虚拟SEG错误清单服务器错误故障排除

简介

本文档介绍如何在虚拟安全网关中启用智能许可证时修复升级清单身份验证错误。

先决条件

要求

Cisco 建议您了解以下主题：

• 智能许可证的工作原理
• 安全邮件网关(SEG)管理

使用的组件

本文档中的信息基于以下软件和硬件版本：

• 版本12.0或更高版本上的安全邮件网关(SEG)AsyncOS
• 版本12.0或更高版本上的安全管理设备

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。

问题

邮件安全设备已启用智能许可证，并且具有有效许可证。尝试升级时，将显示以下错误：

"下载升级列表失败：无法通过清单服务器进行身份验证。"

解决方案

1.验证updateconfig下是否配置了正确的清单服务器。

对于虚拟安全邮件网关，正确的清单服务器是端口443上的update-manifests.sco.cisco.com。

确保在防火墙规则中允许此操作。

要查看CLI上的更新配置，请运行命令updateconfig，然后运行隐藏命令dynamichost:

esa> updateconfig

Service (images): Update URL: 
----------------------------------------------------------------------------------------------------------------------
Feature Key updates  
DLP Engine Updates Cisco IronPort Servers 
PXE Engine Updates Cisco IronPort Servers 
Sophos Anti-Virus definitions Cisco IronPort Servers 
IronPort Anti-Spam rules Cisco IronPort Servers 
Outbreak Filters rules Cisco IronPort Servers 
Timezone rules Cisco IronPort Servers 
Enrollment Client Updates (used to fetch certificates for URL Filtering) Cisco IronPort Servers 
Support Request updates Cisco IronPort Servers 
Content Scanner Updates Cisco IronPort Servers 
Geo Countries Updates Cisco IronPort Servers 
External Threat Feeds updates Cisco IronPort Servers 
How-Tos Updates Cisco IronPort Servers 
Notifications component Updates Cisco IronPort Servers 
Smart License Agent Updates Cisco IronPort Servers 
Mailbox Remediation Updates Cisco IronPort Servers 
Talos Updates Cisco IronPort Servers 
Easy Demo service Updates Cisco IronPort Servers 
Cisco IronPort AsyncOS upgrades Cisco IronPort Servers

Service (list): Update URL: 
----------------------------------------------------------------------------------------------------------------------
DLP Engine Updates Cisco IronPort Servers 
PXE Engine Updates Cisco IronPort Servers 
Sophos Anti-Virus definitions Cisco IronPort Servers 
IronPort Anti-Spam rules Cisco IronPort Servers 
Outbreak Filters rules Cisco IronPort Servers 
Timezone rules Cisco IronPort Servers 
Enrollment Client Updates (used to fetch certificates for URL Filtering) Cisco IronPort Servers 
Support Request updates Cisco IronPort Servers 
Content Scanner Updates Cisco IronPort Servers 
Geo Countries Updates Cisco IronPort Servers 
External Threat Feeds updates Cisco IronPort Servers 
How-Tos Updates Cisco IronPort Servers 
Notifications component Updates Cisco IronPort Servers 
Smart License Agent Updates Cisco IronPort Servers 
Mailbox Remediation Updates Cisco IronPort Servers 
Talos Updates Cisco IronPort Servers 
Easy Demo service Updates Cisco IronPort Servers

Service (list): Update URL: 
----------------------------------------------------------------------------------------------------------------------
Cisco IronPort AsyncOS upgrades Cisco IronPort Servers

Update interval: 5m

Alert Interval for Disabled Automatic Engine Updates: 30d

Proxy server: http://64.X.X.X:8080
The proxy server will be used for the following services:
- Feature Key updates
- DLP Engine Updates
- PXE Engine Updates
- Sophos Anti-Virus definitions
- IronPort Anti-Spam rules
- Outbreak Filters rules
- Virus Threat Level updates
- Timezone rules
- Enrollment Client Updates (used to fetch certificates for URL Filtering)
- Support Request updates
- Content Scanner Updates
- Geo Countries Updates
- External Threat Feeds updates
- How-Tos Updates
- Notifications component Updates
- Smart License Agent Updates
- Mailbox Remediation Updates
- Talos Updates
- Easy Demo service Updates
- Cisco IronPort AsyncOS upgrades
- URL Filtering Service
- Shortened URL Support
- Advanced Phishing Protection Support
- Cisco Threat Response
- Cisco Secure Awareness

