This guide helps you verify/troubleshoot the IDP attack database is downloaded and installed on a SRX device in a Chassis Cluster.
If your SRX is not in a Chassis Cluster, refer to KB23422 - Verify/Troubleshoot IDP attack database on SRX [juniper.net] . Note: A product listed in this article has either reached hardware End of Life (EOL) OR software End of Engineering (EOE). Refer to End of Life Products & Milestones for the EOL, EOE, and End of Support (EOS) dates.
Note: In Junos 12.1, a new feature was added to synchronize the IDP security package in a Chassis Cluster automatically, so this will help significantly with the Attack Database being out of sync on the Chassis Cluster nodes in Junos 11.4 and below. See the Release Notes: New Features - Junos 12.1 Branch SRX and New Features - Junos 12.1 High-end SRX .
This guide applies to Junos 12.1 and below.
Perform the following steps:
Run the command 'show chassis cluster status', and identify which node is Primary for Redundancy group 0 on your SRX.
user@host> show chassis cluster status Cluster ID: 1 Node name Priority Status Preempt Manual failover Redundancy-group: 0, Failover count: 1 node0 254 primary no no node1 2 secondary no no Redundancy-group: 1, Failover count: 1 node0 254 primary no no node1 1 secondary no no
In the above output, node 0 is the primary for Redundancy-group 0 (RG 0 implies the Routing Engine).
Run the command 'show security idp security-package-version', and observe the 'Attack database version' for the Primary node:
node0: <------ -------------------------------------------------------------------------- Attack database version:1732(Mon Jul 19 12:44:15 2010) <------ Detector version :10.4.140100525 Policy template version :N/A node1: -------------------------------------------------------------------------- Attack database version:N/A(N/A) Detector version :10.4.140100525 Policy template version :N/A
Does the Primary node have N/A for the 'Attack database version'?
delete system processes idp-policy disable
Now observe the 'Attack database version' for the Secondary node:
node0: -------------------------------------------------------------------------- Attack database version:1732(Mon Jul 19 12:44:15 2010) Detector version :10.4.140100525 Policy template version :N/A node1: -------------------------------------------------------------------------- Attack database version:N/A(N/A) <------ Detector version :10.4.140100525 Policy template version :N/A
Does the secondary node have N/A for the 'Attack database version'?
On the secondary node, run the command ' show system license ' . (Both nodes in a Chassis Cluster must have the IDP license.)
show system license
Do you see the feature ' idp-sig ' (which is the IDP license)?
Do the Chassis Cluster nodes have connectivity to the Internet?
After performing the steps to update the Attack database, continue to Step 6 .
Run the command 'show security idp security-package-version' again.
node0: -------------------------------------------------------------------------- Attack database version :1732(Mon Jul 19 12:44:15 2010) <------ Detector version :10.4.140100525 Policy template version :N/A node1: -------------------------------------------------------------------------- Attack database version :1732(Mon Jul 19 12:44:15 2010) <------ Detector version :10.4.140100525 Policy template version :N/A
Are the Attack database versions the same?
Yes - Done. For a list of other SRX/IPD isues, go to KB23424 - Resolution Guide - SRX - Troubleshooting IDP [juniper.net] .
No - Collect the IDP information in KB21781 - [SRX] Data Collection Checklist [juniper.net] , and open a case with your technical support representative.
2021-09-11: Tagged article for EOL/EOE. This article talks about the IDP attack database installed correctly or not and further troubleshooting of it on Junos version below 12.1 (mentioned the same in symptoms section) which are already EOL and EOE. This issue is not valid for chassis clusters on 12.1 or above as its IDP signature synchronization has already been taken care of there. So this article can be archived. 2020-02-08: Article reviewed for accuracy. Article is correct and complete.