AIP-SSM-10 signature update failure

Hopefully someone will be able to help me, I am unable to get the IPS signature autoupdate working on our ASA 5510. We have a valid support contract, our username does not incude and special characters and I am able to download the signature files from the website using our CCO.
When trying to get them via Auto/cisco.com update though I get the following in the event logs every update attempt:
evError: eventId=1319467413849005289  vendor=Cisco  severity=error 
  originator:  
    hostId: xxxx 
    appName: mainApp 
    appInstanceId: 354 
  time: Oct 26, 2011 11:40:01 UTC  offset=60  timeZone=GMT00:00 
  errorMessage: AutoUpdate exception: HTTP connection failed [1,111]  name=errSystemError 
I have included a "show conf" and a "show stat host" below.
<snip>
xxxxxx# show conf
! Current configuration last modified Wed Oct 26 10:48:07 2011
! Version 7.0(6)
! Host:
!     Realm Keys          key1.0
! Signature Definition:
!     Signature Update    S604.0   2011-10-20
service interface
exit
service authentication
exit
service event-action-rules rules0
exit
service host
network-settings
host-ip 10.x.x.x/24,10.x.x.x
host-name xxxxxx
telnet-option disabled
access-list 10.x.x.x/32
access-list 10.x.x.x/16
access-list 10.x.x.x/32
dns-primary-server enabled
address 10.x.x.x
exit
dns-secondary-server disabled
dns-tertiary-server disabled
exit
time-zone-settings
offset 0
standard-time-zone-name GMT00:00
exit
ntp-option enabled-ntp-unauthenticated
ntp-server 10.x.x.x
exit
summertime-option recurring
summertime-zone-name GMT00:00
start-summertime
week-of-month last
exit
end-summertime
month october
week-of-month last
exit
end-summertime
month october
week-of-month last
exit
exit
auto-upgrade
cisco-server enabled
schedule-option periodic-schedule
start-time 00:40:00
interval 1
exit
user-name xxxxxxxxxxxxxxx
cisco-url https://198.133.219.25//cgi-bin/front.x/ida/locator/locator.pl
exit
exit
exit
service logger
exit
service network-access
exit
service notification
exit
service signature-definition sig0
exit
service ssh-known-hosts
exit
service trusted-certificates
exit
service web-server
exit
service anomaly-detection ad0
exit
service external-product-interface
exit
service health-monitor
exit
service global-correlation
exit
service aaa
exit
service analysis-engine
virtual-sensor vs0
physical-interface GigabitEthernet0/1
exit
exit
<snip>
xxxxxx# show stat host
General Statistics
   Last Change To Host Config (UTC) = 27-Oct-2011 08:27:10
   Command Control Port Device = GigabitEthernet0/0
Network Statistics
    = ge0_0     Link encap:Ethernet  HWaddr 00:12:D9:48:F7:44
    =           inet addr:10.x.x.x  Bcast:10.x.x.x.x  Mask:255.255.255.0
    =           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
    =           RX packets:470106 errors:0 dropped:0 overruns:0 frame:0
    =           TX packets:139322 errors:0 dropped:0 overruns:0 carrier:0
    =           collisions:0 txqueuelen:1000
    =           RX bytes:40821181 (38.9 MiB)  TX bytes:102615325 (97.8 MiB)
    =           Base address:0xbc00 Memory:f8200000-f8220000
NTP Statistics
    =      remote           refid      st t when poll reach   delay   offset  jitter
    = *time.xxxx.x 195.x.x.x   3 u  142 1024  377    1.825   -0.626   0.305
    =  LOCAL(0)        LOCAL(0)        15 l   59   64  377    0.000    0.000   0.001
    = ind assID status  conf reach auth condition  last_event cnt
    =   1 43092  b644   yes   yes  none  sys.peer   reachable  4
    =   2 43093  9044   yes   yes  none    reject   reachable  4
   status = Synchronized
Memory Usage
   usedBytes = 664383488
   freeBytes = 368111616
   totalBytes = 1032495104
Summertime Statistics
   start = 03:00:00 GMT00:00 Sun Mar 27 2011
   end = 01:00:00 GMT00:00 Sun Oct 30 2011
CPU Statistics
   Usage over last 5 seconds = 51
   Usage over last minute = 44
   Usage over last 5 minutes = 50
Memory Statistics
   Memory usage (bytes) = 664383488
   Memory free (bytes) = 368111616
Auto Update Statistics
   lastDirectoryReadAttempt = 08:40:00 GMT00:00 Thu Oct 27 2011
    =   Read directory: https://198.133.219.25//cgi-bin/front.x/ida/locator/locator.pl
    =   Error: AutoUpdate exception: HTTP connection failed [1,111]
   lastDownloadAttempt = N/A
   lastInstallAttempt = N/A
   nextAttempt = 09:28:00 GMT00:00 Thu Oct 27 2011
Auxilliary Processors Installed
<snip>
Many thanks.

