Release Notes for Cisco Intrusion Prevention System 5.1(7)E1
Available Languages
Table Of Contents
Release Notes for Cisco Intrusion Prevention System 5.1(7)E1
IPS Management and Event Viewers
Cisco Security Intelligence Operations
Before Upgrading to Cisco IPS 5.1(7)E1
Copying and Restoring the Configuration File Using a Remote Server
Obtaining Software on Cisco.com
Major and Minor Updates, Service Packs, and Patch Releases
Signature/Virus Updates and Signature Engine Updates
Recovery, Manufacturing, and System Images
Upgrading to Cisco IPS 5.1(7)E1
After Upgrading to Cisco IPS 5.1(7)E1
Increasing the Memory Size of the Java Plug-In
Java Plug-In on Linux and Solaris
Service Programs for IPS Products
Obtaining and Installing the License Key
Connecting IPS-4240 to a Cisco 7200 Series Router
Obtaining Documentation and Submitting a Service Request
Release Notes for Cisco Intrusion Prevention System 5.1(7)E1
Revised: July 9, 2012Contents
•
IPS Management and Event Viewers
•
•
•
•
•
•
Caution
Signature Engine Updates
Cisco introduced signature engine updates to the IPS Version 5.1 train for the first time with the release of 5.1(5)E1.Signature engine updates allow us to deliver new inspection engines more rapidly, which increases the overall security effectiveness of the sensor. We recommend that you treat signature engine updates like signature updates and install them immediately.
As a result of the introduction of signature engine, the IPS signature engine update nomenclature changed from IPS-sig-S2XX-minreq-5.1-4.pkg to IPS-sig-S2XX-req-E1.pkg to reflect the new signature engine requirements (E1).
With each signature engine release, the latest service pack and system image files are repackaged to include the new engine update. To install a signature engine update, your sensor must be running the required IPS version, which is contained in the filename of the signature engine update package. For example, to install the IPS-K9-engine-E1-req-5.1-5.pkg signature engine update, your sensor must be running IPS version 5.1(5) or later.
If you are running an earlier IPS version, such as IPS version 5.1(4), you can upgrade the sensor to 5.1(7)E1 using the service pack files.
For More Information
For detailed information on IPS signature file naming, see IPS Software Versioning.
IPS 5.1(7)E1 File List
The following files are part of Cisco IPS 5.1(7)E1:
•
–
•
–
–
–
–
•
–
–
–
–
–
–
–
–
•
–
–
•
–
For More Information
•
•
•
•
•
Supported Platforms
Cisco IPS 5.1(7)E1 is supported on the following platforms:
•
•
•
•
•
•
•
•
•
•
•
Supported Servers
The following FTP servers are supported for IPS software updates:
•
•
•
•
•
The following HTTP/HTTPS servers are supported for IPS software updates:
•
•
Note
ROMMON and TFTP
ROMMON uses TFTP to download an image and launch it. TFTP does not address network issues such as latency or error recovery. It does implement a limited packet integrity check so that packets arriving in sequence with the correct integrity value have an extremely low probability of error. But TFTP does not offer pipelining so the total transfer time is equal to the number of packets to be transferred times the network average RTT. Because of this limitation, we recommend that the TFTP server be located on the same LAN segment as the sensor. Any network with an RTT less than a 100 milliseconds should provide reliable delivery of the image. Be aware that some TFTP servers limit the maximum file size that can be transferred to ~32 MB.
For More Information
•
•
IPS Management and Event Viewers
Use IDM, ASDM, or the CLI to configure 5.1(7)E1 sensors.
Note
Use the following tools for monitoring 5.1(7)E1 sensors:
•
•
•
•
Note
Note
For More Information
For the procedure for configuring a new SSL certificate, for the CLI, refer to Configuring TLS, and for IDM, refer to Adding Trusted Hosts.
New and Changed Information
Cisco IPS 5.1(7)E1 contains the following new features:
•
•
IPS-4260 supports the Intel 4-port PCI-Express card with hardware bypass. This PCI card supports hardware bypass only between ports 0 and 1 and between ports 2 and 3. Hardware bypass complements the existing software bypass feature in IPS 5.1(7)E1.
•
The ICS service augments Cisco's current IPS Signature Service by delivering more rapid and focused response to breaking threats.
