Table Of Contents
Release Notes for Cisco Intrusion Prevention System 6.0(4a)E1
IPS 6.0(4a)E1 Installation Issue
IPS Management and Event Viewers
Receiving Cisco IPS Active Update Bulletins
Before Upgrading to Cisco IPS 6.0(4a)E1
Copying and Restoring the Configuration File Using a Remote Server
Obtaining Software on Cisco.com
Major and Minor Updates, Service Packs, and Patch Releases
Signature/Virus Updates and Signature Engine Updates
Recovery and System Image Filenames
Upgrading to Cisco IPS 6.0(4a)E1
After Upgrading to Cisco IPS 6.0(4a)E1
Service Programs for IPS Products
Obtaining and Installing the License Key
Understanding Password Recovery
Recovering the Appliance Password
Recovering the IDSM-2 Password
Recovering the NM-CIDS Password
Recovering the AIP-SSM Password
Recovering the AIM-IPS Password
Verifying the State of Password Recovery
Troubleshooting Password Recovery
Obtaining Documentation and Submitting a Service Request
Release Notes for Cisco Intrusion Prevention System 6.0(4a)E1
April 1, 2008
Revised: October 6, 2009
Contents
•
IPS 6.0(4a)E1 Installation Issue
•
•
•
•
•
•
Caution
IPS 6.0(4a)E1 Installation Issue
The 6.0(4a)E1E1 service pack upgrade file was repackaged to address an installation issue (CSCs031217).
Caution
You cannot uninstall the 6.0(4a)E1 service pack. You must reimage your sensor using a system image file. All configuration settings will be lost.
For More Information
•
•
IPS 6.0(4a)E1 File List
The following files are part of Cisco IPS 6.0(4a)E1:
•
–
–
•
–
–
–
–
–
–
–
–
–
–
–
•
–
–
•
–
Note
•
–
For More Information
•
•
Supported Platforms
Note
Cisco IPS 6.0(4a)E1 is supported on the following platforms:
•
•
•
•
•
•
•
•
•
•
•
•
•
Supported Servers
The following FTP servers are supported for IPS software updates:
•
•
•
•
•
The following HTTP/HTTPS servers are supported for IPS software updates:
•
•
Note
ROMMON and TFTP
ROMMON uses TFTP to download an image and launch it. TFTP does not address network issues such as latency or error recovery. It does implement a limited packet integrity check so that packets arriving in sequence with the correct integrity value have an extremely low probability of error. But TFTP does not offer pipelining so the total transfer time is equal to the number of packets to be transferred times the network average RTT. Because of this limitation, we recommend that the TFTP server be located on the same LAN segment as the sensor. Any network with an RTT less than a 100 milliseconds should provide reliable delivery of the image.
Some TFTP servers limit the maximum file size that can be transferred to ~32 MB. Therefore, we recommend the following TFTP servers:
•
Tftpd32 version 2.0, available at:
•
Tftp-hpa series, available at:
http://www.kernel.org/pub/software/network/tftp/
For More Information
•
•
IPS Management and Event Viewers
Use the following tools for configuring IPS 6.0(4a)E1 and E2 sensors:
•
•
•
•
Use the following tools for monitoring 6.0(4a)E1 sensors:
•
•
•
•
Note
Receiving Cisco IPS Active Update Bulletins
You can subscribe to Cisco IPS Active Update Bulletins on Cisco.com to receive e-mails when signature updates and service pack updates occur.
To receive bulletins about updates, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
a.
b.
c.
d.
e.
f.
Step 8
Step 9
a.
b.
c.
d.
e.
Step 10
You receive e-mail notifications of updates when they occur and instructions on how to obtain them.
Cisco Security Center
The Cisco Security Center site on Cisco.com provides intelligence reports about current vulnerabilities and security threats. It also has reports on other security topics that help you protect your network and deploy your security systems to reduce organizational risk.
You should be aware of the most recent security threats so that you can most effectively secure and manage your network. The Cisco Security Center contains the top ten intelligence reports listed by date, severity, urgency, and whether there is a new signature available to deal with the threat.
The Cisco Security Center contains a Security News section that lists security articles of interest. There are related security tools and links.
You can access the Cisco Security Center at this URL:
http://tools.cisco.com/MySDN/Intelligence/home.x
The Cisco Security Center is also a repository of information for individual signatures, including signature ID, type, structure, and description.
You can access the signature search at this URL:
http://tools.cisco.com/security/center/search.x?search=Signature
New and Changed Information
Cisco IPS 6.0(4a)E1 includes the following new features and hardware platforms:
•
•
•
Analysis Engine now allows asymmetric traffic to be tracked and analyzed using a relaxed normalization process rather than the standard normalization process.