Hi Bob,
Thanks for the reply - it got me thinking about how it was actually getting the update.
I needed to modify an ACL and add a PAT for the sensor management IP as I've tied down the hosts that can get out.
It's now showing that it is attempting to reach the URL - currently there aren't any updates waiting though....
Many thanks.

Similar Messages

  • Upgrade AIP SSM with Signature Engine 4 file

    When I tried to upload Signature Engine 4 file (IPS-engine-E4-req-7.0-2.pkg),  using FTP server both by CLI and IDM, to new AIP SSM sensor, I got the following  error message:
    Cannot upgrade software on the sensor - socket error:110.
    When I tried to do the same by using these steps: IDM --> Configuration  --> Sensor Management --> Update Sensor --> choose Update is located on  this client --> choose the "IPS-K9-7.0-2-E4.pkg" file --> hit the "Update  Sensor" button, I got the following error message
    The current signature level is S480.The current signature level must be  less than s480 for this package to install.
    Here is the output for sh ver command
    AIP_SSM# sh version
    Application Partition:
    Cisco Intrusion Prevention System, Version 7.0(2)E4
    Host:
        Realm Keys          key1.0
    Signature Definition:
        Signature Update    S480.0                   2010-03-24
    OS Version:             2.4.30-IDS-smp-bigphys
    Platform:               ASA-SSM-10
    Serial Number:          JAF1514BAHS
    Licensed, expires:      07-Jun-2012 UTC
    Sensor up-time is 21 days.
    Using 695943168 out of 1032495104 bytes of available memory (67% usage)
    system is using 17.4M out of 38.5M bytes of available disk space (45% usage)
    application-data is using 45.4M out of 166.8M bytes of available disk space (29% usage)
    boot is using 41.6M out of 68.6M bytes of available disk space (64% usage)
    application-log is using 123.5M out of 513.0M bytes of available disk space (24% usage)
    MainApp            B-BEAU_2009_OCT_15_08_07_7_0_1_111   (Ipsbuild)   2009-10-15T08:09:06-0500   Running
    AnalysisEngine     BE-BEAU_E4_2010_MAR_25_02_09_7_0_2   (Ipsbuild)   2010-03-25T02:11:05-0500   Running
    CollaborationApp   B-BEAU_2009_OCT_15_08_07_7_0_1_111   (Ipsbuild)   2009-10-15T08:09:06-0500   Running
    CLI                B-BEAU_2009_OCT_15_08_07_7_0_1_111   (Ipsbuild)   2009-10-15T08:09:06-0500
    Upgrade History:
      IPS-K9-7.0-2-E4   02:00:07 UTC Thu Mar 25 2010
    Recovery Partition Version 1.1 - 7.0(2)E4
    Host Certificate Valid from: 30-May-2011 to 30-May-2013
    Any idea what could be the problem?
    Regards,

    Based on your show version, you already have E4, what is it that you are trying to do?
    Mike