HTTPS Proxy server: http://64.102.255.40:8080
The HTTPS proxy server will be used for the following services:
- Feature Key updates
- DLP Engine Updates
- PXE Engine Updates
- Sophos Anti-Virus definitions
- IronPort Anti-Spam rules
- Outbreak Filters rules
- Timezone rules
- Enrollment Client Updates (used to fetch certificates for URL Filtering)
- Support Request updates
- Content Scanner Updates
- Geo Countries Updates
- External Threat Feeds updates
- How-Tos Updates
- Notifications component Updates
- Smart License Agent Updates
- Mailbox Remediation Updates
- Talos Updates
- Easy Demo service Updates
- Cisco IronPort AsyncOS upgrades
- SenderBase Network Participation sharing
- URL Filtering Service
- Shortened URL Support
- Cisco Threat Response

Choose the operation you want to perform:
- SETUP - Edit update configuration.
- VALIDATE_CERTIFICATES - Validate update server certificates
- TRUSTED_CERTIFICATES - Manage trusted certificates for updates
[]> dynamichost

Enter new manifest hostname:port
[update-manifests.sco.cisco.com:443]>update-manifests.sco.cisco.com:443

2.许可证验证。

许可证授权状态必须为合规性:

esa> showlicense_smart
[]> SUMMARY

Feature Name                                                            License Authorization Status
----------------------------------------------------------------------------------------------------
Email Security Appliance Anti-Spam License                                         In Compliance
Email Security Appliance Outbreak Filters                                          In Compliance
Email Security Appliance Graymail Safe-unsubscribe                                 Not requested
Email Security Appliance Advanced Malware Protection Reputation                    In Compliance
Email Security Appliance Image Analyzer                                            Not requested
Mail Handling                                                                      In Compliance
Email Security Appliance Sophos Anti-Malware                                       In Compliance
Email Security Appliance PXE Encryption                                            In Compliance
Email Security Appliance Advanced Malware Protection                               In Compliance
Email Security Appliance McAfee Anti-Malware                                       Not requested
Email Security Appliance Intelligent Multi-Scan                                    Not requested
Email Security Appliance External Threat Feeds                                     In Compliance
Email Security Appliance Bounce Verification                                       In Compliance
Email Security Appliance Data Loss Prevention                                      In Compliance

运行命令showlicense以确保存在有效的VLAN。

结束日期不能过期。

esa> showlicense

Virtual License
===============
vln VLNESA74NNNNN
begin_date  dd/mm/yyyy
end_date  dd/mm/yyyy
company Cisco Systems, Inc.
seats 1
country MX
serial XXXX
email XXXXXXX
issue 4dXXXXXXXXXXXXXXX
license_version 1.1

如果获得License has Expired输出，请从Global Licensing获取新的XML文件，其中包含新的到期日期和有效证书。从CLI命令loadlicense上传它。

esa>showlicense




License has Expired




Error with License.

Please try to re-initialize the system with a new license, or contact customer support for help.

3.升级安全邮件网关。

运行upgrade命令并选择所需的映像。

esa> upgrade

Are you sure you want to proceed with upgrade? [N]> y


Choose the operation you want to perform:
- DOWNLOADINSTALL - Downloads and installs the upgrade image (needs reboot).
- DOWNLOAD - Downloads the upgrade image.

[]> download

Upgrades available.
1. AsyncOS 14.2.3 build 027 upgrade For Email, 2023-08-13. This release is a Maintenance Deployment Refresh
2. AsyncOS 14.2.3 build 031 upgrade For Email, 2023-11-02,This release is a Maintenance Deployment Refresh
3. AsyncOS 15.0.0 build 104 upgrade For Email, 2023-08-10, This is a General Deployment release
4. AsyncOS 15.0.1 build 030 upgrade For Email, 2023-11-22, This release is a Maintenance Deployment
[4]> 3


Download of AsyncOS 15.0.0 build 104 upgrade For Email, 2023-08-10, This is a General Deployment release has started in background.

升级必须成功。如果您遇到其他问题，请联系思科TAC。

相关信息

• 了解智能许可概述和电邮与Web安全的最佳实践
• 思科技术支持和下载