Recently due to several issues I had with Sourcefire 6.0 code, I went through downgrade exercise taking it back down to version 5.4. With Sourcefire, there is no simple way to roll back from one version to another. Configuration backup helps with Defense Center however Sensors can not be rolled back to the previous version but only recovered from factory reset so expect the following caveats.
Cisco Sourcefire: 5.4 and 6.0
I started downgrade process by deploying another instance of Virtual Defense Center (DC) version 5.4. That way I’ve continued managing my production Sensors while slowly migrating to the previous version.
Prior to deployment assign static MAC address to a virtual NIC. Otherwise in case of VMware host failover all licenses will become invalid due to MAC address change.
When you do a clean install and try to restore backup without any OS patches you may get the following error.
Download and install patch version as shown on System Information field (version 188.8.131.52 in this case).
After OS verification, you will be prompted for vulnerability database check. By default DC will download the latest component. If the component version does not match you will get the following error.
Vulnerability database component update can not be rolled back. If you install the latest version and your restore fails due to version mismatch you will have to re-image DC.
My backup was done on version 260 and the latest was 261. I had to download the earlier version from Cisco website and install it manually on DC.
It is important to perform the following tasks after successful restore:
- License: All licenses will be installed. If your MAC address did not change they will be active. If it changed then you will need to rehost them on Cisco license portal. The process is very easy and does not take much time.
- Sensors: There is no way to downgrade Sensors but only to recover. Since all of them are still running 6.0 version you will have to remove them from 6.0 DC and run through the recovery process. Sensors populated on 5.4 by restore process will need to be removed and re-registered otherwise communication will fail. Running two DC instances in parallel will give you more time to migrate.
- Policies: All policies will be in place. Just need to reapply them to Sensors once they register.