  • ASA-SSM-10 Signature Update Errors Messages

    Hello,
    I am getting error messages on ASA-SSM-10 IPS. It has following configuration:
    Model:   ASA-SSM-10
    Hardware version:   1.0
    Firmware version:   1.0(11)5
    Software version:   7.0(7)E4
    App. version:       7.0(7)E4
    Here are error messages:
    evError: eventId=1334244240891143986  vendor=Cisco  severity=error  
      originator:  
        hostId: sensor 
        appName: mainApp 
        appInstanceId: 357 
      errorMessage: No installable auto update package found on server  name=errSystemError 
    evError: eventId=1334244240891141857  vendor=Cisco  severity=error 
      originator:  
        hostId: sensor 
        appName: mainApp 
        appInstanceId: 357 
      errorMessage: could not parse cisco-locator-server response  name=errSystemError 
    evError: eventId=1334244240891142089  vendor=Cisco  severity=error 
      originator:  
        hostId: sensor 
        appName: collaborationApp 
        appInstanceId: 489 
      errorMessage: A global correlation update failed: Receive HTTP response failed [3,212]
    Messages, like this one, in the category - Reputation update failure - were logged 1 times in the last 105245 seconds.  name=errUnclassified 
    evError: eventId=1334244240891141325  vendor=Cisco  severity=error 
      originator:  
        hostId: sensor 
        appName: mainApp 
        appInstanceId: 357 
      errorMessage: could not parse cisco-locator-server response  name=errSystemError 
    Actually IPS is doing signature and Global Correlation updates, but form time to time I see  these error messages. Do you have any information what could it indicate.

    Hello Giorgi,
    Sometimes it may be server saturation, other connection problems proxy and so on. I recommend you to not put the hour for auto update to an exact time ie 2:00 PM or 1:00 AM try putting not even numbers like 9:17 or 10:41, and see if you continue getting these errors.
    Mike

  • AIP-SSM-10 auto update issue

    Hi! experts
    I using AIP-SSM-10 module on ASA 5540
    But it is not working auto update signature.
    So I `m going to attach " show statistics host" result.
    Can you tell me some help?
    Thanks in advance
    Auto Update Statistics
    lastDirectoryReadAttempt = 07:34:50 UTC Tue Oct 20 2009
    = Read directory: https://198.133.219.25/cgi-bin/ida/locator/locator.pl
    = Error: AutoUpdate exception: HTTP connection failed [1,0]
    lastDownloadAttempt = N/A
    lastInstallAttempt = N/A
    nextAttempt = 04:00:00 UTC Wed Oct 21 2009

    It is clear that mgmt ifaces are able to connect to the Internet but if they may connect to inet via proxy you must configure proxy-server.

  • Signature Updates

    Hello,
    I m very much new to IPS i want to update my AIP-SSM 10 signatures.As if now on cisco website there are updates folder for signature,the latest is S495, what i m having in my IPS is S300,Is that so to upgrade signature all the small packages till S495 i have to download maually 1 by 1 or any link for bulk download of signature till the latest one.
    Thanks,

    Haya;
      You will need to ensure you are running a version of IPS software which contains the E4 analysis engine (i.e. 6.0(6)E4, 6.2(2)E4 or 7.0(2)E4).  You can then download the latest signature update package (S491) and apply that update.  You do not need to apply each and every signature update package.
    Scott

  • Signature Updates for AIP-SSM 10

    Hi all how can i obtain Signature Updates for AIP-SSM 10 where i am having 60 day trial license with me

    Here is the main file download page for the IPS sensors.
    Find the section for the version you are running and click on the Latest Signature Updates link to take to you to the download page for signature updates.
    You can then download which ever signature update you want.
    NOTE1: Each Signature Updates contains all signatures from previous Sig levels. So you only need to download the latest one.
    NOTE2: Each signature update has a specific E (Engine) level requirement. You can execute "show ver" on your sensor to determine if it is at an E1 or E2 level. If it is at E1 and you want the latest sigs that require E2 then you will first need to install the E2 upgrade.
    On that main download page look for the "Latest Upgrades" link for your version, and look for the IPS-engine-E2-req-X.X-X.pkg file where the X.X-X matches your sensor version.
    If there is not an X.X-X matching your sensor version, then you may need to upgrade the software version for your sensor as well.
    NOTE3: Many of these links will also require an account on cisco.com. And for some of these files that account may also need to be verified for being from a country where the USA's export restrictions allow downloads for encryption. (Most countries qualify but you do have to go through that qualification step). It has been over 10 years that I have had do this so I am not sure of the latest procedures for getting an account or validating it for encrpytion downloads.

