Table Of Contents
Release Notes for Cisco Intrusion Prevention System 7.0(1)E3
IPS Management and Event Viewers
Receiving Cisco IPS Active Update Bulletins
Before Upgrading to Cisco IPS 7.0(1)E3
Copying and Restoring the Configuration File Using a Remote Server
Obtaining Software on Cisco.com
Major and Minor Updates, Service Packs, and Patch Releases
Signature/Virus Updates and Signature Engine Updates
Recovery and System Image Filenames
Upgrading to Cisco IPS 7.0(1)E3
After Upgrading to Cisco IPS 7.0(1)E3
Importing a New SSL Certificate
Service Programs for IPS Products
Obtaining and Installing the License Key
Installing or Upgrading Cisco IME
Before Installing or Upgrading IME
Cisco IME Installation and Upgrade Instructions
Obtaining Documentation and Submitting a Service Request
Release Notes for Cisco Intrusion Prevention System 7.0(1)E3
CDC Date: April 22, 2009
Revised: October 21, 2009Contents
•
IPS Management and Event Viewers
•
•
•
•
•
•
Caution
IPS 7.0(1)E3 File List
The following files are part of Cisco IPS 7.0(1)E3:
•
–
•
–
–
–
•
–
–
–
–
–
–
–
–
–
–
•
–
–
–
For More Information
For the procedure for obtaining these files on Cisco.com, see Obtaining Software on Cisco.com.
Supported Platforms
Note
Note
Cisco IPS 7.0(1) is supported on the following platforms:
•
•
•
•
•
•
•
•
•
•
Supported Servers
The following FTP servers are supported for IPS software updates:
•
•
•
•
•
The following HTTP/HTTPS servers are supported for IPS software updates:
•
•
ROMMON and TFTP
ROMMON uses TFTP to download an image and launch it. TFTP does not address network issues such as latency or error recovery. It does implement a limited packet integrity check so that packets arriving in sequence with the correct integrity value have an extremely low probability of error. But TFTP does not offer pipelining so the total transfer time is equal to the number of packets to be transferred times the network average RTT. Because of this limitation, we recommend that the TFTP server be located on the same LAN segment as the sensor. Any network with an RTT less than a 100 milliseconds should provide reliable delivery of the image.
Some TFTP servers limit the maximum file size that can be transferred to ~32 MB. Therefore, we recommend the following TFTP servers:
•
Tftpd32 version 2.0, available at:
•
Tftp-hpa series, available at:
http://www.kernel.org/pub/software/network/tftp/
For More Information
•
•
IPS Management and Event Viewers
Note
Note
Use the following tools for configuring Cisco IPS 7.0(1) sensors:
•
•
•
•
Use the following tools for monitoring Cisco IPS 7.0(1) sensors:
•
•
•
Note
New and Changed Information
Cisco IPS 7.0 contains the following new features:
•
IPS 7.0 contains a new security capability, Cisco Global Correlation, which uses the immense security intelligence that we have amassed over the years. At regular intervals, Cisco IPS receives threat updates from the Cisco SensorBase Network, which contain detailed information about known threats on the Internet, including serial attackers, Botnet harvesters, Malware outbreaks, and dark nets. The IPS uses this information to filter out the worst attackers before they have a chance to attack critical assets. It then incorporates the global threat data in to its system to detect and prevent malicious activity even earlier.
•
–
–
–
•
The 10GE interface card (part numbers IPS-2X10GE-SR-INT and IPS-2X10GE-SR-INT=) provides two 10000 Base-SX (fiber) interfaces. The IPS-4260 supports one 10GE interface card for a total of two 10GE fiber interfaces. The IPS 4270-20 supports up to two 10GE interface cards for a total of four 10GE fiber interfaces.
Note
•
•
–
The signature date represents the date at which the signature was first created. The date is stored in the format YYYYMMDD. The signature type represents the category in which a specific signature falls. Signatures are broadly classified as vulnerability, exploit, anomaly, component, or other. The default is other.
