Fresh install - rules not installed

[WookieeSasquatch]

All,

After a botched 16.5.2 to 16.6.2 upgrade, I did a fresh install of 16.6.2 then restored my backup from 16.5.2.

I noticed blocked activity from IPS was lower than I expected, so I went looking for answers. Suricata only had the very basic ruleset which was ~380 rules and the last updated date was prior to installation (I want to say it was November 2022).

Since there isn't a GUI option to update rules, I ran /usr/share/untangle/bin/intrusion-prevention-get-updates which completed in about 80 seconds and had a fair number of rules. However, the stdout showed this just before completing. "main: Failure on url = https://ids.untangle.com/suricatasignatures6.patch.tar.gz". I can access that URL just fine from a browser and there are no DNS resolution issues directly on the Untangle box, so I'm not sure what is going on. I suspect I am missing rules as a result. I opened a support ticket but figured posting here might help.

[BarryDingle]

I believe they've even changed the default rules that install on a fresh install. I just prepped an Untangle box fresh last night, and noticed there are only three categories installed now:

Low memory, Medium memory, and High memory. The default rules that used to exist for Critical Priority, High Priority, Medium Priority, and Low Priority are now missing on a fresh install. Not sure if this was intentional, but I typically tick the boxes for Critical and High Priority and Low, Medium, and High memory, which includes something like 20k rules that are configured to block... Anyone know if this change was intentional, or if there's just a bug with the latest installer for NG Firewall?

Edit: I've submitted the question to support. I'll report back when I've heard back from them.

Edit2: I've heard back from Graeme at Untangle support and he says that somehow Intrusion Prevention did not install properly. He is going to have one of the engineers look at it tomorrow. I'll keep updating this post as I find out more.

Edit3: Came in this morning and logged into the box and it appears fixed. It says the last update to the signatures was this morning at 1:00AM-ish. I'm wondering if I didn't just need to wait for it to download the signature updates automatically... Either way, the issue is solved!