  • Installing signature update for IDSM-2 on AIP-SSM

    Hi every one,im not sure about this question but i think its beter to ask you experts.i want to know that if i have signature update for example for my IDSM-2 can i instal this sig update on my AIP-SSM --> suppose that IPS software on both devices are same and also i have installed valid license key on AIP-SSM.now can i do this or no? and i know that if you have not valid license installed on IDSM-2 you cant instal any sig update on IDSM-2 but what about AIP-SSM?i mean can i instal sig update on AIP-SSM without installed valid license key on AIP-SSM? thanks

    There are 3 main types of Signature Updates.
    1) IPS Sensor Signature Updates
    2) CSM Signature Updates for IPS Sensors
    3) IOS IPS Signature Updates
    The IPS Signature Update filename is in the form: IPS-sig-Sxxx-req-Ey.pkg
    This is most likely what you are referrnig to in your post. This file can be installed on ANY IDS/IPS Appliance or Module.
    The Requirement here is not the platform but rather the Engine Level. The "req-Ey" portion of the filename tells you that the sensor must already be running the "y" Engine level of software.
    So an IPS-sig-S436-req-E3.pkg file can be installed on any IDS/IPS Appliance or Module so long as the software on that sensor is an "E3" version.
    The CSM updates, are signature updates for the Cisco Security Manager. They contain special files that CSM uses to update itself, and then also included within the CSM update is the actual sensor update described above. CSM unpackages the CSM update, updates itself, and then uses that embedded file to upgrade the actual sensor.
    The third type of file is for IOS Routers loaded with special IOS software that has the special IOS IPS features where the Router itself (instead of a separate IDS/IPS module) does the signature monitoring.
    These IOS IPS Signature Updates get installed on the actual router, and are not installed on the IDS/IPS Sensor Appliances or Modules.
    So in answer to your question, yes the same Signature Update for your IDSM-2 is the exact same Signature Update for your SSM modules.
    The exact same file is available through multiple different paths on cisco.com. But it doesn't matter through which cisco.com path you downloaded the file you can still install it on all IDS/IPS Appliances and Modules.
    As for licensing, the license works the same on all IDS/IPS Appliances and Modules. A license must be on the sensor for the Signature Update to be applied.
    NOTE: A Trial License is available from cisco.com for new sensors to allow you time to get everything setup correctly for your sensor to be covered by a service contract, and get the standard license from the service contract.

  • Signature Update Version : AIP-SSM GUI

    How can I view the current signature version on AIP-SSM via GUI. Via CLI I can see it on 'show version' output.
    Thanks.

    You can view it via the Monitor tab. The exact location is:
    Monitoring >> Support Information >> System Information
    You can also view this information in IME.
    Please rate if helpful.
    Regards
    Farrukh

  • Obtaining hardware and signature support for AIP SSM-10

    We have a 5510 which we have purchased an AIP SSM-10 card for the ASA which is already under a support contract. We now wish to add hardware maintenance for the new AIP SSM-10 card as well as signature updates. Our Cisco supplier will not confirm that we will receive signature updates with the hardware support though (we have been trying to get an answer from them since June or July now).
    Could someone let us know what the correct part number is so we can ask for the specific option that will provide both hardware cover and signature updates.

    i think this is what you need,
    CON-SU1-AS1A1PK9
    IPS SVC, AR NBD ASA5510-AIP10SP-K9
    cisco smartnet support

  • CSM to update IPS AIP -SSM

    Hi all,
    I need some help. I am configuring my CSM 3.1 to apply update on my IPS AIP-SSM.
    I went to the apply IPS Tab and choose to update from cisco.com. But it is always like processing for a long time.
    I tried to enter my username and password for the sensors or the CCO account but still no improvement. Does anyone knows how to configure this. I tried reading the user guide there is no examples.
    Thanks