•
The sensor can perform inline sensing between one or more VLAN pairs on a single sensor interface. Cisco Catalyst line cards that connect directly to the switch backplane and appliances that connect to an external port of the switch can use this feature.
Note
•
A rate limit restricts the amount of a specified type of traffic that is allowed on a network device interface to a percentage of maximum bandwidth capacity. Traffic that exceeds this percentage is dropped by the network device. A rate limit can restrict traffic to a specified target host, or to all traffic that crosses the configured interface/directions. You can rate limit permanently or for a specified amount of time. A rate limit is identified by a protocol, an optional destination address, and an optional data value.
•
Two new deny attacker event actions have been added in the 5.1(7)E1 release: Deny Attacker Service Pair Inline and Deny Attacker Victim Pair Inline. A new Request Rate Limit event action with a parameter that lets you specify a percentage of traffic from a denied attacker has been added to support rate limiting.
•
IPS 5.1(7)E1 sensors can now monitor GRE and IPV4-inIPV4 encapsulated traffic.
For More Information
For detailed information on the new naming conventions, see IPS Software Versioning.
Cisco Security Intelligence Operations
The Cisco Security Intelligence Operations site on Cisco.com provides intelligence reports about current vulnerabilities and security threats. It also has reports on other security topics that help you protect your network and deploy your security systems to reduce organizational risk.
You should be aware of the most recent security threats so that you can most effectively secure and manage your network. Cisco Security Intelligence Operations contains the top ten intelligence reports listed by date, severity, urgency, and whether there is a new signature available to deal with the threat.
Cisco Security Intelligence Operations contains a Security News section that lists security articles of interest. There are related security tools and links.
You can access Cisco Security Intelligence Operations at this URL:
http://tools.cisco.com/security/center/home.x
Cisco Security Intelligence Operations is also a repository of information for individual signatures, including signature ID, type, structure, and description.
You can search for security alerts and signatures at this URL:
http://tools.cisco.com/security/center/search.x
Before Upgrading to Cisco IPS 5.1(7)E1
This section describes what to do before upgrading your sensor, and contains the following topics:
•
•
•
Perform These Tasks
Before you upgrade your sensors to Cisco IPS 5.1(7)E1, make sure you have performed the following tasks:
•
•
If you need to downgrade a service pack or signature update, you will know what versions you had, and you can then apply the configuration you saved when you backed up your configuration.
Note
•
•
For More Information
•
•
•
•
•
Copying and Restoring the Configuration File Using a Remote Server
Note
Use the copy [/erase] source_url destination_url keyword command to copy the configuration file to a remote server. You can then restore the current configuration from the remote server. You are prompted to back up the current configuration first.
Options
The following options apply:
•
This keyword only applies to the current-config; the backup-config is always overwritten. If this keyword is specified for destination current-config, the source configuration is applied to the system default configuration. If it is not specified for the destination current-config, the source configuration is merged with the current-config.
•
•
•
•
The exact format of the source and destination URLs varies according to the file. Here are the valid types:
•
ftp:[//[username@] location]/relativeDirectory]/filename
ftp:[//[username@]location]//absoluteDirectory]/filename
•
scp:[//[username@] location]/relativeDirectory]/filename
scp:[//[username@] location]//absoluteDirectory]/filename
Note
•
http:[[/[username@]location]/directory]/filename
•
https:[[/[username@]location]/directory]/filename
Note
Caution
Backing Up the Current Configuration to a Remote Server
To back up your current configuration to a remote server, follow these steps:
Step 1
Step 2 Back up the current configuration to the remote server.sensor# copy current-config scp://user@192.0.2.0//configuration/cfg current-configPassword: ********Warning: Copying over the current configuration may leave the box in an unstable state.Would you like to copy current-config to backup-config before proceeding? [yes]:Step 3 Enter yes to copy the current configuration to a backup configuration.cfg 100% |************************************************| 36124 00:00
Restoring the Current Configuration From a Backup File
To restore your current configuration from a backup file, follow these steps:
Step 1
Step 2 Back up the current configuration to the remote server.sensor# copy scp://user@192.0.2.0//configuration/cfg current-configPassword: ********Warning: Copying over the current configuration may leave the box in an unstable state.Would you like to copy current-config to backup-config before proceeding? [yes]:Step 3 Enter yes to copy the current configuration to a backup configuration.cfg 100% |************************************************| 36124 00:00Warning: Replacing existing network-settings may leave the box in an unstable state.Would you like to replace existing network settings (host-ipaddress/netmask/gateway/access-list) on sensor before proceeding? [no]:sensor#Step 4
For More Information
•
•
Obtaining Software on Cisco.com
You can find major and minor updates, service packs, signature and signature engine updates, system and recovery files, firmware upgrades, and readmes on the Download Software site on Cisco.com.
