Where to check for signature of VMS MC

corpsec · ‎03-12-2004

Since upgrading our sensors from IDS3x to IDS4x, we have not been able to update signature on our sensors using VMS MC1.2.3. We are getting "Sensor update for xxxx failed. The current version 4.1(3)S75 did not match the applied version 4.1(3)S76 after update.

We are now SSHing to the sensors and manually update the sig on each sensor.

Does anyone know where to check for signature version of VMS MC?

Deleting and re-adding the sensor does not solve the problem. Can you help.

TIA.

Simone.

paul.pearston · ‎03-15-2004

I’m experiencing a similar error having upgraded my IDS sensors manually from the command line before VMS was up and running, the signature version on the sensors now appear to be out of sync with the manager. Error is “The current version 4.1(3)S75 did not match an applied version”. However, I think that I’ve successfully added 4.1(3)S78?

When I try to apply the latest upgrade to the MC it appears to work in so much as I don’t receive and error messages. However, I don’t receive a success message either.

Did you find out how to check the IDS MC signature version? Anything else that may help me get round this problem?

Thanks

Paul

corpsec · ‎03-16-2004

Paul,

We are still waiting for the hero to help us out with IDS MC and IDS 4x sig deployment. Since upgrading our sensors from 3x to 4x we have not been able to deploy sig using VMS MC. The Audit report shows: "Sig update for sensor 123 failed. The current version Sxx did not match the applid version Syy after update".

xx = version of sensor and yy = version of MC.

We are still waiting for solution from Cisco.

Does anyone know how to check sig version on VMS MC or have a solution for this annoying problem.

To verify if the deployment works, run the audit report and also on the sensor type:

Show Version

Simone.

paul.pearston · ‎03-17-2004

Simone,

My sensors are new installs that shipped with version 4.x so I’m not sure that our symptoms are identical. However, Cisco doesn’t recommend that you upgrade your sensors local from the CLI using SCP or FTP which I did. To resolve the problem I had to downgrade the sensors from the latest signature update 4.1(3)s75 to the previous service pack release that I had applied 4.1(3)s61. I then re-applied the latest signature release to the sensors 4.1(3)s78 which resolved the problem.

With regards to the signature version applied to the IDS MC, create a dummy sensor manually within VMS and scroll down the version list to see the latest signature update that the console is aware off (don’t select discover settings)

Hope this helps

Paul

csmeriglio · ‎03-16-2004

I'm not sure if this will help, but you need to make sure the MC is running the highest level expected to support any of your sensors(if running different levels), prior to trying to apply a sig-update to your sensors from the MC. So if all your sensors are running S78, then you need to upgrade the MC to S78 first. If this was not the case, you may have to delete the sensors from the MC, apply the update to the MC, and then add the sensors back.