Description

Each SRX model has a different IDP Detector version so that in case a incorrect detector is installed (e.g. offline update; using download link for a different model), IDP policy related issues would be seen.

Symptoms

Every SRX device is pre-loaded with the correct Detector version. If the device is updated with a Detector version for a different model, the policy update will fail with the following errors in IDP traceoptions: 

Jun 19 12:11:34 sc_policy_unpack_tgz: invalid detector version
Jun 19 12:11:34 idpd_policy_load: sc_detector_unpack failed
Jun 19 12:11:34 idpd_policy_load: deleting temp tar dir(rm -fr /var/db/idpd/bins//4b4dad52)
Jun 19 12:11:34 IDP policy loading failed policy :[/var/db/idpd/bins//Client-Protection.bin.gz.v];detector:/var/db/idpd/sec-repository/installed-detector/libidp-detector.so.tgz.v;reason:[detector unpack failed]

 

Solution

  1. Take note of the correct Detector version for various models:

    12.6.140xxxxx -  Detector for High End device
    12.6.160xxxxx -  Detector for Branch Devices
    12.6.130xx -  Detector for vSRX, SRX4k, SRX1500

  2. Use the following command to check the Detector version installed on the device:

    show security idp security-package-version
    Attack database version:N/A(N/A)
    Detector version :12.6.160121210
    Policy template version :N/A


In this scenario, we did an off-line signature update using KB32399 - How to update IDP Signature Database off-line [juniper.net] . However, the download link in IDP traces was also created with an incorrect Detector version. A fresh IDP full update would be needed. Then the download link can be generated from another working device of the same model.

Modification History

2018-12-14:  Removed Detector version reference for vSRX3