Note
Signature updates are posted to Cisco.com approximately every week, more often if needed. Service packs are posted to Cisco.com as needed. Major and minor updates are also posted periodically. Check Cisco.com regularly for the latest IPS software.
Note
To download software on Cisco.com, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Note
Step 7
The available files appear in a list in the right side of the window. You can sort by file name, file size, memory, and release date. And you can access the Release Notes and other product documentation.
Step 8
Step 9
Step 10
The first time you download a file from Cisco.com, you must fill in the Encryption Software Export Distribution Authorization form before you can download the software.
•
•
If you previously filled out the Encryption Software Export Distribution Authorization form, and read and accepted the Cisco Systems Inc. Encryption Software Usage Handling and Distribution Policy, these forms are not displayed again. The File Download dialog box appears.
Step 11
Step 12
Note
IPS Software Versioning
This section describes the various IPS software files, and contains the following sections:
•
•
•
•
Major and Minor Updates, Service Packs, and Patch Releases
Figure 1 illustrates what each part of the IPS software file represents for major and minor updates, service packs, and patch releases.
Figure 1 IPS Software File Name for Major and Minor Updates, Service Packs, and Patch Releases
Major Update
Contains new functionality or an architectural change in the product. For example, the IPS 5.0 base version includes everything (except deprecated features) since the previous major release (the minor update features, service pack fixes, and signature updates) plus any new changes. Major update 5.0(1) requires 4.x. With each major update there are corresponding system and recovery packages.
Note
Minor Update
Incremental to the major version. Minor updates are also base versions for service packs. The first minor update for 5.0 is 5.1(1). Minor updates are released for minor enhancements to the product. Minor updates contain all previous minor features (except deprecated features), service pack fixes, signature updates since the last major version, and the new minor features being released. You can install the minor updates on the previous major or minor version (and often even on earlier versions). The minimum supported version needed to upgrade to the newest minor version is listed in the Readme that accompanies the minor update. With each minor update there are corresponding system and recovery packages.
Service Packs
Cumulative following a base version release (minor or major). Service packs are used for the release of defect fixes with no new enhancements. Service packs contain all service pack fixes since the last base version (minor or major) and the new defect fixes being released. Service packs require the minor version. The minimum supported version needed to upgrade to the newest service pack is listed in the Readme that accompanies the service pack. Service packs also include the latest engine update. For example, if service pack 6.0(3) is released, and E3 is the latest engine level, the service pack is released as 6.0(3)E3.
Patch Release
Used to address defects that are identified in the upgrade binaries after a software release. Rather than waiting until the next major or minor update, or service pack to address these defects, a patch can be posted. Patches include all prior patch releases within the associated service pack level. The patches roll into the next official major or minor update, or service pack.
Before you can install a patch release, the most recent major or minor update, or service pack must be installed. For example, patch release 5.0(1p1) requires 5.0(1).
Note
For More Information
For a table listing the types of files with examples of filenames and corresponding software releases, see 5.1 Software Release Examples.
Signature/Virus Updates and Signature Engine Updates
Figure 2 illustrates what each part of the IPS software file represents for signature/virus updates.
Figure 2 IPS Software File Name for Signature/Virus Updates,
Signature/Virus Updates
Executable file containing a set of rules designed to recognize malicious network activities. Signature updates are released independently from other software updates. Each time a major or minor update is released, you can install signature updates on the new version and the next oldest version for a period of at least six months. Signature updates are dependent on a required signature engine version. Because of this, a req designator lists the signature engine required to support a particular signature update.
A virus component for the signature updates is packaged with the signature update. Virus updates are generated by Trend Microsystems for use by the Cisco Intrusion Containment System (Cisco ICS). Once created for use by Cisco ICS, they are later be incorporated into standard Cisco signature updates.
Figure 3 illustrates what each part of the IPS software file represents for signature engine updates.