–
Duplicate packet statistics are now added to the TCP Normalizer Stage Statistics section of the show statistics virtual sensor command output. Large numbers of duplicate packets being reported by the Normalizer can aid in the detection of sensor deployment and configuration problems. Duplicate packets are often seen in situations where a single virtual sensor is monitoring two or more networks, and is seeing a TCP connection crossing two or more of these networks. In this situation you can reconfigure the sensor to monitor each network using a different virtual sensor. If both networks must be monitored by a single virtual sensor, configure the virtual sensor with the inline-TCP-session-tracking-mode parameter set to either interface-and-vlan or vlan-only.
–
A new parameter to match a specific UDP length was added. This engine parameter is added in the Atomic IP Advanced and Atomic IP engine for l4-protocol UDP. The purpose of this parameter is to check if UDP total length falls within a specific range.
For More Information
•
•
•
Receiving Cisco IPS Active Update Bulletins
You can subscribe to Cisco IPS Active Update Bulletins on Cisco.com to receive e-mails when signature updates and service pack updates occur.
To receive bulletins about updates, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
a.
b.
c.
d.
e.
f.
Step 8
Step 9
a.
b.
c.
d.
e.
Step 10
You receive e-mail notifications of updates when they occur and instructions on how to obtain them.
Cisco Security Center
The Cisco Security Center site on Cisco.com provides intelligence reports about current vulnerabilities and security threats. It also has reports on other security topics that help you protect your network and deploy your security systems to reduce organizational risk.
You should be aware of the most recent security threats so that you can most effectively secure and manage your network. The Cisco Security Center contains the top ten intelligence reports listed by date, severity, urgency, and whether there is a new signature available to deal with the threat.
The Cisco Security Center contains a Security News section that lists security articles of interest. There are related security tools and links. You can access the Cisco Security Center at this URL:
http://tools.cisco.com/MySDN/Intelligence/home.x
The Cisco Security Center is also a repository of information for individual signatures, including signature ID, type, structure, and description. You can access the signature search at this URL:
http://tools.cisco.com/security/center/search.x?search=Signature
Before Upgrading to Cisco IPS 7.0(1)E3
This section describes the actions you should take before upgrading to Cisco IPS 7.0(1)E3. It contains the following topics:
•
•
Perform These Tasks
Before you upgrade your sensors to IPS 7.0(1)E3, make sure you perform the following tasks:
•
•
•
If you need to downgrade a signature update, you will know what version you had, and you can then apply the configuration you saved when you backed up your configuration.
For More Information
•
•
•
•
Copying and Restoring the Configuration File Using a Remote Server
Note
Use the copy [/erase] source_url destination_url keyword command to copy the configuration file to a remote server. You can then restore the current configuration from the remote server. You are prompted to back up the current configuration first.
The following options apply:
•
This keyword only applies to the current-config; the backup-config is always overwritten. If this keyword is specified for destination current-config, the source configuration is applied to the system default configuration. If it is not specified for the destination current-config, the source configuration is merged with the current-config.
•
•
The exact format of the source and destination URLs varies according to the file. Here are the valid types:
•
ftp:[//[username@] location]/relativeDirectory]/filename
ftp:[//[username@]location]//absoluteDirectory]/filename
•
scp:[//[username@] location]/relativeDirectory]/filename
scp:[//[username@] location]//absoluteDirectory]/filename
Note
•
http:[[/[username@]location]/directory]/filename
•
https:[[/[username@]location]/directory]/filename
Note
The following keywords are used to designate the file location on the sensor:
•
•
Caution
To back up and restore your current configuration, follow these steps:
Step 1
Step 2
sensor# copy scp://user@10.1.1.1//configuration/cfg current-configPassword: ********Warning: Copying over the current configuration may leave the box in an unstable state.Would you like to copy current-config to backup-config before proceeding? [yes]:Step 3
cfg 100% |************************************************| 36124 00:00Warning: Replacing existing network-settings may leave the box in an unstable state.Would you like to replace existing network settings(host-ipaddress/netmask/gateway/access-list) on sensor before proceeding? [no]:sensor#Step 4
For More Information
For the procedure for adding trusted hosts, for the CLI refer to Adding TLS Trusted Hosts, for IDM refer to Configuring Trusted Hosts, and for IME refer to Adding Trusted Hosts.
