How to downgrade sourcefire rules

[Nathan Burchett]

I was wondering what the process was to downgrade the VDB to an earlier version.  We are working on applying a backup but are unable to because the VDB build is currently 231 and needs to be 222.  Con someone help with this?

[Joel Esler]

There is a way to do this I believe. It can be done from the command line.  I don't know if it's documented in any manuals, you may want to contact support for steps to do this.  

[mnobile]

removed, replied directly to the initial query

[mnobile]

Hi Nathan,

Sourcefire Support does not recommend to rollback the VDB versions. It is possible under certain circumstances. However, I don't believe that will help you in this scenario, as you can only rollback one version at a time. Example: you can roll back from VDB 231 to VDB 229, but not VDB 231 to VDB 222. Sourcefire Support would advise to re-image the appliance and install VDB 222 specifically. VDB 222 won't be found on the support site(It has been archived), I have uploaded at the following link:

http://uploads.sourcefire.com/download/72fb962560022f01921da18a2dd48a83/20150223192010-Sourcefire_VDB_Fingerprint_Database-4.5.0-222.sh

If you have any questions, please let me know. Thanks!  

Regards,
Michael Nobile
Sourcefire, now part of Cisco

[Nathan Burchett]

I haven't been able to get this to load onto the machine.  it gives me the Error, "Exit [10] import failed"  What is that?

[mnobile]

Hi Nathan,

Can you provide a more verbose error? On the Defense Center please navigate to Analysis > Search.
The Search page appears. From the Table drop‑down list, select Rule Update Import Log. The page reloads with the appropriate constraints.

Regards,
Michael Nobile
Sourcefire, now part of Cisco

[st92]

Hi Nathan,

I am facing the same issue, the backup file which i need to restore is having 304 version and FMC is having 305 version so is there any way that i can degrade the 305 version to 304 to make it compatible with backup files.