Figure 3 IPS Software File Name for Signature Engine Updates
Signature Engine Updates
Executable files containing binary code to support new signature updates. Signature engine files require a specific service pack, which is also identified by the req designator.
Recovery, Manufacturing, and System Images
Figure 4 illustrates what each part of the IPS software file represents for recovery and system image filenames.
Figure 4 IPS Software File Name for Recovery and System Image Filenames
Recovery and system images contain separate versions for the installer and the underlying application. The installer version contains a major and minor version field.
Installer Major Version
The major version is incremented by one of any major changes to the image installer, for example, switching from .tar to rpm or changing kernels.
Installer Minor Version
The minor version can be incremented by any one of the following:
•
•
5.1 Software Release Examples
Table 1 lists platform-independent IDS 5.1 software release examples. Refer to the Readmes that accompany the software files for detailed instructions on how to install the files.
Table 1 Platform-Independent Release Examples
Signature update1
Weekly
sig
S700
IPS-sig-S700-req-E1.pkg
Signature engine update2
As needed
engine
E1
IPS-engine-E1-req-5.1-3.pkg
Service packs3
Semi-annually
or as needed—
5.1(3)
IPS-K9-5.1-3-E1.pkg
Minor update4
Annually
—
5.1(1)
IPS-K9-5.1-1-E1.pkg
Major update5
Annually
—
5.0(1)
IPS-K9-6.0-1-E1.pkg
Patch release6
As needed
patch
5.0(1p1)
IPS-K9-patch-5.1-1pl-E1.pkg
Recovery package7
Annually or as needed
r
1.1-5.0(1)
IPS-K9-r-1.1-a-5.1-1-E1.pkg
1 Signature updates include the latest cumulative IPS signatures.
2 Signature engine updates add new engines or engine parameters that are used by new signatures in later signature updates.
3 Service packs include defect fixes.
4 Minor versions include new minor version features and/or minor version functionality.
5 Major versions include new major version functionality or new architecture.
6 Patch releases are for interim fixes.
7 The r 1.1 can be revised to r 1.2 if it is necessary to release a new recovery package that contains the same underlying application image. If there are defect fixes for the installer, for example, the underlying application version may still be 5.0(1), but the recovery partition image will be r 1.2.
Table 2 describes platform-dependent software release examples.
Table 2 Platform-Dependent Release Examples
System image1
Annually
sys
Separate file for each sensor platform
IPS-4240-K9-sys-1.1-a-5.1-1-E1.img
Maintenance partition image2
Annually
mp
IDSM-2
c5svc-mp.2-1-2.bin.gz
Bootloader
As needed
bl
NM-CIDS
servicesengine-boot-1.0-4.bin
1 The system image includes the combined recovery and application image used to reimage an entire sensor.
2 The maintenance partition image includes the full image for the IDSM-2 maintenance partition. The file is installed from but does not affect the IDSM-2 application partition.
Table 3 describes the platform identifiers used in platform-specific names.
Note
For More Information
For instructions on how to access these files on Cisco.com, see Obtaining Software on Cisco.com.
Upgrading the IDS-4210 Memory
IDS-4210, IDS-4210-K9, and IDS-4210-NFR must have 512 MB of RAM to support Cisco IPS 5.x. If you are upgrading an existing IDS-4210, IDS-4210-K9, or IDS-4210-NFR to 5.x, you must insert one additional 256-MB DIMM (part number IDS-4210-MEM-U) to upgrade the memory to the required 512 MB minimum.
Note
Caution
To upgrade the memory, follow these steps:
Step 1
Step 2
sensor# reset powerdownWait for the power down message before continuing with Step 3.
Note
Step 3
Step 4
Step 5
Step 6
Step 7
Note
Step 8
Step 9 Install the new DIMM, by positioning the DIMM into the socket and pressing it into place.
Note
Step 10
Step 11
Note
For More Information
For more information about ESD-controlled environments, refer to Working in an ESD Environment.
Upgrading the IDS-4215 BIOS
The BIOS/ROMMON upgrade utility (IDS-4215-bios-5.1.7-rom-1.4.bin) upgrades the BIOS of IDS-4215 to version 5.1.7 and the ROMMON to version 1.4.
