MARS: IPS Signature Dynamic Update Failed

[ttran]

Hello all,

I checked the signature update on the MARS system and it has no update for over 6 months.  My bad.  I should checked this regularly.

So I tested the connectivity and it said successful.  Did the update now and failed:

Download Failed: CS-MARS could not download IPS Signature file - IPS-CS-MARS-Sig-S482.zip
at Apr 09, 2010 11:51:42 AM EDT

It seems it does see the new signature out there but the down load failed not sure why.  I manually down load the signature and SSH to

the box manually did the pnupgrade using ftp and also got error:

CSMARS Upgrade...........[1126]
Loading..................[IPS-CS-MARS-Sig-S481.zip]
    User.................[myID]
    Protocol.............[ftp]
    Host.................[x.xx.xx.xx]
    Path.................[CiscoIOS/IPS-CS-MARS-Sig-S481.zip]
    Modified.............[Thu, 08 Apr 2010 13:19:11 GMT]
    Size.................[632711]
######################################################################## 100.0%
[Alert][get_pkg_info/223]: no IPS-CS-MARS-Sig-S481.zip package info.
[Alert][main/265]: fail to find IPS-CS-MARS-Sig-S481.zip version info.
Strip Meta Data..........[IPS-CS-MARS-Sig-S481.zip]
Decrypt Package..........[IPS-CS-MARS-Sig-S481.zip]
[Error][decrypt_pkg/181]: fail to decrypt IPS-CS-MARS-Sig-S481.zip(2).

So from there may be file was corrupted so I did the same for S480, S479, S478 and got same error.

Checked the thread in the community and follow the same step that in the threat and I am still geting no where.

Case is opened and still going no where.

If anyone ran into this problem before and had a solution for this is appreciated.

Thank you.

[Jennifer Halim · Accepted solution]

It does not support manually downloading the file and perform the update.

Please use either local web server or direct connection to cisco.com site from the MARS as follows to update the IPS signature:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/device/configuration/guide/chIpsCisoc6x.html#wp440709

Hope that helps.

[ttran]

Thank you for your answer.  I do not have local web server for this so I am trying to find out if I can get a spare server setup for the IPS update.

Not sure when.  I read and followed the webpage to do the down load and changed many different URL still no good.

Now just have to wait for the local webserver.

[ttran]

Using local web server and update signature fine.

Thank you for your help.