You can now configure inline interface mode in situations where the Normalizer engine normally blocks or delays traffic because of the strict nature of stream processing, and where normalization is achieved by not doing any protocol checking or packet reordering. You can relax the Normalizer process by adding a flag to the sensorApp.conf file, which requires using the service account. It also requires a sensor reboot.
To enable Asymmetric mode processing, log in to the sensor service account, and edit the /usr/cids/idsRoot/etc/sensorApp.conf file by adding the AsymmetricFlows=true flag to the file:
[NormalizerSettings]QueuedTimeout=4AsymmetricFlows=trueAfter you add the Asymmetric flag, reboot the sensor.
To verify that the Asymmetric mode processing has been enabled, run traffic through the inline sensor and verify that TCP packets pass through the system unaltered and not reordered. You can also verify Asymmetric mode processing in the TCP Normalizer stage statistics. Verify that the number of Current Streams is increasing, but the number of Closed, Closing, Embryonic, and Established streams are all 0:
Current Streams = 1630Current Streams Closed = 0Current Streams Closing = 0Current Streams Embryonic = 0Current Streams Established = 0•
Log in to the service account and in the /usr/cids/idsRoot/etc/interface.conf file, change cdp-mode=block to cdp-mode=forward.
Save your changes to the interface.conf file, and reboot the sensor.
For More Information
For more information on the Normalizer engine, refer to Normalizer Engine.
Before Upgrading to Cisco IPS 6.0(4a)E1
This section describes the actions you should take before upgrading to Cisco IPS 6.0(4a)E1. It contains the following topics:
•
•
Perform These Tasks
Before you upgrade your sensors to Cisco IPS 6.0(4a)E1, make sure you perform the following tasks:
•
•
•
•
If you need to downgrade a signature update, you will know what version you had, and you can then apply the configuration you saved when you backed up your configuration.
•
•
In IPS 5.x, the read-only-community was set to public by default, and the read-write-community was set to private by default. In IPS 6.0(4a)E1 these two options do not have default values. If you were not using SNMP gets and sets with IPS 5.x (for example, enable-set-get was set to false), there is no problem upgrading to IPS 6.0(4a)E1. If you were using SNMP gets and sets with IPS 5.x (for example, enable-set-get was set to true), you must configure the read-only-community and read-write-community parameters to specific values or the IPS 6.0(4a)E1 upgrade fails. You receive the following error message:
Error: execUpgradeSoftware : Notification Application "enable-set-get" value set to true, but "read-only-community" and/or "read-write-community" are set to null. Upgrade may not continue with null values in these fields.For More Information
•
•
•
•
•
•
Copying and Restoring the Configuration File Using a Remote Server
Use the copy [/erase] source_url destination_url keyword command to copy the configuration file to a remote server. You can then restore the current configuration from the remote server. You are prompted to back up the current configuration first.
Note
The following options apply:
•
This keyword only applies to the current-config; the backup-config is always overwritten. If this keyword is specified for destination current-config, the source configuration is applied to the system default configuration. If it is not specified for the destination current-config, the source configuration is merged with the current-config.
•
•
The exact format of the source and destination URLs varies according to the file. Here are the valid types:
•
ftp:[//[username@] location]/relativeDirectory]/filename
ftp:[//[username@]location]//absoluteDirectory]/filename
•
scp:[//[username@] location]/relativeDirectory]/filename
scp:[//[username@] location]//absoluteDirectory]/filename
Note
•
http:[[/[username@]location]/directory]/filename
•
https:[[/[username@]location]/directory]/filename
Note
The following keywords are used to designate the file location on the sensor:
•
•
Caution
To back up and restore your current configuration, follow these steps:
Step 1
Step 2
sensor# copy current-config ftp://user@10.1.1.1//configs/sensor89.cfgPassword: ********Step 3
sensor# copy ftp://user@10.1.1.1//configs/sensor89.cfg current-configPassword: ********Warning: Copying over the current configuration may leave the box in an unstable state.Would you like to copy current-config to backup-config before proceeding? [yes]:Step 4
For More Information
•
•
Obtaining Software on Cisco.com
You can find major and minor updates, service packs, signature and signature engine updates, system and recovery files, firmware upgrades, and readmes on the Download Software site on Cisco.com.
Note
Signature updates are posted to Cisco.com approximately every week, more often if needed. Service packs are posted to Cisco.com as needed. Major and minor updates are also posted periodically. Check Cisco.com regularly for the latest IPS software.
Note
Note
To download software on Cisco.com, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Note
Step 7
The available files appear in a list in the right side of the window. You can sort by file name, file size, memory, and release date. And you can access the Release Notes and other product documentation.
Step 8
The file details appear.
Step 9
Step 10
The first time you download a file from Cisco.com, you must fill in the Encryption Software Export Distribution Authorization form before you can download the software.