To upgrade the BIOS and ROMMON on IDS-4215, follow these steps:
Step 1
Note
Step 2
While rebooting, IDS-4215 runs the BIOS POST. After the completion of POST, the console displays the message:
Evaluating Run Options ...for about 5 seconds.Step 3
The console display resembles the following:
CISCO SYSTEMS IDS-4215Embedded BIOS Version 5.1.3 05/12/03 10:18:14.84Compiled by ciscouserEvaluating Run Options ...Cisco ROMMON (1.2) #0: Mon May 12 10:21:46 MDT 2003Platform IDS-42150: i8255X @ PCI(bus:0 dev:13 irq:11)1: i8255X @ PCI(bus:0 dev:14 irq:11)Using 1: i82557 @ PCI(bus:0 dev:14 irq:11), MAC: 0000.c0ff.ee01Use ? for help.rommon>Step 4 If necessary, change the port number used for the TFTP download:rommon> interface port_numberThe port in use is listed just before the rommon prompt. Port 1 (default port) is being used as indicated by the text,
Using 1: i82557 @ PCI(bus:0 dev:14 irq:11), MAC: 0000.c0ff.ee01.
Note
Step 5
rommon> address ip_address
Note
Step 6 Specify the TFTP server IP address:rommon> server ip_addressStep 7
rommon> gateway ip_addressStep 8
rommon> ping server_ip_addressrommon> ping serverStep 9
rommon> file filenameExample:
rommon> file IDS-4215-bios-5.1.7-rom-1.4.bin
Note
Step 10
rommon> tftpStep 11
IDS-4215 reboots when the update is complete.
Caution
For More Information
For the procedure for locating software on Cisco.com, see Obtaining Software on Cisco.com
Upgrading to Cisco IPS 5.1(7)E1
This section provides information on upgrading to IPS 5.1(7)E1. It contains the following topics:
•
Upgrade Notes and Caveats
The following upgrade notes and caveats apply to upgrading from 4.x to 5.1(7)E1:
•
•
•
•
•
If Auto Update is configured on the IPS-4260, it does not install the 4260 files because it does not recognize them. Use the CLI or IDM to install the 5.1(7)E1 service pack.
Note
•
If you try to upgrade a 4.0 sensor to 5.0, you receive an error that Analysis Engine is not running rather than an error that the sensor cannot be upgraded from 4.0 to 5.0:
sensor#upgrade scp://user@10.1.1.1/upgrades/IPS-K9-maj-5.0-1-S148.rpm.pkgPassword: ********Warning: Executing this command will apply a major version upgrade to the application partition. The system may be rebooted to complete the upgrade.Continue with upgrade? : yesError: AnalysisEngine is not running. Please reset box and attempt upgrade again.If you receive this error, you must upgrade from 4.0 to 4.1 and then to 5.0. Or you can use the recovery CD (if your sensor has a CD-ROM) or the system image file to reimage directly to version 5.1(7)E1. You can reimage a 4.0 sensor to 5.0 because the reimage process does not check to see what version was previously installed.
•
•
•
•
•
•
•
For More Information
•
•
•
•
Upgrading to 5.1(7)E1
To upgrade the sensor, follow these steps:
Step 1
Note
Note
Caution
Caution
Step 2
Step 3 Upgrade the sensor:sensor# configure terminalsensor(config)# upgrade scp://tester@10.1.1.1//upgrade/IPS-K9-5.1-7-E1.pkgEnter password: ********Re-enter password: ********Step 4 Type yes to complete the upgrade.
Note
Step 5
sensor# show versionApplication Partition:Cisco Intrusion Prevention System, Version 5.1(7)E1Host:Realm Keys key1.0Signature Definition:Signature Update S278.0 2007-03-28Virus Update V1.2 2005-11-24OS Version: 2.4.26-IDS-smp-bigphysPlatform: IDS-4210Serial Number: 8R2D501No license presentSensor up-time is 12 days.Using 500482048 out of 510238720 bytes of available memory (98% usage)system is using 17.4M out of 29.0M bytes of available disk space (60% usage)application-data is using 36.8M out of 174.7M bytes of available disk space (22%usage)boot is using 35.3M out of 75.9M bytes of available disk space (49% usage)application-log is using 532.6M out of 2.8G bytes of available disk space (20% usage)MainApp 2007_FEB_02_15_58 (Release) 2007-02-02T16:04:00-0600 RunningAnalysisEngine 2007_FEB_02_15_58 (Release) 2007-02-02T16:04:00-0600 RunningCLI 2007_FEB_02_15_58 (Release) 2007-02-02T16:04:00-0600Upgrade History:IPS-K9-sp-5.1-7-E1 15:58:00 UTC Fri Feb 02 2007Recovery Partition Version 1.1 - 5.1(7)E1sensor#
For More Information
•
•
•
Installing the ISO Image File
Note
The Recovery ISO Image is for IDS-4235 and IDS-4250 sensors only.
