed, 17 Nov 2010 11:03:37 GMT

Sorry, I made a mistake typing the date

29/08/2012

Re: No AutoUpdate feature working on ASA-SSM-20

Jennifer Halim — Wed, 17 Nov 2010 11:28:55 GMT

Was the auto update feature working previously?

Can you also confirm that the CCO account that you use works fine by going to www.cisco.com and try to download the signature pack manually.

Can you also check that the time on the IPS itself is correct (I understand that you sync it to an NTP server), but just want to double check if it does sync correctly and the time is correct on the IPS itself, and it's in the correct timezone, and the auto update schedule time is set to the same timezone.

Re: No AutoUpdate feature working on ASA-SSM-20

ConfederacionHJ — Wed, 17 Nov 2010 11:39:16 GMT

1. No, autoupdate feature never worked .... we have tried several times, and we are trying to make it work now again.

2. CCO account if working fine, we are using it to manually download signatures from:

http://www.cisco.com/cisco/pub/software/portal/select.html?&mdfid=282671829&flowid=4417&softwareid=282549755

3. Yes, time on both IPS (we have two of them) is correct and syncronized with NTP server: 150.214.94.5 Timezone is the same on the Sensor Setup->Time configuration tab and the same is set on the Autoupdate Schedule time (GMT+1)

Re: No AutoUpdate feature working on ASA-SSM-20

Scott Fringer — Wed, 17 Nov 2010 12:03:53 GMT

There is currently an open issue with automatic IPS updates on some platforms. Work is being performed internally to correct the issue.

For the current time you will need to manually apply signature updates.

Scott

Re: No AutoUpdate feature working on ASA-SSM-20

ConfederacionHJ — Wed, 17 Nov 2010 12:08:47 GMT

Ok. If you/they need something, like Wireshark Captures, or run some test or something else, please let me known.

Thank you all!!!!!

Re: No AutoUpdate feature working on ASA-SSM-20

Rodrigo Gurriti — Wed, 17 Nov 2010 17:10:40 GMT

Scott Fringer

Is there a problem with the website or the platform ?

Are appliances 42xx affected ?

My 4260 is showing the same symptoms, my auto update was working before. While my 4260 isn't working my MARS is flying on the updates.

I'd posted on this:

https://supportforums.cisco.com/message/3228033#3228033

Re: No AutoUpdate feature working on ASA-SSM-20

Scott Fringer — Wed, 17 Nov 2010 17:14:07 GMT

Rodrigo;

The issue is affecting specific platforms (the 4200 series appliances are affected).

Efforts are still underway to correct the issue. Until that time you can manually update the IPS signatures, or await word that the issue has been addressed.

Scott

Re: No AutoUpdate feature working on ASA-SSM-20

Rodrigo Gurriti — Wed, 17 Nov 2010 19:20:43 GMT

Is there a Bug ID?

Re: No AutoUpdate feature working on ASA-SSM-20

Scott Fringer — Wed, 17 Nov 2010 19:23:31 GMT

Rodrigo;

There is a not a bug ID as the issue is not with the IPS software/hardware itself. The IPS software is functioning as designed.

Scott

Re: No AutoUpdate feature working on ASA-SSM-20

Rodrigo Gurriti — Wed, 17 Nov 2010 19:26:02 GMT

Is the problem on the web platform ?

Re: No AutoUpdate feature working on ASA-SSM-20

Scott Fringer — Wed, 17 Nov 2010 19:30:23 GMT

Rodrigo;

I cannot speak directly to the exact cause of the issue as it is being addressed by the business unit; but they have confirmed it is not a functional defect in the IPS software.

Scott

Re: No AutoUpdate feature working on ASA-SSM-20

pascal_parrot — Wed, 17 Nov 2010 21:10:21 GMT

Scott,

Do you have a list of devices that are affected? Are the ASA-SSM-10 and ASA-SSC-AIP-5 affected?

Pascal

Re: No AutoUpdate feature working on ASA-SSM-20

Scott Fringer — Thu, 18 Nov 2010 11:17:56 GMT

Pascal;

At this time there is not a definitive list of the affected platforms.

Scott

Re: No AutoUpdate feature working on ASA-SSM-20

Christopher Dreier — Fri, 19 Nov 2010 04:49:38 GMT

Hello all,

This issue has been resolved. Please set your sensors' Auto Update URL to the default and allow the update to run again. Let us know if you continue to experience issues.

Thank you,

Blayne Dreier

Cisco TAC Escalation Team

**Please check out our Podcasts**

TAC Security Show: http://www.cisco.com/go/tacsecuritypodcast

TAC IPS Media Series: https://supportforums.cisco.com/community/netpro/security/intrusion-prevention?view=tags&tags=tac_ips_media_series