Best practice for SmartDefense update

[RayPesek]

At a recent user group meeting, it was brought up that the database backup you can perform prior to pushing a policy can be used to un-do SmartDefense updates if needed. Our local SE who was present confirmed it.

You need to push the policy with a backup BEFORE you perform the SD update and then update it and push again.

If you need to roll back for some reason, you can restore the backup.

Ray

[runcmd]

This is nice to know; however, to the best of my knowledge, features added by SmartDefense updates aren't automatically enabled and it is necessary to go in and switch the new features on. Has anyone ever encountered an issue with a SmartDefense update that required a rollback, rather than simply disabling the new feature? Thanks!

[Lackie]

There have been issues in the past with SmartDefense updates that really break some things. One issue that came about is not being able to push a policy after doing a smartdefense upgrade. Had to have a few customers roll back to their previous version.

[runcmd]

WOW! Then it sounds like the wisest thing to do is to "create database version" before and after every SmartDefense update. Thanks, again, for the info!

[srikrishnak]

A bit weird but true. Better to have a backup copy before updating SmartDefense. One case I exp is the update of JPEG vulnerabilities update some time back which caused the FW to drop packets with out of state reason. ;)

[RayPesek]

The reason I asked the question at thet meeting was because I had an SD update break Outlook Web Access, which was in a DMZ. The new update was only peripherally involved with MS networking as I recall, but it sure broke it.

Even with the new update set to Monitor Only, it still blocked authentication. I had to totally un-check the entire section (which I was GREATLY relived to see work!).

A few months later an SK article was issued that described problem I was experiencing. The root cause was that I had the SmartCenter on R55 HFA17 but the enforcement module was on R55 HFA14. There was an incompatibility in the code.

I had never heard of an issue where a down-rev enforcement module caused a problem. I had never applied HFA17 to the enforcement module because it didn't have anything in the release notes that I needed fixed, but the SmartCenter updates did fix problems I was having.

Ray