Recovery Steps for USG FLEX/ATP Series Application Patrol Signature Issue
The App Patrol signature release V220.127.116.1120310.0 may create parsing error on device for both on-premises and on-cloud modes, application patrol daemon will not work well after updating this new signature though the rest of UTM features keep running. However, the worst case is that device may get stuck if device did rebooting further no matter manually or by schedule
Follow the instructions to recover the affected device temporarily.
1. Connect the device directly via the console port using a terminal emulation program. Reboot the device and enter debug mode.
2. Switch to another firmware partition. Type atcd 1 to use firmware partition 1.
3. Type atgo to boot up device.
- If the device is still stuck in reboot loop, repeat the step 1 and step 2 to retry. In step 2, type atcd 2 to use firmware partition 2 to boot up.
4. After the device boots up successfully, access the device via FTP from LAN to get the previous startup-configuration file.
Note: If you are unable to access the device using the latest administrative account, click here to reset the password.
5. Go to /standby_conf and download startup-config.conf. This is the latest configuration file device using before meeting the reboot issue.
6. If you want to apply this configuration file to device, you must:
- Upgrade the same firmware version as that one before the issue happen to Running partition. Do not upgrade to Standby partition to avoid the issue happening again.
- After you completed upgrade firmware, upload and apply the startup-config.conf that you downloaded in step 5.
7. We fix the reboot issue in ZLD5.21 patch 1. Do NOT reboot to the Standby partition until you get the fixed patch.
8. If the device cannot boot up with both firmware partitions, use firmware recovery to recover the device using version 5.21 P1. See Appendix 3. Firmware Recovery on page 55 in the release note.
9. In the process of firmware recovery, if you find the following error messages on console, check Windows Firewall settings and disable Windows Firewall temporarily on your laptop.
Recovery Steps for Nebula USG FLEX/ATP Series Application Patrol Signature Issue
ZLD 5.21P1 should be installed on any device compatible with it?at which time zone of march 16?0
This does not work for Nebula based units, because as soon as you get them online they update and get hung in the same spot.
"load av threat info..........................."1
This doesn't work, firmware gets stuck again after upgrade from reset.1
BoJack said:This does not work for Nebula based units, because as soon as you get them online they update and get hung in the same spot.
"load av threat info..........................."
As we removed the signatures, this should not be the case.. if you still encounter issues, please visit our teams' session maybe tomorrow or send in a ticket to help you.. @ https://support.zyxel.eu
SimplyRem said:This doesn't work, firmware gets stuck again after upgrade from reset.if you still encounter issues, please visit our teams' session maybe tomorrow or send in a ticket to help you.. @ https://support.zyxel.eu0
Zyxel_Stanley Posts: 1,296Hi @mMontana
The firmware will be available by Wednesday.(UTC+8)
If your device updated signature(18.104.22.16820310.0) and did not reboot yet, then you can upgrade ZLD5.21 P1 firmware prevent the symptom.
If you confirmed swap between 2 partitions and doesn't work for you, then you still can recover database on your device. The steps will flush all of exist files as default unit include configuration, installed CA...etc.
1. Initial database recover process.
Connect the device directly via the console port using a terminal emulation program. And also connect the device on 1st Ethernet port with your PC. Reboot the device.
- Enter to debug mode
- Enter "atcd 1"
- Enter "atkz -f -l 192.168.1.1"
- Enter "atgof"
- After entering "atgof" system will go to restart and initial FTP server on device.
2. Upload Database file to device
- Change your PC IP address as 192.168.1.1.2 and mask 255.255.255.0
- Access device by FTP(by anonymous) and upload XXXX.db file.
- System will start to recover as default database.
After finishing the steps, you can do power recycle to make sure your device could boot up successfully.0
This still does NOT work for Nebula units.
Once recovered and they boot, they immediately download 5.21(ABUH.0) and reboot, and again get stuck.
Why hasn't 5.21(ABUH.1) been made available to Nebula yet like the standalone units have.
Why hasn't a "new" App Patrol signature version been released that simply uses that last good version with a newer name/version number.0
Nebula Update will be 3/16 via Nebula Update Online.
The signature update broke the module so we can´t upgrade/downgrade the Signature, this is why an update will be mandatory.
This is really, really, really, really frustrating. Of course not knowing about the issue, I rebooted my Nebula ATP 500 several hours ago and am now stuck without internal and external network. Will try the recovery process tonight after getting the required cable and software. But gentlemen, this is an incredible no-go. Get your act together.1
Agree with Trilogy. This is the height of incompetence.
- 8.4K All Categories
- 1.6K Nebula
- 70 Nebula Ideas
- 57 Nebula Status and Incidents
- 4.5K Security
- 226 Security Ideas
- 980 Switch
- 46 Switch Ideas
- 870 WirelessLAN
- 22 WLAN Ideas
- 5.1K Consumer Product
- 156 Service & License
- 280 News and Release
- 97 Success Stories
- 58 Security Advisories
- 13 Education Center
- 579 FAQ
- 262 Nebula FAQ
- 160 Security FAQ
- 76 Switch FAQ
- 74 WirelessLAN FAQ
- 7 Consumer Product FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 69 About Community
- 46 Security Highlight