Forum Discussion

VB_95896's avatar
VB_95896
Icon for Nimbostratus rankNimbostratus
Nov 24, 2008

Attack signature disappeared

Hi,

 

 

My attack signatures disappeared !!!

 

 

My situation = 2 units “Big-IP ASM" (platform "4100") running version "9.4.5" (+ Hotfix “HF2”) in an Active-Active configuration (HA pair with CMP enabled).

 

 

I tried to recover my attack signatures by a "manual update" based on a download of the latest Signature set from downloads.f5.com (I selected "v 9.4.5" and then file "ASM-LatestSignatureFile" dated 10/15/2008 ...)

 

 

After that update, I could recover the "system-specific" signatures (for example : "Systems: IIS") but could not find my "system-supplied" signature sets. In particular, when going to Policy > Attack Signatures > Available Signature Sets, I used to see the 3 following sets :

 

 

- "Generic Detection Signatures",

 

- "OWA Signatures",

 

- "All Signatures".

 

 

I can't see them anymore.

 

 

Any information is welcome !

 

 

VB

 

app sec
BIG-IP Access Policy Manager (APM)
security

2 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Nov 24, 2008
    Hi VB,

     

     

    I'd suggest opening a case with F5 Support on this. The forums on DC aren't really a good place for this level of troubleshooting.

     

     

    Aaron
  • AaronJB's avatar
    AaronJB
    Icon for SIRT rankSIRT
    Dec 03, 2008
    If you installed a UCS from v9.4.4 or v9.4.3 onto this unit at some point then it's highly likely this is CR 108866.

     

     

    Unfortunately there's no publically downloadable resolution for this CR at the moment, but if you contact F5 Support we can make available a HotFix for v9.4.5.

     

     

    Sadly, in order to resolve this, you need to install the HotFix before you load the UCS from the earlier version - so at the stage you have found yourself the only fix is to (as you have done) load the signatures again manually and then manually create signature sets as needed.

     

     

    To have a full fix you would need the HotFix (or the next release of the software, once it is available), a clean installation and then go ahead and re-load your v9.4.4/3 UCS.

     

     

     

    There will be a solution published about this shortly on AskF5.

     

     

     

    Aaron