Obtaining Software on Cisco.com
Note
You can find major and minor updates, service packs, signature and signature engine updates, system and recovery files, firmware upgrades, and readmes on the Download Software site on Cisco.com. Signature updates are posted to Cisco.com approximately every week, more often if needed. Service packs are posted to Cisco.com as needed. Major and minor updates are also posted periodically. Check Cisco.com regularly for the latest IPS software.
To download software on Cisco.com, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
The available files appear in a list in the right side of the window. You can sort by file name, file size, memory, and release date. And you can access the Release Notes and other product documentation.
Step 8
The file details appear.
Step 9
Step 10
The first time you download a file from Cisco.com, you must fill in the Encryption Software Export Distribution Authorization form before you can download the software.
•
The Cisco Systems Inc. Encryption Software Usage Handling and Distribution Policy appears.
•
The Encryption Software Export/Distribution Form appears.
If you previously filled out the Encryption Software Export Distribution Authorization form, and read and accepted the Cisco Systems Inc. Encryption Software Usage Handling and Distribution Policy, these forms are not displayed again.
The File Download dialog box appears.
Step 11
Step 12
Note
For More Information
•
•
IPS Software Versioning
This section describes the various IPS software files, gives examples, and contains the following sections:
•
•
•
•
Major and Minor Updates, Service Packs, and Patch Releases
Figure 1 illustrates what each part of the IPS software file represents for major and minor updates, service packs, and patch releases.
Figure 1 IPS Software File Name for Major and Minor Updates, Service Packs, and Patch Releases
Major Update
Contains new functionality or an architectural change in the product. For example, the Cisco IPS 7.0 base version includes everything (except deprecated features) since the previous major release (the minor update features, service pack fixes, and signature updates) plus any new changes. Major update 7.0(1) requires 5.1(6) and later. With each major update there are corresponding system and recovery packages.
Note
Minor Update
Incremental to the major version. Minor updates are also base versions for service packs. The first minor update for 7.0 is 7.1(1). Minor updates are released for minor enhancements to the product. Minor updates contain all previous minor features (except deprecated features), service pack fixes, signature updates since the last major version, and the new minor features being released. You can install the minor updates on the previous major or minor version (and often even on earlier versions). The minimum supported version needed to upgrade to the newest minor version is listed in the Readme that accompanies the minor update. With each minor update there are corresponding system and recovery packages.
Service Packs
Cumulative following a base version release (minor or major). Service packs are used for the release of defect fixes with no new enhancements. Service packs contain all service pack fixes since the last base version (minor or major) and the new defect fixes being released. Service packs require the minor version. The minimum supported version needed to upgrade to the newest service pack is listed in the Readme that accompanies the service pack. Service packs also include the latest engine update. For example, if service pack 7.0(3) is released, and E3 is the latest engine level, the service pack is released as 7.0(3)E3.
Patch Release
Used to address defects that are identified in the upgrade binaries after a software release. Rather than waiting until the next major or minor update, or service pack to address these defects, a patch can be posted. Patches include all prior patch releases within the associated service pack level. The patches roll into the next official major or minor update, or service pack.
Before you can install a patch release, the most recent major or minor update, or service pack must be installed. For example, patch release 7.0(1p1) requires 7.0(1).
Note
Signature/Virus Updates and Signature Engine Updates
Figure 2 illustrates what each part of the IPS software file represents for signature/virus updates.
