Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

S492 : Bad Custom Signature ID ... [5577]

Hi,

I've implemented signature update S492, but apparently there is a problem with the new signature 5577.1 : SMB Secure NULL Login Attempt . During the upgrade process run from our CSM V3.3.1, the deployment manager returns an error :

instance=sig0:unspecifiedError:Bad Custom Signature ID ... [5577].  Can not create a custom signature with sig-id < 60000

When I verifie on the sensors themselves, this new signature is nowhere to be found.

Best regards.

3 REPLIES
Cisco Employee

Re: S492 : Bad Custom Signature ID ... [5577]

Signature# 5577 is a new signature from s492 signature update:

http://www.cisco.com/web/software/282549755/34252/IPS-sig-S492.readme.txt

Do you happen to have a custom signature with sig# 5577 by any chance?

If you don't, then you might want to open a TAC case as it might be a new bug.

Community Member

Re: S492 : Bad Custom Signature ID ... [5577]

No, we don't have such custom signature. Moreover I think custom signatures start from 60000 ; so I suppose there should be something wrong with this new subsig. I'll open up then as you advise a support call.

Cisco Employee

Re: S492 : Bad Custom Signature ID ... [5577]

Yes, please go ahead and open a TAC case. Thanks.

556
Views
0
Helpful
3
Replies
CreatePlease to create content