•
The Cisco Systems Inc. Encryption Software Usage Handling and Distribution Policy appears.
•
The Encryption Software Export/Distribution Form appears.
If you previously filled out the Encryption Software Export Distribution Authorization form, and read and accepted the Cisco Systems Inc. Encryption Software Usage Handling and Distribution Policy, these forms are not displayed again.
The File Download dialog box appears.
Step 11
Step 12
Note
For More Information
•
•
IPS Software Versioning
This section describes the various IPS software files, and contains the following sections:
•
•
•
•
Major and Minor Updates, Service Packs, and Patch Releases
Figure 1 illustrates what each part of the IPS software file represents for major and minor updates, service packs, and patch releases.
Figure 1 IPS Software File Name for Major and Minor Updates, Service Packs, and Patch Releases
Major Update
Contains new functionality or an architectural change in the product. For example, the IPS 6.0 base version includes everything (except deprecated features) since the previous major release (the minor update features, service pack fixes, and signature updates) plus any new changes. Major update 6.0(1) requires 5.x. With each major update there are corresponding system and recovery packages.
Note
Minor Update
Incremental to the major version. Minor updates are also base versions for service packs. The first minor update for 6.0 is 6.1(1). Minor updates are released for minor enhancements to the product. Minor updates contain all previous minor features (except deprecated features), service pack fixes, signature updates since the last major version, and the new minor features being released. You can install the minor updates on the previous major or minor version (and often even on earlier versions). The minimum supported version needed to upgrade to the newest minor version is listed in the Readme that accompanies the minor update. With each minor update there are corresponding system and recovery packages.
Service Packs
Cumulative following a base version release (minor or major). Service packs are used for the release of defect fixes with no new enhancements. Service packs contain all service pack fixes since the last base version (minor or major) and the new defect fixes being released. Service packs require the minor version. The minimum supported version needed to upgrade to the newest service pack is listed in the Readme that accompanies the service pack. Service packs also include the latest engine update. For example, if service pack 6.0(3) is released, and E3 is the latest engine level, the service pack is released as 6.0(3)E3.
Patch Release
Used to address defects that are identified in the upgrade binaries after a software release. Rather than waiting until the next major or minor update, or service pack to address these defects, a patch can be posted. Patches include all prior patch releases within the associated service pack level. The patches roll into the next official major or minor update, or service pack.
Before you can install a patch release, the most recent major or minor update, or service pack must be installed. For example, patch release 5.0(1p1) requires 5.0(1).
Note
For More Information
For a table listing the types of files with examples of filenames and corresponding software releases, see 6.x Software Release Examples.
Signature/Virus Updates and Signature Engine Updates
Figure 2 illustrates what each part of the IPS software file represents for signature/virus updates.
Figure 2 IPS Software File Name for Signature/Virus Updates,
Signature/Virus Updates
Executable file containing a set of rules designed to recognize malicious network activities. Signature updates are released independently from other software updates. Each time a major or minor update is released, you can install signature updates on the new version and the next oldest version for a period of at least six months. Signature updates are dependent on a required signature engine version. Because of this, a req designator lists the signature engine required to support a particular signature update.
A virus component for the signature updates is packaged with the signature update. Virus updates are generated by Trend Microsystems for use by the Cisco Intrusion Containment System (Cisco ICS). Once created for use by Cisco ICS, they are later be incorporated into standard Cisco signature updates.
Figure 3 illustrates what each part of the IPS software file represents for signature engine updates.
Figure 3 IPS Software File Name for Signature Engine Updates
Signature Engine Updates
Executable files containing binary code to support new signature updates. Signature engine files require a specific service pack, which is also identified by the req designator.
Recovery and System Image Filenames
Figure 4 illustrates what each part of the IPS software file represents for recovery and system image filenames.
Figure 4 IPS Software File Name for Recovery and System Image Filenames
Recovery and system images contain separate versions for the installer and the underlying application. The installer version contains a major and minor version field.
Installer Major Version
The major version is incremented by one of any major changes to the image installer, for example, switching from .tar to rpm or changing kernels.
Installer Minor Version
The minor version can be incremented by any one of the following:
•
•
6.x Software Release Examples
Table 1 lists platform-independent IDS 6.x software release examples. Refer to the Readmes that accompany the software files for detailed instructions on how to install the files.