To create the recovery CD for the ISO image for IDS-4235 and IDS-4250, follow these steps:
Step 1
Step 2 Enter the following command:host# cdrecord -v speed=6 dev=0,0 IPS-K9-cd-1.1-a-6.0-5-E2.isohost# cdrecord -v speed=6 dev=0,0 IPS-K9-cd-1.1-a-6.0-5-E3.isohost# cdrecord -v speed=6 dev=0,0 IPS-K9-cd-1.1-a-6.0-4-E2.isohost# cdrecord -v speed=6 dev=0,0 IPS-K9-cd-1.1-a-6.0-4a-E1.isohost# cdrecord -v speed=6 dev=0,0 IPS-K9-cd-1.1-a-6.0-2-E1.isohost# cdrecord -v speed=6 dev=0,0 IPS-K9-cd-1.1-a-6.0-3-E1.isohost# cdrecord -v speed=6 dev=0,0 IPS-K9-cd-1.1-a-5.1-7-E1.isoStep 3 Follow the command line arguments for cdrecord.
Note
Step 4
For More Information
For the procedure for using a recovery CD to install images, refer to Using the Recovery/Upgrade CD.
After Upgrading to Cisco IPS 5.1(7)E1
This section provides information about what to do after you install IPS 5.1(7)E1. It contains the following topics:
•
Comparing Configurations
Compare your backed up and saved 5.0 configuration with the output of the show configuration command after upgrading to 5.1(7)E1 to verify that all the configuration has been properly converted.
Note
Caution
SSL Certificate
If necessary import the new SSL certificate for the upgraded sensor in to each tool being used to monitor the sensor.
For More Information
For the CLI procedure, refer to Configuring TLS, or for the IDM procedure, refer to Configuring Certificates.
Increasing the Memory Size of the Java Plug-In
To correctly run IDM, your browser must have Java Plug-in 1.4.2 or 1.5 installed. By default the Java Plug-in allocates 64 MB of memory to IDM. IDM can run out of memory while in use, which can cause IDM to freeze or display blank screens. Running out of memory can also occur when you click Refresh. An
OutofMemoryErrormessage appears in the Java console whenever this occurs. You must change the memory settings of Java Plug-in before using IDM. The mandatory minimum memory size is 256 MB.
Note
This section contains the following topics:
•
Java Plug-In on Windows
To change the settings of Java Plug-in on Windows for Java Plug-in 1.4.2 and 1.5, follow these steps:
Step 1
Step 2
Step 3
a.
b.
c.
d.
Step 4
a.
b.
c.
d.
e.
Java Plug-In on Linux and Solaris
To change the settings of Java Plug-in 1.4.2 or 1.5 on Linux and Solaris, follow these steps:
Step 1
Step 2
Note
Note
Step 3
a.
b.
c.
Step 4
a.
b.
c.
d.
Logging In to IDM
IDM is a web-based, Java Web Start application that enables you to configure and manage your sensor. The web server for IDM resides on the sensor. You can access it through Internet Explorer or Firefox web browsers.
To log in to IDM, follow these steps:
Step 1
https:// sensor_ip_address
Note
Note
A Security Alert dialog box appears.
Step 2
Step 3
Step 4
The JAVA Web Start progress dialog box appears.
The IDM on ip_address dialog box appears.
Step 5
Note
The Cisco IDM Launcher dialog box appears.
Step 6
Note
IDM begins to load.
If you change panes from Home to Configuration or Monitoring before IDM has complete initialization, a Status dialog box appears with the following message:
Please wait while IDM is loading the current configuration from the sensor.The main window of IDM appears.
Note
For More Information
•
•
Licensing the Sensor
This section describes how to obtain a license key and how to license the sensor using the CLI or IDM. It contains the following topics:
•
•
Understanding the License
Although the sensor functions without the license, you must have a license to obtain signature updates. To obtain a license, you must have a Cisco Service for IPS service contract. Contact your reseller, Cisco service or product sales to purchase a contract.
