Alarm for IDPS Signature Bundle Download Failure

Products

• VMware NSX
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

Title: Alarm for IDPS signature bundle download failure
Event ID: ids_ips.idps_signature_bundle_download_failure
Added in release: 4.1.2 M24
Alarm Description

• Purpose: Failure to download signature bundle
• Impact: In this case user will not be able to download the IDPS Signature Bundles.
• Maintenance window required for remediation?
  No

Environment

VMware NSX
VMware vDefend Firewall with ATP

Resolution

First, verify that you have a valid IDPS license. You can confirm this by navigating to System > Licenses in the NSX Manager UI.

If a valid IDPS license is present and the error persists, ensure that the NSX Manager has internet connectivity to NTICS by issuing the following API request:

POST https://api.nsx-sec-prod.com/1.0/auth/register
{
license_keys:[#####-#####-#####-#####],
device_type:NSX-Idps-Offline-Download,
client_id: client_username
}

Note: Even when IDPS auto-update is disabled, the system still checks for newer signature bundles on NTICS via api.prod.nsxti.vmware.com.

In environments without internet access (air-gapped) or where Auto-Update is disabled, you can choose one of the following options:

1. Ignore the alarm (resolving it will only clear it temporarily).

2. Disable the alarm under Home > System > Alarm Definitions.

For either option, you should always manually update the signature bundle periodically to ensure workload inspection contains the latest signatures.