Failed to edit IDPS profile in NSX-T due to error "Invalid Signature IDs" after updating IDS Signature set

Products

• VMware NSX

Issue/Introduction

• You are running VMware NSX-T version 3.1.3.7.
• You are not able to edit the IDPS profile.
• You have updated the IDPS signature set.
• Override Signatures are not present in the active bundle.
• You receive an error when running the PUT API:
  PUT /policy/api/v1/infra/settings/firewall/security/intrusion-services/profiles/<profile-id>:

  Response:
  {
      "httpStatus": "BAD_REQUEST",
      "error_code": 523669,
      "module_name": "Policy",
      "error_message": "Invalid Signature IDs [1116076] passed in IDS Profile /infra/settings/firewall/security/intrusion-services/profiles/SR."
  }

Environment

VMware NSX-T Data Center
VMware NSX-T Data Center 3.x

Cause

The NSX UI is not removing the signatures which are not present in the active bundle.

Resolution

This issue is resolved in NSX-T version 3.2.3 available at Support Documents and Downloads (broadcom.com).

Workaround:

1. You can use the following API to remove these invalid signatures from the IDPS profile.

   1. First, get the IDPS profile using the API call:
      GET /policy/api/v1/infra/settings/firewall/security/intrusion-services/profiles/<profile-id>
   2. Copy the response/payload of the GET API output and find the invalid signature.
   3. Once you find the invalid signature, delete it from the payload.
   4. Run the below PUT API again using the updated payload to update the IDPS profile:
      PUT /policy/api/v1/infra/settings/firewall/security/intrusion-services/profiles/<profile-id>

   Example:

   Below is an example of the output you should see when running GET /policy/api/v1/infra/settings/firewall/security/intrusion-services/profiles/<profile-id>.

   In this scenario, the section to remove is highlighted in bold.

   {
       "profile_severity": [
           "HIGH",
           "MEDIUM",
           "LOW",
           "SUSPICIOUS",
           "CRITICAL"
       ],
       "overridden_signatures": [
           {
               "marked_for_delete": false,
               "overridden": false,
               "action": "ALERT",
               "signature_id": "1116076",
               "enable": true,
               "_protection": "NOT_PROTECTED"
           }
       ],
       "resource_type": "IdsProfile",
       "id": "SR",
       "display_name": "SR",
       "path": "/infra/settings/firewall/security/intrusion-services/profiles/SR",
       "relative_path": "SR",
       "parent_path": "/infra",
       "remote_path": "",
       "unique_id": "b60c6660-####-####-####-########1e8",
       "realization_id": "b60c6660-####-####-####-########1e8",
       "owner_id": "aa4dc826-####-####-####-########a4a",
       "origin_site_id": "aa4dc826-####-####-####-########a4a",
       "marked_for_delete": false,
       "overridden": false,
       "_create_time": 1677731180496,
       "_create_user": "admin",
       "_last_modified_time": 1677731607733,
       "_last_modified_user": "admin",
       "_system_owned": false,
       "_protection": "NOT_PROTECTED",
       "_revision": 5
   }

   Once you remove the invalid signature from the output, copy the remaining output and run the PUT /policy/api/v1/infra/settings/firewall/security/intrusion-services/profiles/<profile-id> API with this as the payload to remove the invalid signature from the IDPS profile.

   Below is an example of the payload to be used with the above PUT API:

   {
       "profile_severity": [
           "HIGH",
           "MEDIUM",
           "LOW",
           "SUSPICIOUS",
           "CRITICAL"
       ],
       "overridden_signatures": [],
       "resource_type": "IdsProfile",
       "id": "SR",
       "display_name": "SR",
       "path": "/infra/settings/firewall/security/intrusion-services/profiles/SR",
       "relative_path": "SR",
       "parent_path": "/infra",
       "remote_path": "",
       "unique_id": "b60c6660-####-####-####-########1e8",
       "realization_id": "b60c6660-####-####-####-########1e8",
       "owner_id": "aa4dc826-####-####-####-########a4a",
       "origin_site_id": "aa4dc826-####-####-####-########a4a",
       "marked_for_delete": false,
       "overridden": false,
       "_create_time": 1677731180496,
       "_create_user": "admin",
       "_last_modified_time": 1677731607733,
       "_last_modified_user": "admin",
       "_system_owned": false,
       "_protection": "NOT_PROTECTED",
       "_revision": 5
   }

2. On the NSX-T UI, you can update the locally modified signatures by changing the IDPS profile criteria.

Additional Information

Ref. NSX-T Data Center REST API guide.