Sig 153 doesn't work with IDM ?

[alian-sam]

I upgraded to the S153 signature , and then couldnt login to the IDM getting an error about unable to download signature configuration.

I restarted the IDSM2 and the issue still there , i downgraded to S150 and i can access the IDSM2 using the IDM now .

please your help appreciated.

thanks

[derwalke]

Hi,

Could you provide me with more information? re:

-software version of sensor prior to the upgrade: was it 4.x or 5.x?

-your upgrade was from 150->153, correct?

-what hardware platorm is this on?

-what is the general load of the sensor (amount and type of traffic)?

We haven't heard of any other problems with this release so I'd definitely like to figure out how to get you flying right. Also, have you tried again since the first upgrade (just in case it was an odd, unreproducable error)?

D.

[alian-sam]

D.,

I am using IDSM2 module with the 6513 chasi , the version IPS 5.01 and i was upgrading from S150 to S153.

as john mentioned , i will be able to authenticate and login using the IDM but them kick me out and exit because of that error.

[derwalke]

Great, that helps a bunch.

To help trouble shoot this, I'd like to see what happens to the config files on your sensor when it rejects the configuration. So ideally, I'd like you to attempt the upgrade again and let it fail. Then I need you to grab some files for me before you revert it to S150 again.

If you don't have one already, setup a service account so you can log directly into the sensor's underlying shell. From the CLI:

sensorname(config)# username service privilege service

Then you can log out and login again as service@sensor via ssh.

Once in:

cd /usr/cids/idsRoot/etc/config/signatureDefinition/

grab: default.xml and typedefs.xml

then go down to:

cd instances

and grab: sig0.xml

=====

Once you have those three files you can send them to me, derwalke@cisco.com, and we'll take a look at them for possible problems for you.

[derwalke]

We've now identified a problem with the S153 and S154 releases. This has been corrected in the S155 release posted yesterday afternoon. Upgrading to it should resolve your current issue.

[oconnelj]

I had the same problem with our IDSM2(which is a POS!). I used the updates function in IDS MC(which is also a POS!). During the update, I specified that our IDSM2 be updated with s153. After I came back, I couldn't log into the sensor. It would accept the login credentials, show PART of the login banner, sit there for 5 minutes and then I'd loose my connection. I shutdown the module with the shutdown module, reset the mod from the switching portion, waited, and after resetting it, it still did the same thing. So, I went back to IDS MC after rebooting the IDSM2, and re-deployed the s153 update to VMS and the IDSM2. This seemed to do the trick and now I can get to it again.

Gotta love the mediocrity of the Cisco IDS implementation. Will Cisco IPS be as crappy??? I've had nothing but problems with VMS IDS MC, the IDSM, AND the IDSM2.

-john