9 Replies Latest reply on Mar 4, 2016 3:42 PM by boschind

    HIPS not working after ePO upgrade from 5.1.0 to 5.1.3

    boschind

      yeterday i did the upgrade of ePO from 5.1.0 to 5.13 - the setup went smootly but in ePO console HIPS dashboards are not working anymore.

        • 1. Re: HIPS not working after ePO upgrade from 5.1.0 to 5.1.3
          boschind

          when i start login ePO console web page the following msg is displayed:

           

           

          HostIpsAdv - Dependent plugin hip8 failed with initialization error

          HostIPSLicense - Dependent plugin hip8 failed with initialization error

          hip8 - Error creating bean with name 'hip8.command.registration': Unsatisfied dependency expressed through bean property 'commandInvoker': : Error creating bean with name 'hip8.actions.FWClientRuleActions' defined in URL [jndi:/localhost/HOSTIPS_8000/WEB-INF/beans.xml]: Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.aop.framework.ProxyFactoryBean]: Constructor threw exception; nested exception is java.lang.NoSuchMethodError: org.springframework.core.CollectionFactory.createIdentityMapIfPossible(I)Ljava/ util/Map;; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'hip8.actions.FWClientRuleActions' defined in URL [jndi:/localhost/HOSTIPS_8000/WEB-INF/beans.xml]: Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.aop.framework.ProxyFactoryBean]: Constructor threw exception; nested exception is java.lang.NoSuchMethodError: org.springframework.core.CollectionFactory.createIdentityMapIfPossible(I)Ljava/ util/Map;

           

           

          btw i can access the console, see all dashboards except those about  HIPS - HIPS monitors and queries shows:

           

          This query cannot be displayed because it is in an invalid state. View the query's details for more information.

           

           

          any help or suggestion

          thanks in advance

          • 2. Re: HIPS not working after ePO upgrade from 5.1.0 to 5.1.3
            andrep1

            Unless you have a good backup to revert back to

            1. take a backup of epo folder and epo db

            2. stop master repository pull task

            3. remove hips extension

            4. reinstall hips extension (maybe try extension for HIPS 8 patch 7 if it is out already)

             

            You'll pretty much loose all you hips stuff, policies, etc... If your HIPS policies are exportable in your server's current state, then do that also.

            • 3. Re: HIPS not working after ePO upgrade from 5.1.0 to 5.1.3
              boschind

              thanks Andre for your answer and suggestions. would you be so kind to give some more details on the steps to recover this issue?

               

              you know it because you had paste experiences? i'm let's say disappointed by the fact the the setup process ran smootly ,and most of the ePO is up and running but this damn extension is giving me this problem....

              thanks again

              • 4. Re: HIPS not working after ePO upgrade from 5.1.0 to 5.1.3
                andrep1

                Extensions will fail and it a fact of life, it has happened to me many times...

                In extensions, click remove to remove the hips 8 extensions, then they can be reinstalled. Download the latest extension from mcafee or from the software manager in ePO.

                Then go to extension and check them in.  Ideally do that when the server is not too busy  (at night), ensure a backup of you db has been taken and make a copy of the ePolicy Orchestrator folder on your epo server.

                • 5. Re: HIPS not working after ePO upgrade from 5.1.0 to 5.1.3
                  j.kennedy

                  This is a known issue:

                  (ePolicy Orchestrator 5.1.x Known Issues) Technical Articles ID: KB80075 It is the 1st issue listed.

                   

                  During upgrade to ePO 5.1.3, all permissions related to Host Intrusion Prevention (Host IPS) for the existing permission sets are lost. Host IPS settings are reset to No Permission for the existing permission sets, but other permissions are saved with existing settings.  You will need to back up the HOST IPS permission sets before the update to ePO 5.1.3 and then restore the permissions sets after the upgrade.

                   

                  Here is the related KB if you have any questions  KB85912.

                  • 7. Re: HIPS not working after ePO upgrade from 5.1.0 to 5.1.3
                    boschind

                    the fact that it is "normal" to have problem with extensions is only a "cold confort".... but thanks for sharing your experience.

                    another question before starting removing HIPS extensions: via epo console i still have access to the policy catalog and i can still select:

                    HIPS 8.0:General

                    HIPS 8.0:Firewall

                    HIPS 8.0:IPS

                    and i can select the export button to save them as xml files

                    after the extensions removal and reinstall should i import them to restore HIPS policies?

                    extensions removal order is

                    license

                    advance

                    HIPS 8.0.0

                    isn't it?

                     

                    thanks

                    • 8. Re: HIPS not working after ePO upgrade from 5.1.0 to 5.1.3
                      andrep1

                      Export all you can, they might be reusable. Just no guarantee.

                      Problem is sometimes a policy can be corrupt, you just wont know. But then you realize the console password hasn't changed, or a feature is note enabled. So after importing a policy, you have to do a good sanity check on the endpoint to verify everything is working.

                       

                      As far as order, ePO  will tell you if here is a dependency.

                       

                      Andre

                      • 9. Re: HIPS not working after ePO upgrade from 5.1.0 to 5.1.3
                        boschind

                        i feel as a lucky guy ... for your support and because , before attempting to remove failing HIPS extensions (ver 8.0.6.978) and since there are available new ver 8.0.7.1001 , i attempted to upgrade to this new version the old failing ones. bingo! it worked !

                        here are a couple of screenshots

                        during the upgrade

                         

                        after the upgrade

                        now i'm reviewing policies , queries , etc..

                        but it seems that it works

                        THANKS