How to uninstall IDP module in SRX

I would like to share my experiment on uninstalling of IDP module on an SRX100 device. Please take this as a test case and use it at your own discretion as I just test a manual removal of files and re-installed IDP module.

1) First disable IDP process

root@ankara# set system processes idp-policy disable

2) Delete everything related to idp in the configuration

root@ankara# delete security idp

3) And commit the changes

root@ankara# commit and-quit
commit complete
Exiting configuration mode
root@ankara>start shell
root@ankara%

4) Below are the list of files related to IDP

root@ankara% ls -l /cf/var/db/scripts/commit
total 240
-rw-r--r-- 1 root wheel 8628 Dec 27 15:17 DMZ_Services
-rw-r--r-- 1 root wheel 5542 Dec 27 15:17 DNS_Service
-rw-r--r-- 1 root wheel 8709 Dec 27 15:17 File_Server
-rw-r--r-- 1 root wheel 8143 Dec 27 15:17 Getting_Started
-rw-r--r-- 1 root wheel 10878 Dec 27 15:17 IDP_Default
-rw-r--r-- 1 root wheel 9523 Dec 27 15:17 Recommended
-rw-r--r-- 1 root wheel 7660 Dec 27 15:17 Web_Server
-rw-r--r-- 1 root wheel 55842 Dec 27 15:20 templates.xsl

5) I have removed all of these files along with sec-download and nsm-download content.

root@ankara% rm -rf /cf/var/db/scripts/commit/*
root@ankara% rm -rf /cf/var/db/idpd/db/*
root@ankara% rm -rf /cf/var/db/idpd/sec-download/*
root@ankara% rm -rf /cf/var/db/idpd/nsm-download/*
root@ankara% rm -rf /cf/var/db/idpd/sec-repository/*

6) Reboot the box. If you dont´t reboot the box, you will still have something related to old IDP policy.

root@ankara> request system reboot

After all of these I re-installed IDP as described in my other post and I have got it working.
I have received a temporary error during my installation attempt like below;
opening file(/var/db/idpd/sec-download/sub-download/SignatureUpdate.xml) failed;No such file or directory
But after a few attempts it resolved:) maybe I had done a mistake.

Good luck!

About: rtoodtoo

Worked for more than 10 years as a Network/Support Engineer and also interested in Python, Linux, Security and SD-WAN, currently living in the Netherlands and works as a Network Support Engineer. // JNCIE-SEC #223 / RHCE / PCNSE


2 thoughts on “How to uninstall IDP module in SRX”

  1. you can try to run commands below to fix your problem in 6):
    “request security idp security-package download policy-templates”
    szym

You have a feedback?

This site uses Akismet to reduce spam. Learn how your comment data is processed.