Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Signature auto update from Cisco.com - again

Hello,

Another auto update problem with Cisco.com...

We're using a ASA-SSM-10 with OS 6.2(1)E3.

We've discovered that the update is no longer working; we doesn't know precisely when it stopped to work.

What we know for sure, is that nothing in the topology is changed, and some time ago it worked.

Attached, the "sh statistics host" output.

These are the URL we tried, and the update results for each of them:

>https://198.133.219.25/cgi-bin/front.x/ida/locator/locator.pl

Auto Update Statistics

lastDirectoryReadAttempt = 12:00:01 UTC Mon Apr 06 2009

= Read directory: https://198.133.219.25/cgi-bin/front.x/ida/locator/locator.pl

= Error: http error response: 400

lastDownloadAttempt = N/A

lastInstallAttempt = N/A

nextAttempt = 13:00:00 UTC Mon Apr 06 2009

>https://198.133.219.25/cgi-bin/ida/locator/locator.pl

Auto Update Statistics

lastDirectoryReadAttempt = 14:00:03 UTC Mon Apr 06 2009

= Read directory: https://198.133.219.25/cgi-bin/ida/locator/locator.pl

= Error: http error response: 400

lastDownloadAttempt = N/A

lastInstallAttempt = N/A

nextAttempt = 15:00:00 UTC Mon Apr 06 2009

>https://198.133.219.25//cgi-bin/front.x/ida/locator/locator.pl

Auto Update Statistics

lastDirectoryReadAttempt = 13:00:35 UTC Mon Apr 06 2009

= Read directory: https://198.133.219.25//cgi-bin/front.x/ida/locator/locator.pl

= Error: AutoUpdate exception: Receive HTTP response failed [3,212]

lastDownloadAttempt = N/A

lastInstallAttempt = N/A

nextAttempt = 14:00:00 UTC Mon Apr 06 2009

Any idea?

Thanks a lot.

Marco.

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Signature auto update from Cisco.com - again

Set the URL back to the default.

The download URL has not changed.

Try setting the download time to be something like 13 minutes after the hour 00:13.

The majority of sensors are using the default download time exectly on the hour 00:00. Since most sensors are running NTP, this means the majority of the sensors world wide are all trying to get to cisco.com at the same time.

We think that there might be connection problems to cisco.com when this happens. Bu setting it several minutes after the hour it will be less likely to see congestion at cisco.com and less likely to have connection issues.

Also try connecting from your own desktop to cisco.com and using the same username and password your sensor is configured to use. Ensure that this username is still able to download IPS files from cisco.com.

You want to ensure that permissions for your username on cisco.com have not changed.

I am not positive that any of the above will solve your problem, but they are worth a try to eliminate some of the easy things.

6 REPLIES
Cisco Employee

Re: Signature auto update from Cisco.com - again

Set the URL back to the default.

The download URL has not changed.

Try setting the download time to be something like 13 minutes after the hour 00:13.

The majority of sensors are using the default download time exectly on the hour 00:00. Since most sensors are running NTP, this means the majority of the sensors world wide are all trying to get to cisco.com at the same time.

We think that there might be connection problems to cisco.com when this happens. Bu setting it several minutes after the hour it will be less likely to see congestion at cisco.com and less likely to have connection issues.

Also try connecting from your own desktop to cisco.com and using the same username and password your sensor is configured to use. Ensure that this username is still able to download IPS files from cisco.com.

You want to ensure that permissions for your username on cisco.com have not changed.

I am not positive that any of the above will solve your problem, but they are worth a try to eliminate some of the easy things.

New Member

Re: Signature auto update from Cisco.com - again

Hello,

It worked.

Thanks a lot for your precios support.

Marco.

New Member

Re: Signature auto update from Cisco.com - again

What exactly did you do to solve the problem ?  I'm having the same issue

New Member

Re: Signature auto update from Cisco.com - again

Hi,

Sorry to hijack this thread, but what are the actual Servers/IP's the IPS system contacts AFTER it calls Cisco? We see the call out to Cisco then it tried three other hosts right after and their IP's change. I assume these are some sort of local Akamai proxies for the update files?

Anyway since the IP's change we cannot allow these through the firewall.

Thanks

New Member

Re: Signature auto update from Cisco.com - again

I have same problem.

could someone please clarify the correct configuration for IPS auto update to cisco.com?

Re: Signature auto update from Cisco.com - again

Hello all,

This issue has been resolved. Please set your sensors' Auto Update URL to the default and allow the update to run again. Let us know if you continue to experience issues.

Thank you,

Blayne Dreier

Cisco TAC Escalation Team

**Please check out our Podcasts**

TAC Security Show: http://www.cisco.com/go/tacsecuritypodcast

TAC IPS Media Series: https://supportforums.cisco.com/community/netpro/security/intrusion-prevention?view=tags&tags=tac_ips_media_series

1758
Views
0
Helpful
6
Replies
CreatePlease to create content