Table 1 Platform-Independent Release Examples
Signature update1
Weekly
sig
S700
IPS-sig-S700-req-E1.pkg
Signature engine update2
As needed
engine
E1
IPS-engine-E1-req-6.1-3.pkg
Service packs3
Semi-annually
or as needed—
6.1(3)
IPS-K9-6.1-3-E1.pkg
Minor version update4
Annually
—
6.1(1)
IPS-K9-6.1-1-E1.pkg
Major version update5
Annually
—
6.0(1)
IPS-K9-6.0-1-E1.pkg
Patch release6
As needed
patch
6.0(1p1)
IPS-K9-patch-6.0-1pl-E1.pkg
Recovery package7
Annually or as needed
r
1.1-6.0(1)
IPS-K9-r-1.1-a-6.0-1-E1.pkg
1 Signature updates include the latest cumulative IPS signatures.
2 Signature engine updates add new engines or engine parameters that are used by new signatures in later signature updates.
3 Service packs include defect fixes.
4 Minor versions include new minor version features and/or minor version functionality.
5 Major versions include new major version functionality or new architecture.
6 Patch releases are for interim fixes.
7 The r 1.1 can be revised to r 1.2 if it is necessary to release a new recovery package that contains the same underlying application image. If there are defect fixes for the installer, for example, the underlying application version may still be 6.0(1), but the recovery partition image will be r 1.2.
Table 2 describes platform-dependent software release examples.
Table 2 Platform-Dependent Release Examples
System image1
Annually
sys
Separate file for each sensor platform
IPS-4240-K9-sys-1.1-a-6.0-1-E1.img
Maintenance partition image2
Annually
mp
IDSM-2
c6svc-mp.2-1-2.bin.gz
Bootloader
As needed
bl
NM-CIDS
AIM-IPSservicesengine-boot-1.0-4.bin
pse_aim_x.y.z.bin (where x, y, z is the release number)Mini-kernel
As needed
mini-kernel
AIM-IPS
pse_mini_kernel_1.1.10.64.bz2
1 The system image includes the combined recovery and application image used to reimage an entire sensor.
2 The maintenance partition image includes the full image for the IDSM-2 maintenance partition. The file is installed from but does not affect the IDSM-2 application partition.
Table 3 describes the platform identifiers used in platform-specific names.
Note
For More Information
For instructions on how to access these files on Cisco.com, see Obtaining Software on Cisco.com.
Upgrading the IDS-4215 BIOS
The BIOS/ROMMON upgrade utility (IDS-4215-bios-5.1.7-rom-1.4.bin) upgrades the BIOS of IDS-4215 to version 5.1.7 and the ROMMON to version 1.4.
To upgrade the BIOS and ROMMON on IDS-4215, follow these steps:
Step 1
Note
Step 2
While rebooting, IDS-4215 runs the BIOS POST. After the completion of POST, the console displays the message: Evaluating Run Options ...for about 5 seconds.
Step 3
The console display resembles the following:
CISCO SYSTEMS IDS-4215Embedded BIOS Version 5.1.3 05/12/03 10:18:14.84Compiled by ciscouserEvaluating Run Options ...Cisco ROMMON (1.2) #0: Mon May 12 10:21:46 MDT 2003Platform IDS-42150: i8255X @ PCI(bus:0 dev:13 irq:11)1: i8255X @ PCI(bus:0 dev:14 irq:11)Using 1: i82557 @ PCI(bus:0 dev:14 irq:11), MAC: 0000.c0ff.ee01Use ? for help.rommon>Step 4
rommon> interface port_numberThe port in use is listed just before the rommon prompt. Port 1 (default port) is being used as indicated by the text, Using 1: i82557 @ PCI(bus:0 dev:14 irq:11), MAC: 0000.c0ff.ee01.
Note
Step 5
rommon> address ip_address
Note
Step 6
rommon> server ip_addressStep 7
rommon> gateway ip_addressStep 8
rommon> ping server_ip_addressrommon> ping serverStep 9
rommon> file filenameExample:
rommon> file IDS-4215-bios-5.1.7-rom-1.4.bin
Note
Step 10
rommon> tftpStep 11
IDS-4215 reboots when the update is complete.
Caution
For More Information
•
•
Upgrading to Cisco IPS 6.0(4a)E1
This section provides information on upgrading to IPS 6.0(4a)E, and contains the following topics:
•
Upgrade Notes and Caveats
The following upgrade notes and caveats apply to upgrading to 6.0(4a)E1:
•
•
Note
•
sensor# upgrade scp://user@10.1.1.1/upgrades/IPS-K9-6.0-4a-E1.pkg
Password: ********
Warning: Executing this command will apply a major version upgrade to the application partition. The system may be rebooted to complete the upgrade.
Continue with upgrade?: yes
Error: Analysis Engine is not running. Please reset box and attempt upgrade again.
If you receive this error, you must get Analysis Engine running before trying to upgrade again. This error is often caused by a defect in the currently running version. Try rebooting the sensor, and after reboot, run setup and remove the interfaces from the virtual sensor vs0. When it is not monitoring traffic, Analysis Engine usually stays up and running. You can upgrade to 6.0(4a)E1 at this time. After the upgrade to IPS 6.0(4a)E1, add the interfaces back to the virtual sensor vs0 using the setup command.
