Signature S371 Update Error

[afnosc.nsd]

I'm trying to update my sensor to S371 and receive the following errors. I am updating from a VMS director to a 4240 appliance. I was able to update to S370 successfully. Any help is appreciated.

I am attaching the test in a file in case of word wrap mangling.

ERROR MESSAGE FROM VMS DIRECTOR:

Sensor my-sensor: Signature Update Process

Exception during sensor reimaging: The sensor rebooted with version 5.1(8)E3S370

instead of the expected version 5.1(8)E3S371 but no error was reported during the

update.

Error(s) encountered during sensor update, this sensor update is aborted.

Error(s) encountered during sensor update, this sensor update is aborted.

===================================================================================

ERROR MESSAGE FROM SENSOR CONSOLE:

Broadcast Message from root@my-sensor

(somewhere) at 18:26 ...

Applying update IPS-sig-S371-req-E3

Broadcast Message from root@my-sensor

(somewhere) at 18:26 ...

Error sending sensorApp control transaction. Restoring old signatures.

Broadcast Message from root@my-sensor

(somewhere) at 18:26 ...

Update complete

Broadcast Message from root@my-sensor

(somewhere) at 18:26 ...

Un-installing IPS-sig-S371-req-E3.

Broadcast Message from root@my-sensor

(somewhere) at 18:27 ...

Un-install complete.

[wsulym · Accepted solution]

Yes, it is a bad package, not just a problem on your side.

In the process of removing it right now.

I'm not sure of your setup, but the s371 sensor package from here:

http://www.cisco.com/cgi-bin/tablebuild.pl/ips6-sigup

can be used to update your sensor(s). this would however leave you with an out of sync sensor version to CSM sensor version issue.

[gdntidseng]

Could someone tell me how would I go about unloading/disregarding S371 signature pack that has been committed to the CSM and how is pending to be deployed for the sensor?

[RicheeJJJ_2]

You could try rediscovering the device in CSM. This may or may not remove all undeployed configs after you rediscover and redeploy.

[craig.lepchenske]

When will this fix be available for CSM? I have 95 sensors to do, and I would rather not manually update them all.

[wsulym]

s372 should be out today.

s372 will contain a couple additional signatures. it is in essence the next update and not a re-package of s371.

you will not need to install s371 then s372, you'll only need to update with s372.