Alarm for IDPS Signature Bundle Download Failure

Products

• VMware NSX
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

Title: Alarm for IDPS signature bundle download failure
Event ID: ids_ips.idps_signature_bundle_download_failure
Added in release: 4.1.2 M24
Alarm Description

• Purpose: Failure to download signature bundle
• Impact: In this case user will not be able to download the IDPS Signature Bundles.
• Maintenance window required for remediation?
  No

Environment

VMware NSX
VMware vDefend Firewall with ATP

Resolution

Check if you have a valid license for IDPS.You can check this by going to the System > Licenses page on the NSX Manager UI. If you have a valid IDPS license and are still getting this error, please ensure that you have internet connectivity from NSX Manager to NTICS by issuing the following API

POST https://api.nsx-sec-prod.com/1.0/auth/register
{
license_keys:[XXXXX-XXXXX-XXXXX-XXXXX],
device_type:NSX-Idps-Offline-Download,
client_id: client_username
}

 

Note:  Even when IDPS auto-update is disabled, the system still checks for newer bundles available on NTICS via api.prod.nsxti.vmware.com

 

In environments without internet access (aka air-gapped) or with Auto-Update disabled, you can choose one of the following options:
1. Ignore the alarm;  resolving the alarm will only clear it temporarily.
2. Disable the alarm under Home > System > Alarm Definitions

For either option, you should always manually update the signature bundle periodically to ensure workload inspection contains the latest signatures.