Figure 2 IPS Software File Name for Signature/Virus Updates,
Signature/Virus Updates
Executable file containing a set of rules designed to recognize malicious network activities. Signature updates are released independently from other software updates. Each time a major or minor update is released, you can install signature updates on the new version and the next oldest version for a period of at least six months. Signature updates are dependent on a required signature engine version. Because of this, a req designator lists the signature engine required to support a particular signature update.
A virus component for the signature updates is packaged with the signature update. Virus updates are generated by Trend Microsystems for use by the Cisco Intrusion Containment System (Cisco ICS). Once created for use by Cisco ICS, they are later be incorporated into standard Cisco signature updates.
Figure 3 illustrates what each part of the IPS software file represents for signature engine updates.
Figure 3 IPS Software File Name for Signature Engine Updates
Signature Engine Updates
Executable files containing binary code to support new signature updates. Signature engine files require a specific service pack, which is also identified by the req designator.
Recovery and System Image Filenames
Figure 4 illustrates what each part of the IPS software file represents for recovery and system image filenames.
Figure 4 IPS Software File Name for Recovery and System Image Filenames
Recovery and system images contain separate versions for the installer and the underlying application. The installer version contains a major and minor version field.
Installer Major Version
The major version is incremented by one of any major changes to the image installer, for example, switching from .tar to rpm or changing kernels.
Installer Minor Version
The minor version can be incremented by any one of the following:
•
•
7.x Software Release Examples
Table 1 lists platform-independent Cisco IPS 7.x software release examples. Refer to the Readmes that accompany the software files for detailed instructions on how to install the files.
Table 1 Platform-Independent Release Examples
Signature update1
Weekly
sig
S353
IPS-sig-S353-req-E3.pkg
Signature engine update2
As needed
engine
E3
IPS-engine-E3-req-7.0-1.pkg
Service packs3
Semi-annually
or as needed—
7.0(3)
IPS-K9-7.0-3-E3.pkg
Minor version update4
Annually
—
7.0(1)
IPS-K9-7.0-1-E3.pkg
Note
Major version update5
Annually
—
7.0(1)
IPS-K9-7.0-1-E3.pkg
Patch release6
As needed
patch
7.0(1p1)
IPS-K9-patch-7.0-1pl-E3.pkg
Recovery package7
Annually or as needed
r
1.1-7.0(1)
IPS-K9-r-1.1-a-7.0-1-E3.pkg
1 Signature updates include the latest cumulative IPS signatures.
2 Signature engine updates add new engines or engine parameters that are used by new signatures in later signature updates.
3 Service packs include defect fixes.
4 Minor versions include new minor version features and/or minor version functionality.
5 Major versions include new major version functionality or new architecture.
6 Patch releases are for interim fixes.
7 The r 1.1 can be revised to r 1.2 if it is necessary to release a new recovery package that contains the same underlying application image. If there are defect fixes for the installer, for example, the underlying application version may still be 7.0(1), but the recovery partition image will be r 1.2.
Table 2 describes platform-dependent software release examples.
Table 2 Platform-Dependent Release Examples
System image1
Annually
sys
Separate file for each sensor platform
IPS-4240-K9-sys-1.1-a-7.0-1-E3.img
Maintenance partition image2
Annually
mp
IDSM-2
c6svc-mp.2-1-2.bin.gz
Bootloader
As needed
bl
AIM-IPS
NME-IPSpse_aim_x.y.z.bin
pse_nm_x.y.z.bin
(where x, y, z is the release number)Mini-kernel
As needed
mini-kernel
AIM-IPS
NME-IPSpse_mini_kernel_1.1.10.64.bz2
1 The system image includes the combined recovery and application image used to reimage an entire sensor.
2 The maintenance partition image includes the full image for the IDSM-2 maintenance partition. The file is installed from but does not affect the IDSM-2 application partition.
Table 3 describes the platform identifiers used in platform-specific names.
