Using Junos Space to update IDP on an SRX Cluster fail on the primary device but not on the secondary node. This is due to ‘Application Signatures failed due to xcommit error’. It is recommended to use master-only IP address across the cluster.
When using Junos to update IDP on an SRX cluster, it is successful on the secondary node, but the updates fail on the primary device. The following error was seen:
Upgrade IPS/Application Signatures failed. Version(2610) node0 done; ai installation failed! attack db update failed! checking compatibility of application package version 2610 ... Upgrade IPS/Application Signatures failed. Version(2610) node1 done; attack db update : successful - [update number=2610,exportdate=2016-01-07 19:02:39,detector=12.6.160151117] updating control-plane with new detector : successful updating data-plane with new attack or detector : not performed due to no active policy configured.
Output from IDP trace options on the SRX:
Feb 5 09:17:38 jnx_idp_secpack_load: [New request] secdb_load .arg(source-path /var/db/idpd/nsm-download/) Feb 5 09:17:41 jnx_idp_secpack_load: [New request] secdb_load .arg(source-path /var/db/idpd/nsm-download/)
Feb 5 09:18:16 jnx_idp_secpack_load: [New request] secdb_load .arg(status) Feb 5 09:18:19 jnx_idp_secpack_load: [New request] secdb_load .arg(status) Feb 5 09:56:06 jnx_idp_secpack_load: [New request] secdb_load .arg(status) Observe above that the requests for installing the Attack DB files that were pushed by the Junos Space to the device highlighted in bold. . Please observe that there are two different requests coming from the JunOS Space within a span of three seconds. This results in the following error on the device. 09:17:41 IDP update license status: Valid license installed. 09:17:41 jnx_idp_secpack_load: About to begin install 09:17:41 jnx_idp_secpack_load: Install is already in progress .. 09:17:48 AI installation failed due to xcommit error.
In an SRX cluster, multiple requests will come only if the devices are not discovered using the master-only IP address. It is recommended to use master-only IP address across the cluster. This way, the Junos Space can query a single IP address and that IP address is always the primary for the cluster. Thus, the Junos Space will send only one install request to the primary device. The primary device will not only install IDP on itself, it will also update the IDP installation on the secondary node as well.