Description

This article explains how to revert to a previous IDP Signature Attack Database using the Command Line Interface.

For information about reverting to a previous IDP Signature Attack Database from Security Director, see: KB27835 - [Junos Space] How to revert to an earlier IDP Signature Attack Database using Security Director [juniper.net] .

Symptoms

If problems are encountered after downloading and installing the latest IDP Attack Database, a workaround is to revert to a previously known working IDP Attack Database.

Solution

Perform the following steps:

  1. Collect the IDP related logs if a case needs to be opened with your technical support representative. Refer to KB21781 - [SRX] Data Collection Checklist - Logs/data to collect for troubleshooting [juniper.net]  to collect the necessary information. The next steps may apply differently based on the Junos OS version that the device is running on.

Junos OS Release 21.3R1 and later

  1. Run the following CLI command to display your current and rollback Attack database version: 

root@srx> show security idp security-package-version
  Attack database version:3458(Thu Jan 20 14:43:42 2022 UTC)
  Detector version :12.6.130200828
  Policy template version :3454
  Rollback version :3457(Tue Jan 18 14:40:09 2022 UTC)
  Rollback Detector version : 12.6.130200828

  1. If the rollback version was working fine and is the preferred version to revert to, run the following command (otherwise skip to the "Prior to 21.3R1" section below to revert to a different version): 

root@srx> request security idp security-package rollback
Will be processed in async mode. Check the status using the status checking CLI

  1. Confirm that the rollback is successful: 

root@srx> request security idp security-package rollback status
Done;Sucessfully Rolled back to 3457.

root@srx> show security idp security-package-version
  Attack database version:3457(Tue Jan 18 14:40:09 2022 UTC)
  Detector version :12.6.130200828
  Policy template version :3454
  Rollback version :N/A(N/A)
  Rollback Detector version : N/A

Prior to Junos OS Release 21.3R1

Note: Step 1 is given above.

  1. Run the following command to display your current Attack database version: 

root@srx> show security idp security-package-version
  Attack database version:2108(Thu Mar 29 12:47:45 2012)
  Detector version :12.6.160120213
  Policy template version :2108

Here 2108 indicates the version of the Attack database in use. Refer to your notes for the last known good Attack database version that you want to revert to.

  1. To revert to a previous version of the IDP Attack database, run the following command: 

request security idp security-package download version <version>   ->  Version number of the IDP attack database

For example 

request security idp security-package download version 2105     ->   In this example it's 2105

Then check the status: 

root@srx>request security idp security-package download status
Done;Successfully downloaded from(https://services.netscreen.com/cgi-bin/index.cgi).
Version info:2105(Thu Mar 26 12:30:49 2012, Detector=10.4.160101203)

 The above output indicates that the IDP attack database with version 2105 has been successfully downloaded.

  1. Now install the attack database: 

root@srx> request security idp security-package install

  1. It typically takes approximately 15 minutes to install the attack database. After it is installed, the status can be checked as follows: 

root@srx> request security idp security-package install status
Done;Attack DB update : successful - [UpdateNumber=2105,ExportDate=Thu Mar 26 12:32:49 2012,Detector=10.4.160101203]
Updating control-plane with new detector : successful
Updating data-plane with new attack or detector : not performed
due to no existing running policy found.

The above output indicates that the IDP attack database with version 2105 has been successfully installed.

You can check the Attack database version by using the following command: 

root@srx>show security idp security-package-version
Attack database version:2105(Mon Mar 26 12:35:38 2012)
Detector version :10.4.160101203
Policy template version :2

Note: If the previous version had an older detector, the detector will be reverted as well.

Refer to the RSS feed for more details on the signatures and detectors released with each sigdb version  Juniper Signature Updates .

Modification History

2022-02-10: Added new CLI command to rollback security package that is available starting from Junos OS Release 21.3R1

Related Information