    The IPS-engine-E2-req-5.1-7.pkg Engine Update file is just to upgrade an existing 5.1(7)E1 sensor to 5.1(7)E2.
    It only changes the "engine" features of the sensor that are necessary for installing signature updates requiring E2. It does not change other files on the sensor.
    The IPS-K9-5.1-8-E2.pkg Service Pack file is for upgrading the entire image to the next service pack level as well as upgrading the "engine" features. So you get all of the latest bug fixes.
    So which to use?
    If you are running 5.1(7)E1 then you will eventually want to get to 5.1(8)E2. But the upgrade to 5.1(8)E2 WILL require a reboot and so if running in an inline mode it should only be done during a scheduled network downtime. For most networks this could be a week or even a month before the downtime can be scheduled to do this type of upgrade. So the IPS-engine-E2-5.1-7.pkg file is a short term solution to get you to the E2 level required for signature updates, until you can schedule the upgrade to 5.1(8)E2.
    The IPS-engine... file will NOT reboot the sensor. It will temporarilly stop analysis and if Software ByPass is set to auto then traffic will be allowed to pass through the sensor unanalyzed while the engine update takes place. Because the traffic will continue to flow with Software ByPass most companies will allow an Engine update to be installed without having to schedule network downtime.
    Of course, the above discussion was really only applicable when E2 was the latest Engine release. Now that E3 is out, the discussion really becomes how to get to E3.
    There is Not an IPS-engine-E3-req-5.1-7.pkg engine update file.
    So you must get to 5.1(8)E3 if you want to keep getting recent signature updates.
    So then it just depends on your current IPS version.
    If you are running 5.1(7)E2 or earlier version then you must schedule a downtime and install the IPS-K9-5.1-8-E3.pkg file in order to install the latest E3 required signature updates.
    If you are running 5.1(8)E2 already, then you need to install the IPS-engine-E3-req-5.1-8.pkg file because the only thing needing to be upgraded is the Engine level to E3.
    General Rules of Thumb:
    Always ensure you are at the latest Service Pack level for the major/minor version train you are using. (5.1(8) in this case)
    If you are running the latest Service Pack then you will be able to simply install an Engine Update when the next Engine Update comes out without having to schedule downtime.
    If you are not at the latest Service Pack level then you will want to schedule a network downtime to do that upgrade within 60 days of the Service Pack being released.
    If an Engine Update comes out before you get a chance to upgrade to the next Service Pack, then install the Engine Update for the prior Service Pack (that you should at least be at) as a temporary measure to keep getting signature updates. And schedule a Service Pack upgrade as soon as possible.
    Why 60 days?
    If a new Engine Update is released within 60 of a Service Pack release, then the Engine Update will be released for both the latest Service Pack AND the one prior. But if the new Engine Update is longer than 60 days after the latest Service Pack, then an Engine Update will be created only for the latest Service Pack and not for the prior. This is why E3 was only released for 5.1(8). E3 was released more than 60 days after 5.1(8) so there was not an E3 for the prior 5.1(7).
    So you see that an Engine Update for a prior Service Pack should be considered a temporary measure until you can get the next Service Pack installed.
    If you wait too long another Engine Update might come out, and you might be forced into an immediate network downtime to get to the latest Service Pack.
    As for do you HAVE to install IPS-engine-E2-req-5.1-7.pkg before installing IPS-K9-5.1-8-E2.pkg (or more importantly IPS-K9-5.1-8-E3.pkg).
    The answer is NO.
    You can go directly from any 5.0 or 5.1 version directly to IPS-K9-5.1-8-E3.pkg.

  • AIP-SSM crash during S389 Signature upgrade

    Our AIP-SSM [version 6.1(2)E3] crashed during a S389 Signature upgrade on Friday. Neither a "session 1" command from its host, an ASA5520, or a "reload" command of the ASA5520 succeeded in bringing back up the AIP-SSM. Fortunately, after the ASA's power was recycled, the AIP-SSM successfully booted, albeit not to S389, but to its previously loaded S383. I established an SR and supplied the "show tech" and "show config," but the Cisco tech replied "nothing stands out" in them and said just run the S389 update again and send the same info if it crashes. I have several problems with that approach: 1) he had replied that several other customers had had the same problem; 2) our current AIP-SSM is a replacement for an RMA'ed one which had choked on the E2 engine upgrade a few months ago; 3) if another S389 upgrade attempt fails, our client's network will be down because our security policy requires the ASA's bypass mode for the AIP-SSM to be "fail-close." My questions to the forum include:
    1) If the "show tech" command is run after an AIP-SSM has rebooted after a previously-attempted S389 upgrade, can it include any information specific to the previously-attempted S389 upgrade? 2) Could the hardware components of the AIP-SSM-10 be inadequate for the combination of the E3 engine plus the cumulative signatures? 3) If the answer to question 2 is "yes" or "possibly," could Cisco modularize the signatures, eg. provide an "only-activated-signatures" (ie smaller) file for customers like us and an "everything" for others? Advice and recommendations heartily requested.