Or you can use the recovery CD (if your sensor has a CD-ROM) or the system image file to reimage directly to IPS 6.0(4a)E1. You can reimage a 5.x sensor to 6.0(4a)E1 because the reimage process does not check to see Analysis Engine is running.
Caution
•
Error: execUpgradeSoftware : Notification Application "enable-set-get" value set to true, but "read-only-community" and/or "read-write-community" are set to null. Upgrade may not continue with null values in these fields.•
•
•
The upgrade may stop if it comes across a value that it cannot translate. If this occurs, the resulting error message provides enough information to adjust the parameter to an acceptable value. After editing the configuration, try the upgrade again.
•
For More Information
•
•
•
•
•
•
•
Upgrading to 6.0(4a)E1
Note
To upgrade the sensor, follow these steps:
Step 1
Caution
Caution
Step 2
Step 3
sensor# show version
Note
Step 4
sensor# configure terminalStep 5
sensor(config)# upgrade scp://tester@10.1.1.1//upgrade/IPS-K9-6.0-4a-E1.pkgStep 6
Enter password: ********Step 7
Note
Note
Step 8
sensor# show versionApplication Partition:Cisco Intrusion Prevention System, Version 6.0(4a)E1Host:Realm Keys key1.0Signature Definition:Signature Update S291.0 2007-06-18Virus Update V1.2 2005-11-24OS Version: 2.4.30-IDS-smp-bigphysPlatform: ASA-SSM-20Serial Number: P300000220No license presentSensor up-time is 13 days.Using 1039052800 out of 2093682688 bytes of available memory (49% usage)system is using 17.8M out of 29.0M bytes of available disk space (61% usage)application-data is using 49.9M out of 166.6M bytes of available disk space (32% usage)boot is using 37.8M out of 68.5M bytes of available disk space (58% usage)MainApp N-2007_JUN_19_16_45 (Release) 2007-06-19T17:10:20-0500 RunningAnalysisEngine N-2007_JUN_19_16_45 (Release) 2007-06-19T17:10:20-0500 RunningCLI N-2007_JUN_19_16_45 (Release) 2007-06-19T17:10:20-0500Upgrade History:IPS-K9-6.0-4-E.1 15:31:13 UTC Mon Sep 10 2007Recovery Partition Version 1.1 - 6.0(4a)E1sensor#
Note
Note
For More Information
•
•
Installing the ISO Image File
Note
The Recovery ISO Image is for IDS-4235 and IDS-4250 sensors only.
To create the recovery CD for the ISO image for IDS-4235 and IDS-4250, follow these steps:
Step 1
Step 2 Enter the following command:host# cdrecord -v speed=6 dev=0,0 IPS-K9-cd-1.1-a-6.0-5-E3.isohost# cdrecord -v speed=6 dev=0,0 IPS-K9-cd-1.1-a-6.0-4a-E1.isoStep 3 Follow the command line arguments for cdrecord.
Note
Step 4
For More Information
For the procedure for using a recovery CD to install images, refer to Using the Recovery/Upgrade CD.
After Upgrading to Cisco IPS 6.0(4a)E1
This section provides information about what to do after you install IPS 6.0(4a)E1. It contains the following topics:
Comparing Configurations
Compare your backed up and saved 5.1 configuration with the output of the show configuration command after upgrading to 6.0(4a)E1 to verify that all the configuration has been properly converted.
Caution
For More Information
For a list of the IPS 6.0(4a)E1 caveats, see Caveats.
SSL Certificate
If necessary, import the new SSL certificate for the upgraded sensor in to each tool being used to monitor the sensor.
For More Information
For the CLI procedure for importing a new SSL certificate, refer to Configuring TLS. For IDM, refer to Configuring Certificates.
Logging In to IDM
IDM is a web-based, Java Start application that enables you to configure and manage your sensor. The web server for IDM resides on the sensor. You can access it through Internet Explorer or Firefox web browsers.
To log in to IDM, follow these steps:
Step 1
https://sensor_ip_address
Note
Note
A Security Alert dialog box appears.
Step 2
The Cisco IPS Device Manager Version 6.0 window appears.
Step 3
The JAVA loading message box appears.
The Warning - Security dialog box appears.
Step 4
The JAVA Web Start progress dialog box appears.
The IDM on ip_address dialog box appears.
Step 5
Note
The Cisco IDM Launcher dialog box appears.
Step 6
Note
IDM begins to load.
The Status dialog box appears with the following message:
Please wait while IDM is loading the current configuration from the sensor.The main window of IDM appears.
