Automatic Applying Intrusion Policies to multiple sensors at same time.

[mahesh18]

Hi Everyone,

Under System

Updates

Rule updates

On Defence center 750 we have enabled the option to download new rules and apply the policies  automaticall to all sensors.

But lately i am seeing that policie apply on sensor is failing.

It will apply on one sensor and fail on rest.

But when i apply them manually one at a time then it worked fine.

I also open the case with cisco tech as per him we should apply policies manually one at a time?

Does anyone know what else i can check to fix this issue?

Regards

Mahesh

[Marvin Rhoads]

Mahesh,

Have you setup your sensors in a device group? See FireSIGHT System User Guide, section on "Adding Device Groups".

[mahesh18]

Hi Marvin,

Not they are not setup in groups.

When i go to Devices,Device Management i see them ungrouped .

Regards

MAhesh

[Marvin Rhoads · Accepted solution]

Hmm. I think whether or not they are in groups, the policy should reapply if you have slected the box to do so (and the update isn't already in place). That's how it works on mine.

What does your rule update log tell you (filter on action = apply)? Mine shows the apply action taking place as configured (open image in new tab to zoom):

[mahesh18]

Hi MArvin,

Under Rule update log i see error under action.

When i click on error then new window opens up that shows

2015-08-10 00:00:25

/var/sf/SRU/Sourcefire_Rule_Update-2015-08-06-001-vrt.sh

SRU Import

error

Already Installed

1

Earlier Rules which were applied to policies shows action as changed.

Regards

Mahesh

[Marvin Rhoads · Accepted solution]

So it's telling you "Already Installed". We see this when we check for updates daily yet the updates are only released more or less weekly. It won't install an update that's already installed.

Perhaps the message could be a bit more informative at the top level but your log show the root cause is of no concern.

[mahesh18]

Many thanks Marvin.

Regards

Mahesh