    Based on your show version, you already have E4, what is it that you are trying to do?
    Mike

  • IPS Signature DataBase - ASA IPS/IOS IPS/IPS 42xx/AIP-SSM

    Hi,
    Can anyone briefly tell me the signature database details (No of Signature) among the following devices,
    -->ASA IPS/IOS IPS/IPS 42xx/AIP-SSM.
    Thanks,

    IPS on ASA/PIX = just 50 or so common signatures
    AIP-SSM module = same signatures as Cisco 4200 series sensors. Little minor differences exist (like IPv6 signature support etc.)
    Please rate if helpful.
    Regards
    Farrukh

  • Reporting for System Center End point Protection -Antivirus Infections,Signature updates,Errors/failures

    Hi,
    We have SCEP on all servers 2008 R2 and 2012, now basically we are loking for specific information on
    infections
    Signature Updates
    Errors/Failures.
    Regards,
    gautham.K
    MCTS-Microsoft Exchange Adminstrator,2010

    The Antimalware activity report cover your 1 request.
    The Computer Endpoint Protection status covers the other two request, it is a drill through for the other reports and it is within a hidden folder.
    Garth Jones | My blogs: Enhansoft and
    Old Blog site | Twitter:
    @GarthMJ

  • Customizing signatures question on AIP-SSM

    Hi all
    actually our customer has an AIP-SSM module which is configured in inline mode.some users are appeared as attackers in the IPS event store .
    can i deny any unwanted connection for these users without affecting on the legitimate connections of these users like internet browsing ???
    i tried to make the signature action to be "deny connection inline" but when the signature fire , the user who has appeared as an attacker is totally blocked and cannot access internet.
    anyone face this issue ??
    please advice.
    regards

    Hi Mohammed.
    Right now I'm preparing the IPS Exam, and I have read some where that:
    "deny connection inline" will stop the connection totaly. But if the same user(IP Address) has many "deny connection inline", the IPS will say that there is a problem with this PC, and I'll not lose ressource and time to block each connection, and the the IPS sensor will block the Host.
    You can tune the Signature to solve this issue, but this will not solve the main problem.
    But as Andy said, thier is a Sweep attack from these PCs. try to scan them with Anti-Virus, and anti-worm... because they are the source of this issues.
    Sweep is a "Network Reconnaissance Attack". Please take a look at this link for more information:
    http://www.cisco.com/en/US/docs/security/ips/5.1/configuration/guide/cli/cliSgEng.html#wp1048257
    I hope this helpful.
    Best regards
    Reda
    [email protected]

  • Failure to Upgrade the software of my AIP-SSM-20

    Dear all,
    I have failed to upgrade the software of my AIP-SSM-20 on the ASA. The AIP-SSM-20 had an Image of version IPS-K9-5.1-7-E1.pkg and I tried to upgrade it to IPS-K9-6.1-1-E2.pkg but after the upgrade the AIP-SSM-20 became unusable. I can no longer log on  to the IPS Module from the ASA. When I initiated a connection to the module with session 1 command, the systems says card in slot 1 did not respond to system request. I decided to restored the system image from the ASA by using the hw-module module 1 recover configure and hw-module module 1 recover boot commands but has so far failed.When  I issued the command hw-module module 1 boot command, the status of the IPS shows recover and would be in that state even for days.And my TFTP server shows that it is transfering the images to the IPS.
    I don't know where I have gone wrong and I would be very happy if somebody can give me a procedure that would help me to re-image the software of the IPS.
    Any help would be highly appreciated.
    Claude Fozao