Note
For More Information
•
•
Licensing the Sensor
This section describes how to obtain a license key and how to license the sensor using the CLI or IDM. It contains the following topics:
•
•
Understanding the License
Although the sensor functions without the license key, you must have a license key to obtain signature updates. To obtain a license key, you must have the following:
•
Contact your reseller, Cisco service or product sales to purchase a contract.
•
To find the IPS device serial number in IDM, choose Configuration > Licensing, or in the CLI use the show version command.
•
Trial license keys are also available. If you cannot get your sensor licensed because of problems with your contract, you can obtain a 60-day trial license that supports signature updates that require licensing.
You can obtain a license key from the Cisco.com licensing server, which is then delivered to the sensor. Or, you can update the license key from a license key provided in a local file. Go to http://www.cisco.com/go/license and click IPS Signature Subscription Service to apply for a license key.
You can view the status of the license key on the Licensing pane in IDM. Whenever you start IDM, you are informed of your license status—whether you have a trial, invalid, or expired license key. With no license key, an invalid license key, or an expired license key, you can continue to use IDM but you cannot download signature updates.
When you enter the CLI, you are informed of your license status. For example, you receive the following message if there is no license installed:
***LICENSE NOTICE***There is no license key installed on the system.The system will continue to operate with the currently installedsignature set. A valid license must be obtained in order to applysignature updates. Please go to http://www.cisco.com/go/licenseto obtain a new license or install a license.You will continue to see this message until you install a license key.
For More Information
•
•
Service Programs for IPS Products
You must have a Cisco Services for IPS service contract for any IPS product so that you can download a license key and obtain the latest IPS signature updates. If you have a direct relationship with Cisco Systems, contact your account manager or service account manager to purchase the Cisco Services for IPS service contract. If you do not have a direct relationship with Cisco Systems, you can purchase the service account from a one-tier or two-tier partner.
When you purchase the following IPS products you must also purchase a Cisco Services for IPS service contract:
•
•
•
•
•
•
•
•
•
•
For ASA 5500 series adaptive security appliance products, if you purchased one of the following ASA 5500 series adaptive security appliance products that do not contain IPS, you must purchase a SMARTnet contract:
•
•
•
•
•
•
•
•
•
Note
If you purchased one of the following ASA 5500 series adaptive security appliance products that ships with the AIP-SSM installed or if you purchased AIP-SSM to add to your ASA 5500 series adaptive security appliance product, you must purchase the Cisco Services for IPS service contract:
•
•
•
•
•
•
•
•
•
Note
For example, if you purchased an ASA-5510 and then later wanted to add IPS and purchased an ASA-SSM-AIP-10-K9, you must now purchase the Cisco Services for IPS service contract.
After you have the Cisco Services for IPS service contract, you must also have your product serial number to apply for the license key.
Caution
For More Information
For the procedure for obtaining and installing the license key, see Obtaining and Installing the License Key.
Obtaining and Installing the License Key
You can install the license key through the CLI or IDM. This section describes how to obtain and install the license key, and contains the following topics:
Using IDM
Note
To obtain and install the license key, follow these steps:
Step 1
Step 2
The Licensing pane displays the status of the current license. If you have already installed your license, you can click Download to save it if needed.
Step 3 Obtain a license key by doing one of the following:•
IDM contacts the license server on Cisco.com and sends the server the serial number to obtain the license key. This is the default method. Go to Step 4.
•
To use this option, you must apply for a license key at this URL: www.cisco.com/go/license.
The license key is sent to you in e-mail and you save it to a drive that IDM can access. This option is useful if your computer cannot access Cisco.com. Go to Step 7.
Step 4
The Licensing dialog box appears.
Step 5
The Status dialog box informs you that the sensor is trying to connect to Cisco.com. An Information dialog box confirms that the license key has been updated.
Step 6
Step 7
Step 8
Caution
Your license key will be sent to the e-mail address you specified.
Step 9
Step 10
Step 11
Step 12
Step 13
The Select License File Path dialog box appears.
Step 14 Browse to the license file and click Open.Step 15
For More Information
For more information on Cisco service contracts, see Service Programs for IPS Products.
Using the CLI
Use the copy source-url license_file_name license-key command to copy the license key to your sensor.
The following options apply:
•
•
•
•
Note
The exact format of the source and destination URLs varies according to the file. Here are the valid types:
•
ftp:[//[username@] location]/relativeDirectory]/filename
ftp:[//[username@]location]//absoluteDirectory]/filename
•
scp:[//[username@] location]/relativeDirectory]/filename
scp:[//[username@] location]//absoluteDirectory]/filename
Note
•
http:[[/[username@]location]/directory]/filename
•
https:[[/[username@]location]/directory]/filename
Note
To install the license key, follow these steps:
Step 1
Note
Step 2
Note
Your Cisco IPS Signature Subscription Service license key will be sent by e-mail to the e-mail address you specified.
