IPS module will not download signature updates.

[rosswmerrifield]

Hello all,

I have a Cisco ASA 5512-X with the IPS module/processor. I am trying to get the device to download signature updates but am encountering problems. I have entered a valid cisco.com user account into the GUI to enable this feature, but the updates never actually download.

Is there a way to manually apply the signature updates?

why won't the updates download automatically? The device can ping public servers such as 8.8.8.8

Please let me know if there is smoehting I am doing wrong, or if you would like configuration details/show command out put etc. Everything else seems to be working fine, traffic is actively being passed through the sensor.

Thank you very much,

-Ross Merrifield

[hausherrs]

Updates take place over port 80. You should make sure that port 80 is open between the sensor and the internet. If you have a web filter such as Websense or some sort of internet proxy the port 80 updates will probably be blocked. You need to exempt the sensor in the firewall rule that sends all http requests to Websense for permission or put a rule in the websense to allow the sensor.

Thanks,

Steven

[rosswmerrifield]

Port 80 is not blocked. Do the updates download through the management interface only or can they be downloaded from any interface? In my current setup, the management interface cannot route to the internet. Only one of the GE interfaces can communicate over the internet.

[hausherrs · Accepted solution]

The IPS management address needs to be able to get to the internet. So make sure routing is in place. There is not a way to get it use any other interfaces, that I am aware of.

Thanks,

Steven

[Julio Carvajal]

Hello Ross,

what DNS server are you using?

[rosswmerrifield]

DNS server is google (8.8.8.8)

Routing was the issue. This thread can be closed.

[Julio Carvajal]

Great..