Note
You can view the status of the IPS subscription license key on the Licensing panel in IDM. You can obtain a license key from the Cisco.com licensing server, which is then delivered to the sensor. Or, you can update the sensor license key from a license key provided in a local file.
You must know your IPS device serial number to obtain a license key. You can find the IPS device serial number in by clicking Configuration > Licensing, or through the CLI by using the show version command.
Whenever you start IDM, a dialog box informs you of your license status—whether you have a trial, invalid, or expired license key. With no license key, an invalid license key, or an expired license key, you can continue to use but you cannot download signature updates.
When you enter the CLI, you receive the following message if there is no license installed:
***LICENSE NOTICE***There is no license key installed on the system.Please go to http://www.cisco.com/go/license to obtain a new license or install a license.You will continue to see this message until you have installed a license. Go to http://www.cisco.com/go/license and click IPS Signature Subscription Service to apply for a license.
For More Information
•
•
Service Programs for IPS Products
You must have a Cisco Services for IPS service contract for any IPS product so that you can download a license key and obtain the latest IPS signature updates. If you have a direct relationship with Cisco Systems, contact your account manager or service account manager to purchase the Cisco Services for IPS service contract. If you do not have a direct relationship with Cisco Systems, you can purchase the service account from a one-tier or two-tier partner.
When you purchase the following IPS products you must also purchase a Cisco Services for IPS service contract:
•
•
•
•
•
For ASA products, if you purchased one of the following ASA products that do not contain IPS, you must purchase a SMARTnet contract:
•
•
•
•
•
•
•
•
•
Note
If you purchased one of the following ASA products that ships with the AIP-SSM installed or if you purchased AIP-SSM to add to your ASA product, you must purchase the Cisco Services for IPS service contract:
•
•
•
•
•
•
Note
For example, if you purchased an ASA-5510 and then later wanted to add IPS and purchased an ASA-SSM-AIP-10-K9, you must now purchase the Cisco Services for IPS service contract.
After you have the Cisco Services for IPS service contract, you must also have your product serial number to apply for the license key.
Caution
For More Information
For the procedure for obtaining and installing the License key, see Obtaining and Installing the License Key.
Obtaining and Installing the License Key
You can install the license key through the CLI or IDM. This section contains the following topics:
Using IDM
To obtain and install the license key, follow these steps:
Step 1
Step 2
The Licensing pane displays the status of the current license. If you have already installed your license, you can click Download to save it if needed.
Step 3
•
IDM contacts the license server on Cisco.com and sends the server the serial number to obtain the license key. This is the default method. Go to Step 4.
•
To use this option, you must apply for a license key at this URL: www.cisco.com/go/license.
The license key is sent to you in e-mail and you save it to a drive that IDM can access. This option is useful if your computer cannot access Cisco.com. Go to Step 7.
Step 4 Click Update License.The Licensing dialog box appears.
Step 5
The Status dialog box informs you that the sensor is trying to connect to Cisco.com. An Information dialog box confirms that the license key has been updated.
Step 6
Step 7
Step 8
Caution
Your license key will be sent to the e-mail address you specified.
Step 9
Step 10
Step 11
Step 12
Step 13
The Select License File Path dialog box appears.
Step 14
Step 15
Using the CLI
Use the copy source_url license_file_name license-key command to copy the license file to your sensor.
The following options apply:
•
•
•
•
Note
The exact format of the source and destination URLs varies according to the file. Here are the valid types:
•
ftp:[//[username@] location]/relativeDirectory]/filename
ftp:[//[username@]location]//absoluteDirectory]/filename
•
scp:[//[username@] location]/relativeDirectory]/filename
scp:[//[username@] location]//absoluteDirectory]/filename
Note
•
http:[[/[username@]location]/directory]/filename
•
https:[[/[username@]location]/directory]/filename
Note
To install the license key, follow these steps:
Step 1
Note
Step 2
Note
Your Cisco IPS Signature Subscription Service license key will be sent to the e-mail address you specified.