Step 3
Step 4
Step 5 Copy the license key to the sensor:sensor# copy scp://user@10.89.147.3://tftpboot/dev.lic license-keyPassword: *******Step 6
sensor# show versionApplication Partition:Cisco Intrusion Prevention System, Version 6.0(4a)E1Host:Realm Keys key1.0Signature Definition:Signature Update S317.0 2008-02-13Virus Update V1.2 2005-11-24OS Version: 2.4.30-IDS-smp-bigphysPlatform: IPS-4255-K9Serial Number: JAB0815R00NLicensed, expires: 30-Dec-2008 UTCSensor up-time is 45 min.Using 1885913088 out of 3974135808 bytes of available memory (47% usage)system is using 17.7M out of 29.0M bytes of available disk space (61% usage)application-data is using 43.5M out of 166.8M bytes of available disk space (28% usage)boot is using 38.5M out of 68.6M bytes of available disk space (59% usage)MainApp N-2008_FEB_15_16_16 (Release) 2008-02-15T17:08:23-0600 RunningAnalysisEngine N-2008_FEB_15_16_16 (Release) 2008-02-15T17:08:23-0600 RunningCLI N-2008_FEB_15_16_16 (Release) 2008-02-15T17:08:23-0600Upgrade History:IPS-K9-6.0-4a-E1 17:45:18 UTC Tue May 06 2008Recovery Partition Version 1.1 - 6.0(4a)E1sensor#Step 7
sensor# copy license-key scp://user@10.89.147.3://tftpboot/dev.licPassword: *******sensor#For More Information
•
•
•
Restrictions and Limitations
The following restrictions and limitations apply to Cisco IPS 6.0(4a)E1 software and the products that run 6.0(4a)E1:
•
•
•
•
•
•
•
•
AIM-IPS and the IOS firewall complement each other's abilities to create security zones in the network and inspect traffic in those zones. Because AIM-IPS and the IOS firewall operate independently, sometimes they are unaware of the other's activities. In this situation, the IOS firewall is the best defense against a SYN flood attack.
•
•
•
•
This is true for any string that is used by CLI as an identifier, for example, names of time periods, inspect maps, server and URL lists, and interfaces.
•
•
•
For More Information
For more information about which modules Cisco routers support, refer to Interoperability With Other IPS Modules.
Recovering the Password
For most IPS platforms, you can now recover the password on the sensor rather than using the service account or reimaging the sensor. This section describes how to recover the password for the various IPS platforms. It contains the following topics:
•
•
•
•
•
•
•
•
Understanding Password Recovery
Password recovery implementations vary according to IPS platform requirements. Password recovery is implemented only for the cisco administrative account and is enabled by default. The IPS administrator can then recover user passwords for other accounts using the CLI. The cisco user password reverts to cisco and must be changed after the next login.
Note
Table 4 lists the password recovery methods according to platform.
For More Information
For more information on when and how to disable password recovery, see Disabling Password Recovery.
Recovering the Appliance Password
This section describes the two ways to recover the password for appliances. It contains the following topics:
Using the GRUB Menu
For 4200 series appliances, the password recovery is found in the GRUB menu, which appears during bootup. When the GRUB menu appears, press any key to pause the boot process.
Note
To recover the password on appliances, follow these steps:
Step 1
•
GNU GRUB version 0.94 (632K lower / 523264K upper memory)-------------------------------------------0: Cisco IPS1: Cisco IPS Recovery2: Cisco IPS Clear Password (cisco)-------------------------------------------Use the ^ and v keys to select which entry is highlighted.Press enter to boot the selected OS, 'e' to edit theCommands before booting, or 'c' for a command-line.Highlighted entry is 0:Step 2
Step 3 Choose 2: Cisco IPS Recovery.The password is reset to cisco. You can change the password the next time you log into the CLI.
For More Information
For more information about setting up a terminal server, refer to Connecting an Appliance to a Terminal Server.
Using ROMMON
For IPS-4240 and IPS-4255 you can use the ROMMON to recover the password. To access the ROMMON CLI, reboot the sensor from a terminal server or direct connection and interrupt the boot process.
