10-20-2008 11:26 AM
I noticed my MARS box is at signature level 358 released in mid Sept. I am using auto updates. The latest IPS signature release is 361. Any ideas why there is a delay for MARS to support the new signatures?
Mars is roughly a month behind. I don't check Mars' signature status regularly, so this could be the norm.
10-20-2008 09:32 PM
I had been checking one of our boxes quite frequently since the past few months and it almost always updated within 1-2 days of the signature release (IPS).
However I just checked now after looking at your post, and ours was also stuck at 358! I did a manual "Update Now" and it took me to:
Download Succeeded: CS-MARS downloaded IPS Signature file - IPS-CS-MARS-Sig-S360.zip
at Oct 21, 2008 08:34:16 AM
I wonder what is causing this.
Regards
Farrukh
10-21-2008 04:05 AM
Interesting. Sometime between my post and your post, MARS IPS S360 and S359 were posted. I guess the Cisco MARS team is a little behind.
10-21-2008 04:17 AM
Yup you are right, they were both release on oct 20:
http://www.cisco.com/cgi-bin/tablebuild.pl/mars-ips-sigup
It seems the XML is broken from Cisco, if I put the MARS update URL in the browser I get:
https://www.cisco.com/cgi-bin/ida/locator/locator.pl
-
-
Whereas previously it would give a URL for the CCO download page AFAIR.
Also after seeing the above URL it seems a gap of 10-15 days between IPS and MARS signature releases is common.
Regards
Farrukh
10-29-2008 03:21 PM
Hi,
There was an issue with the process that was to get the XML updates for the signature posted. That has been corrected and the signature updates were posted over the past weekend.
The MARS IPS signature updates should post to CCO approx. 24 hours after new IPS updates post.
Raymond
12-18-2009 09:48 PM
We are facing the same issue again with MARS signature updates, anybody else facing the same issue?
MARS Version: 4.3
GUI Error:
Download Failed: CS-MARS could not download IPS Signature file
at Dec 19, 2009 03:46:13 AM AST
If I manually put the MARS update URL in the browser:
xml version="1.0" encoding="UTF-8" ?>
Regards
Farrukh
01-11-2010 11:19 AM
We used to get this error as well, until I found this new URL embedded in MARS documentation:
https://www.cisco.com/cgi-bin/front.x/ida/locator/locator.pl
Works ok for us now.
01-11-2010 11:26 PM
Excellent, works now
01-18-2010 07:45 AM
My MARS broke on December 2nd. I'm using the new URL and I get the same output as farrukh noted.
"This XML file does not appear to have any style information associated with it. The document tree is shown below.
−
−
back to manual updates :-(
01-18-2010 12:38 PM
Even tough I kept seeing the same input..parsing errors in the browser for the new link. it worked when I entered it into MARS! However the websites/IPs used by MARS to update the packages from the Cisco website have changed. So if you have a firewall blocking those, you might have to fix that.
Regards
Farrukh
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide