cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
487
Views
0
Helpful
1
Replies
Beginner

vs0 getting deleted and added

- ASA 5525 with Software IPS

What could be the reason for ASA throwing this syslog everyday exactly when the signatures are configured for auto-update:

%ASA-6-420005: Virtual Sensor vs0 was deleted from the AIP SSM

As per Cisco documentation, vs0 cannot be deleted.

Immediately after the above message, following message is generated:

%ASA-1-323006: Module ips experienced a data channel communication failure, data channel is DOWN.

Then, after around a minute, following syslog is generated telling that vs0 was added back to the IPS:

%ASA-6-420004: Virtual Sensor vs0 was added on the AIP SSM

And finally, we get following syslog showing that IPS module is back up:

%ASA-1-505011: Module ips data channel communication is UP

So, it looks like that somehow, vs0 gets deleted from the IPS module which results in IPS experiencing data channel communication failure. Then vs0 automatically gets added back and IPS comes back up.

The cycle of above syslogs is seen daily at the same time.

Please note that we don't have license present on the IPS module.

So, it looks like this is what could be happening:

- At configured update time everyday, the IPS module tries upgrading the signature. The signatures get downloaded successfully and when IPS module tries to apply them, it realizes that the license is missing, so it tries to roll back and that’s when all those messages start coming up (even though still vs0 shouldn’t have been deleted)

Am I understanding it right?

1 REPLY 1
Highlighted
Cisco Employee

vs0 getting deleted and added

Hi,

I just saw a case were the issue was cleared after installing the license.

And you are right ablout how auto-update works.

Please update the license; if the issue persists let us know.

HTH

Luis Silva

"If you need PDI (Planning, Design, Implement) assistance feel free to reach"

http://www.cisco.com/web/partners/tools/pdihd.html

Luis Silva