To recover the password using the ROMMON CLI, follow these steps:
Step 1
Step 2
The boot code either pauses for 10 seconds or displays something similar to one of the following:
•
•
Step 3
confreg=0x7bootSample ROMMON session:
Booting system, please wait...CISCO SYSTEMSEmbedded BIOS Version 1.0(11)2 01/25/06 13:21:26.17...Evaluating BIOS Options...Launch BIOS Extension to setup ROMMONCisco Systems ROMMON Version (1.0(11)2) #0: Thu Jan 26 10:43:08 PST 2006Platform IPS-4240-K9Use BREAK or ESC to interrupt boot.Use SPACE to begin boot immediately.Boot interrupted.Management0/0Link is UPMAC Address:000b.fcfa.d155Use ? for help.rommon #0> confreg 0x7Update Config Register (0x7) in NVRAM...rommon #1> boot
Recovering the IDSM-2 Password
To recover the password for IDSM-2, you must perform a system image upgrade, which installs a special password recovery image instead of a typical system image. This upgrade only resets the password, all other configuration remains intact. You must have administrative access to the Cisco 6500 series switch to recover the password. You boot to the maintenance partition and execute the upgrade command to install a new image.
Use the following commands:
•
reset module_number cf:1
session module_number
•
hw-module module module_number reset cf:1
session slot slot_number processor 1
The only protocol for upgrades is FTP. Make sure you put the password recovery image file (WS-SVC-IDSM2-K9-a-6.0-password-recovery.bin.gz) on an FTP server.
Note
For More Information
For the procedures for reimaging IDSM-2, refer to Installing the IDSM-2 System Image.
Recovering the NM-CIDS Password
To recover the password for NM-CIDS, use the clear password command. You must have console access to NM-CIDS and administrative access to the router.
Note
Note
To recover the password for NM-CIDS, follow these steps:
Step 1
router# service-module ids module_number/0 sessionStep 2
Step 3
router# service-module ids module_number/0 resetStep 4
Step 5 When prompted for boot options, enter *** quickly.You are now in the bootloader.
Step 6
ServicesEngine boot-loader# clear passwordStep 7
ServicesEngine boot-loader# boot disk
Caution
For More Information
For the procedure for installing a new bootloader image, refer to Upgrading the NM-CIDS Bootloader.
Recovering the AIP-SSM Password
Note
Use the hw-module module slot_number password-reset command to reset the AIP-SSM password to the default cisco. The ASA 5500 series adaptive security appliance sets the ROMMON confreg bits to 0x7 and then reboots the sensor. The ROMMON bits cause the GRUB menu to default to option 2 (reset password).
If the module in the specified slot has an IPS version that does not support password recovery, the following error message is displayed:
ERROR: the module in slot <n> does not support password recovery.Recovering the AIM-IPS Password
To recover the password for AIM-IPS, use the clear password command. You must have console access to AIM-IPS and administrative access to the router.
To recover the password for AIM-IPS, follow these steps:
Step 1
Step 2
router> enableStep 3
router# show run | include ids-sensorinterface IDS-Sensor0/0router#Step 4
router# service-module ids-sensor slot/port sessionExample:
router# service-module ids-sensor 0/0 sessionStep 5
Step 6
router# service-module ids-sensor 0/0 resetStep 7
Step 8
You are now in the bootloader.
Step 9
ServicesEngine boot-loader# clear passwordAIM-IPS reboots.
Disabling Password Recovery
Caution
Password recovery is enabled by default. You can disable password recovery through the CLI or IDM.
To disable password recovery in the CLI, follow these steps:
Step 1
Step 2
sensor# configure terminalStep 3
sensor(config)# service hostStep 4
sensor(config-hos)# password-recovery disallowedTo disable password recovery in IDM, follow these steps:
Step 1
Step 2
The Network pane appears.
Step 3
For More Information
•
•
Verifying the State of Password Recovery
Use the show settings | include password command to verify whether password recovery is enabled.
To verify whether password recovery is enabled, follow these steps:
Step 1
Step 2
sensor# configure terminalsensor (config)# service hostsensor (config-hos)#Step 3
sensor(config-hos)# show settings | include passwordpassword-recovery: allowed <defaulted>sensor(config-hos)#
Troubleshooting Password Recovery
To troubleshoot password recovery, pay attention to the following:
•
•
To check the state of password recovery, use the show settings | include password command.
•
•
For More Information
•
•
•
Caveats
For the most complete and up-to-date list of caveats, use the Bug Navigator Tool to refer to the caveat release notes. The Bug Navigator Tool is found at this URL:
http://www.cisco.com/cgi-bin/Support/Bugtool/launch_bugtool.pl
This section lists the resolved and known caveats, and contains the following topics:
Resolved Caveats
The following known issues have been resolved in Cisco IPS 6.0(4a)E1:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Known Caveats
The following known issues are found in IPS 6.0(4a)E1:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Related Documentation
Refer to the following documentation for more information on IPS 6.0 found at this URL:
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/tsd_products_support_series_home.html
•
•
•
•
•
•
•
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco Pulse, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, and Flip Gift Card are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Fast Step, Follow Me Browsing, FormShare, GainMaker, GigaDrive, HomeLink, iLYNX, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0908R)
Copyright © 2006-2009 Cisco Systems, Inc. All rights reserved.
Guest