Step 3
Note
Step 4
Step 5
sensor# copy scp://user@10.89.147.3://tftpboot/dev.lic license-keyPassword: *******Step 6 Verify the sensor is licensed:sensor# show versionApplication Partition:Cisco Intrusion Prevention System, Version 5.1(7)S182.0OS Version 2.4.26-IDS-smp-bigphysPlatform: IPS-4255-K9Serial Number: ABC1234DEFGLicensed, expires: 19-Dec-2005 UTCSensor up-time is 2 days.Using 706699264 out of 3974291456 bytes of available memory (17% usage)system is using 17.3M out of 29.0M bytes of available disk space (59% usage)application-data is using 36.5M out of 166.8M bytes of available disk space (23% usage)boot is using 39.4M out of 68.6M bytes of available disk space (61% usage)MainApp 2005_Feb_18_03.00 (Release) 2005-02-18T03:13:47-0600 RunningAnalysisEngine 2005_Feb_15_03.00 (QATest) 2005-02-15T12:59:35-0600 RunningCLI 2005_Feb_18_03.00 (Release) 2005-02-18T03:13:47-0600Upgrade History:IDS-K9-min-5.1-7 14:16:00 UTC Thu Mar 04 2004Recovery Partition Version 1.1 - 5.1(7)S182sensor#Step 7
sensor# copy license-key scp://user@10.89.147.3://tftpboot/dev.licPassword: *******sensor#
For More Information
•
•
•
Restrictions and Limitations
The following restrictions and limitations apply to Cisco IPS 5.1(7)E1 software and the products that run 5.1(7)E1:
•
•
•
•
The PIX and ASA Firewalls and other security devices support a feature known as TCP Sequence Randomization. The initial TCP packets for a connection have their initial Sequence Numbers randomized as they flow through the firewall. A sensor monitoring the side of the firewall where the TCP client is located as well as monitoring the side of the firewall where the TCP server is located sees the same TCP session twice, but with different sequence numbers. If the sensor is monitoring in promiscuous mode, this can confuse the TCP Reassembly software and the sensor may not be able to properly track the TCP Session and may not be able to send alerts for any attacks within the TCP connection. If the sensor is monitoring in inline mode (inline interface pair, or inline VLAN pair), it sees the TCP packets with the randomized sequence numbers as being out of order when compared to the original sequence numbers. When this happens the inline sensor drops/denies the TCP packets with the randomized sequence numbers and prevent the TCP connection from continuing.
•
This is true for any string that is used by CLI as an identifier, for example, names of time periods, inspect maps, server and URL lists, and interfaces.
•
•
•
•
•
•
•
•
Connecting IPS-4240 to a Cisco 7200 Series Router
When an IPS-4240 is connected directly to a 7200 series router and both the IPS-4240 and the router interfaces are hard-coded to speed 100 with duplex Full, the connection does not work. If you set IPS-4240 to speed Auto and duplex Auto, it connects to the router but only at speed 100 and duplex Half.
To connect correctly at speed 100 and duplex Full, set the interfaces of both IPS-4240 and the router to speed Auto and duplex Auto. Also, if either interface is hard-coded, you must make the connection using a crossover cable.
Recovering the Password
The following password recovery options exist:
•
•
•
For More Information
•
•
Caveats
This section lists the resolved and known issues, and contains the following topics:
Bug Toolkit
For the most complete and up-to-date list of caveats, use the Bug Toolkit to refer to the caveat release note. You can use the Bug Toolkit to search for known bugs based on software version, feature set, and keywords. The resulting matrix shows when each bug was integrated, or fixed if applicable. It also lets you save the results of a search in Bug Groups, and also create persistent Alert Agents that can feed those groups with new defect alerts.
Note
If you are a registered Cisco.com user, you can view the Bug Toolkit at this URL:
http://tools.cisco.com/Support/BugToolKit/action.do?hdnAction=searchBugs
To become a registered cisco.com user, go to this URL:
http://tools.cisco.com/RPF/register/register.do
Resolved Caveats
The following known issues have been resolved in IPS 5.1(7)E1:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Known Caveats
The following known issues are found in IPS 5.1(7)E1:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Related Documentation
Refer to the following documentation for more information on IPS 5.1 found at this URL:
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/tsd_products_support_series_home.html
•
•
•
•
•
•
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as an RSS feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service. Cisco currently supports RSS Version 2.0.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Copyright © 2006-2012 Cisco Systems, Inc. All rights reserved.
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)