Ironport C170 The Anti-Virus database on this system is expired

[mpoloq]

Hi,

We have a problem with our IronPort device. Both Sophos Anti-Virus files and IronPort Anti-Spam rules are outdated. They stopped processing between 10-12.10.2017. Feature keys are up to date. The update now option is not giving any results, i also tried to force the update. Device was rebooted month ago but it did not resolve the problem,

Any help will be really appreciated,

System Status:
Online

Status as of:
05 Jan 2018 14:40 (GMT +01:00)

Up Since:
09 Dec 2017 15:45 (GMT +01:00)
(26d 22h 54m 39s)

Oldest Message:
2 days 16 hours 27 mins 15 secs

Model:
C170

Operating System:
8.0.1-023

Build Date:
14 Oct 2013 00:00 (GMT +02:00)

Install Date:
17 Feb 2017 12:45 (GMT +01:00)

I forced the update

XXXXXXXXXXXXX> avupdate force

Sophos Anti-Virus updates:
Requesting forced update of Sophos Anti-Virus.
McAfee Anti-Virus updates:
McAfee Anti-Virus scanning not enabled. McAfee virus definitions not updated

tail updater_logs

Press Ctrl-C to stop.
Fri Jan 5 14:36:02 2018 Info: cloudmark waiting for new updates
Fri Jan 5 14:36:02 2018 Info: postx waiting for new updates
Fri Jan 5 14:36:02 2018 Info: timezones waiting for new updates
Fri Jan 5 14:36:02 2018 Info: sophos waiting for new updates
Fri Jan 5 14:36:02 2018 Info: mcafee waiting for new updates
Fri Jan 5 14:36:02 2018 Info: dlp waiting for new updates
Fri Jan 5 14:36:02 2018 Info: openssh_key waiting for new updates
Fri Jan 5 14:36:02 2018 Info: repeng waiting for new updates
Fri Jan 5 14:36:02 2018 Info: Started handler for updates; updates are now star ted
Fri Jan 5 14:36:02 2018 Info: Received remote command to signal a manual update
Fri Jan 5 14:36:33 2018 Info: Scheduled next update to occur at Fri Jan 5 15:3 6:33 2018

[Ken Stieers]

You HAVE to upgrade.

8.0.1  was eol'd, the last day you could get any support on it at all was October 31, 2016.

https://www.cisco.com/c/en/us/products/collateral/security/email-security-appliance/eos-eol-notice-c51-738362.html

I'd go to at least the 10.x code train...

The last code that will be supported on the C170 is 11.0.

https://www.cisco.com/c/en/us/products/collateral/security/web-security-appliance/eos-eol-notice-c51-737103.html

[Robert Sherwin]

Correct - as Ken stated, you'll need to upgrade the appliance to 9.0+, preferably 9.7+.

We shut down feeds and updates for EoL AsyncOS releases. 

[mpoloq]

Ken, Robert,

Big thanks for your answer! Do you have any instruction how to complete such upgrade? Can i upgrade to the latest version directy or need to upgrade to lower version first?

Thanks

Mateusz

[Robert Sherwin · Accepted solution]

From your appliance, it may be needed to go through several upgrades hops, since you are on 8.0.1.

You can follow best practices for upgrade from the following:

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117793-technote-esa-00.html