Discrepancy between SNTC portal and the Collector regarding IOS firmware version

[Bill Cameron]

I am seeing what appears to be a discrepancy between the SNTC portal and the Collector regarding IOS firmware version on multiple devices.  

This is a problem because we get false positive PSIRT alerts for devices that SNTC thinks have outdated IOS firmware and thus, associated vulnerabilities, but when we check the device locally via CLI or even as it is found in the collector, the actual firmware version is later (and as a result not vulnerable) which leaves us with false positive alerts in SNTC.  

For example,  we have a device running IOS version 15.1(4)M10, and it is shown correctly in the Collector, but SNTC portal erroneously thinks it is old with 15.1(4)M.  Collector discovery and SNTC Inventory updates appear to be current.

Is this an SNTC bug or is there a way to override SNTC at the device level so we can manually correct the firmware version to suppress these false positives? 

[asingadi]

Hi Bill ,

Thanks for reaching out to cisco .

I am checking this issue , will update you soon.

Thanks,

Anusha.

[asingadi]

Hi Bill,

I  tired to check your request but i am  facing a issue because of multiple inventories.

Could you please provide me the exact inventory name where ur facing the issue .

Thanks,

Anusha.

[Bill Cameron]

Hi Anusha,

I am using the following inventory:

1.) Inventory > Regents...

2.) Segment > VoIP

3.) All PSIRTs

However, upon spot checking these now, I am unable to to find a discrepancy.  Please keep this thread open for another couple weeks though, since we are upgrading our IOS devices this weekend.  Then we can verify if SNTC is getting updates from collector as expected regarding IOS version.  Thanks for looking into this.

[asingadi]

Hi Bill ,

Sure , I will keep the thread open . Once the upgrade is done we can cross verify the issue.

Thanks,

Anusha.