Forum Discussion
VB_95896
Nimbostratus
NimbostratusAttack signature disappeared
Hi,
My attack signatures disappeared !!!
My situation = 2 units “Big-IP ASM" (platform "4100") running version "9.4.5" (+ Hotfix “HF2”) in an Active-Active configuration (HA pair with CMP enabled).
I tried to recover my attack signatures by a "manual update" based on a download of the latest Signature set from downloads.f5.com (I selected "v 9.4.5" and then file "ASM-LatestSignatureFile" dated 10/15/2008 ...)
After that update, I could recover the "system-specific" signatures (for example : "Systems: IIS") but could not find my "system-supplied" signature sets. In particular, when going to Policy > Attack Signatures > Available Signature Sets, I used to see the 3 following sets :
- "Generic Detection Signatures",
- "OWA Signatures",
- "All Signatures".
I can't see them anymore.
Any information is welcome !
VB
hoolioCirrostratus
Hi VB,
I'd suggest opening a case with F5 Support on this. The forums on DC aren't really a good place for this level of troubleshooting.
Aaron- AaronJB
SIRT
If you installed a UCS from v9.4.4 or v9.4.3 onto this unit at some point then it's highly likely this is CR 108866.
Unfortunately there's no publically downloadable resolution for this CR at the moment, but if you contact F5 Support we can make available a HotFix for v9.4.5.
Sadly, in order to resolve this, you need to install the HotFix before you load the UCS from the earlier version - so at the stage you have found yourself the only fix is to (as you have done) load the signatures again manually and then manually create signature sets as needed.
To have a full fix you would need the HotFix (or the next release of the software, once it is available), a clean installation and then go ahead and re-load your v9.4.4/3 UCS.
There will be a solution published about this shortly on AskF5.
Aaron
