Description

This article addresses a failure of IDP policy configuration that is caused when the wrong IDP detector version is used. Different versions of the IDP detector are used for high end and branch versions of SRX.

Symptoms

If a customer upgrades the IDP signature database on SRX240H by offline mode, the upgrade and signature database install successfully, but IDP policy configuration fails.

root@SRX240H-34> show security idp security-package-version
node0:
--------------------------------------------------------------------------
Attack database version:2300(Mon Sep 16 18:21:22 2013 UTC)
Detector version :12.6.140130715
Policy template version :2300

node1:
--------------------------------------------------------------------------
Attack database version:2300(Mon Sep 16 18:21:22 2013 UTC)
Detector version :12.6.140130715
Policy template version :2300

root@SRX240H-34> show security idp policy-commit-status
node0:
--------------------------------------------------------------------------
policy re-load: last good patterndatabase does not exist
node1:
--------------------------------------------------------------------------
policy re-load: last good patterndatabase does not exist

In IDP traceoption , we can see the following error:

Sep 24 12:00:11 Apply policy configuration, policy ops bitmask = 4
Sep 24 12:00:11 Starting policy load...
Sep 24 12:00:11 Loading policy(/var/db/idpd/bins/idp_p2.bin.gz.v + /var/db/idpd/sec-repository/installed-detector/libidp-detector.so.tgz.v + no AI)...
Sep 24 12:00:11 idpd_dev_add_ipc_connection called...
Sep 24 12:00:11 idpd_dev_add_ipc_connection: done.
Sep 24 12:00:13 idpd_policy_load: lsys to pid map 0x981d00, size 132
Sep 24 12:00:13 idpd_policy_load: creating temp tar directory '/var/db/idpd//bins/55247820'
Sep 24 12:00:13 sc_policy_unpack_tgz: mkdir '' failed (errno=-1)
Sep 24 12:00:14 IDP policy loading failed policy :[/var/db/idpd/bins/idp_p2.bin.gz.v];detector:/var/db/idpd/sec-repository/installed-detector/libidp-detector.so.tgz.v;reason:[]
Sep 24 12:00:14 policy re-load: last good pattern database does not exist
Sep 24 12:00:14 ...Failed
Sep 24 12:00:14 idpd_policy_apply_config:4251:(idpd_policy_config_apply(pname, NULL, op)):

Solution


This issue is caused by use of the wrong IDP detector. The detector version is different for different Junos OS platforms.

  • Detector version: 12.6.140130715" is used on a high end SRX
  • Detector version: 12.6.160130715 is used on a branch device
Refer to the detector release notes for more details on the detector versions.

Customers should follow up by consulting TN83 How to perform offline IDP signature database update.