    Halijen has already send you a link to reimage,let me briefly answer what a system image and upgrade files are and the difference between them
    The System Image files are meant to be used only when a complete erasing of the sensor's image is needed.  This is generally because the installed files were corrupted, or so old that it would be easier to start over and make it look like it came from the factory; than to use the standard "upgrade" files.So in case you are doing reimaging than use .img files which are system reimage files
    In more than 90% of the cases, most customers will want to "upgrade" rather than do a System Image.  The "upgrade" is done from within the sensor itself, and will both load the higher version as well as convert your current configuration to work with the newer version.it uses .pkg files
    A usual poblem with the System Re-imaging process is that the card winds up in a boot loop because of an error.  When ROMMON detects an error it reboots and tries the same steps again which usually winds up with the same error which causes a reboot, etc.....
    So determining if the card is in a reboot loop, and what the error is would be the next step in your debugging process.
    Execute "debug module-boot".  Enter "hw-module module 1 recover stop".   Wait for a few minutes, and then enter "hw-module module 1 recover boot".
    The output from ROMMON on the SSM will be seen on your ASA connection.Look at the configuration being passed to the SSM's ROMMON and look for any bad entries.Watch to see if it able to download the System Image file, or if it continuously reboots.
    If it continuously reboots, then look to see what error message is seen just prior to the reboot.
    Some common problems:
    1) Typos in IP address, gateway, tftp server IP, or system image filename.
    2) If the tftp server is on the same subnet as the SSM's IP Address, then try leaving the Gateway address blank since it is not needed.
    3) Remember that the IP Address is for the external interface of the SSM.  So be sure you are using an address that is applicable for the network where you are pluggin in the SSM's external interface.
    4) If the TFTP Server is on another subnet, then be sure there is a route to the other network.  If having to route back through the ASA, then ensure that the ASA will allow TFTP packets to pass through the ASA.  (The ASA could wind up blocking the TFTP packets depending on the ASA configuration)
    5) Be sure the file can be downloaded from the TFTP server.  Check the file permissions, and the directory where the file is located.   From your desktop try to downlaod the file from the tftp server.  This will ensure you are using the correct directory and that the file has correct permissions.  Once common problem is that the file may be /tftpboot/sensorfiles/IPS-SSM_20-K9-sys-1.1-a-6.1-1-E1.img.  But because the tftp server automatically starts in /tftpboot, you may need to NOT specify it for the file and instead just use: sensorfiles/IPS-SSM_20-K9-sys-1.1-a-6.1-1-E1.img
    6) Check to make sure the file is not corrupted by running an md5sum and checking it against the value listed on cisco's web site.

Maybe you are looking for

  • Itunes 11.2.2.3 sync problems iphone4

    Hi, Your assistance will be appreciated here. OK, I'm looking at a Macbook (2.1 with 1gb sdram) running 10.6.8 with itunes 11.2.2.3 trying to sync with an iPhone 4 (not an 'S') with iOS 7.1.2 uptodate. Since the iTunes 11.2.2.3 update a couple of day

  • Is it possible to delete linked SharePoint Lists?

    Greetings everyone, I'm hoping someone can point me in the right direction here.  So, I'm building a database for my organization, which is a nursing division at a hospital--it's rather large and rather involved--but there are only certain pieces of

  • Offsetting entry and account determination

    Hi friends, The question I'm putting across might sound silly. I have tried a lot to understand these on my own but I still don't feel confident on my own understanding. Hence I'm seeking your help. Can you please explain me the meaning of Offsetting

  • Acrobat Updater Error 1300

    Hi, I have Adobe Acrobat Std 9.2 installed on an Acer tablet running Windows 8 Professional. When I attempt to install the 9.5.4 update, I receive the following message: "Cannot install the update. Please run Adobe Acrobat Repair. Error: 1300" I have

  • Wrong link on deployment page (Flash Player)

    Hi all, I think there's a malformed link on the Flash Player distribution / deployment page (Weiterverteilung von Adobe Flash Player | Adobe): when I click on the FP 15 ActiveX link, it downloads the correct version 15.0.0.239 the link for the FP 15