Upgrading to Cisco IPS 7.0(1)E3
This section provides information on upgrading to Cisco IPS 7.0(1)E3, and contains the following topics:
Upgrade Notes and Caveats
The following upgrade notes and caveats apply to upgrading to 7.0(1)E3:
•
•
•
•
–
–
•
–
–
•
For More Information
•
•
•
•
•
•
•
Upgrading to IPS 7.0(1)E3
Caution
Caution
To upgrade the sensor, follow these steps:
Step 1
Step 2
Step 3
sensor# configure terminalStep 4
sensor(config)# upgrade url/IPS-K9-7.0-1-E3.pkgThe URL points to where the update file is located, for example, to retrieve the update using FTP, enter the following:
sensor(config)# upgrade ftp://username@ip_address//directory/IPS-K9-7.0-1-E3.pkgStep 5
Enter password: ********Step 6
Note
Note
For More Information
•
•
After Upgrading to Cisco IPS 7.0(1)E3
This section provides information about what to do after you install IPS 7.02(1)E3. It contains the following topics:
•
Comparing Configurations
Compare your backed up and saved IPS 6.2 configuration with the output of the show configuration command after upgrading to 7.0(1)E3 to verify that all the configuration has been properly converted.
Caution
For More Information
For a list of the caveats associated with this release, see Caveats.
Importing a New SSL Certificate
If necessary import the new SSL certificate for the upgraded sensor in to each tool being used to monitor the sensor.
For More Information
For the procedures for configuring TLS/SSL, for the CLI refer to Configuring TLS, for IDM refer to Configuring Trusted Hosts, and for IME refer to Configuring Trusted Hosts.
Logging In to IDM
IDM is a web-based, Java Web Start application that enables you to configure and manage your sensor. The web server for IDM resides on the sensor. You can access it through Internet Explorer or Firefox web browsers.
To log in to IDM, follow these steps:
Step 1
https://sensor_ip_address
Note
Note
A Security Alert dialog box appears.
Step 2
The Cisco IPS Device Manager Version 7.0 window appears.
Step 3
The JAVA loading message box appears.
The Warning - Security dialog box appears.
Step 4
The JAVA Web Start progress dialog box appears.
The IDM on ip_address dialog box appears.
Step 5
Note
The Cisco IDM Launcher dialog box appears.
Step 6
Note
IDM begins to load.
If you change panes from Home to Configuration or Monitoring before IDM has complete initialization, a Status dialog box appears with the following message:
Please wait while IDM is loading the current configuration from the sensor.The main window of IDM appears.
Note
Licensing the Sensor
This section describes how to obtain a license key and how to license the sensor using the CLI, IDM, or IME. It contains the following topics:
•
•
Understanding the License
Although the sensor functions without the license key, you must have a license key to obtain signature updates and use the global correlation features. To obtain a license key, you must have the following:
•
Contact your reseller, Cisco service or product sales to purchase a contract.
•
To find the IPS device serial number in IDM or IME, for IDM choose Configuration > Sensor Management > Licensing, and for IME choose Configuration > sensor_name > Sensor Management > Licensing, or in the CLI use the show version command.
•
Trial license keys are also available. If you cannot get your sensor licensed because of problems with your contract, you can obtain a 60-day trial license that supports signature updates that require licensing.
You can obtain a license key from the Cisco.com licensing server, which is then delivered to the sensor. Or, you can update the license key from a license key provided in a local file. Go to http://www.cisco.com/go/license and click IPS Signature Subscription Service to apply for a license key.
You can view the status of the license key in these places:
•
•
•
•
Whenever you start IDM, IME, or the CLI, you are informed of your license status—whether you have a trial, invalid, or expired license key. With no license key, an invalid license key, or an expired license key, you can continue to use IDM, IME, and the CLI, but you cannot download signature updates.
If you already have a valid license on the sensor, you can click Download on the License pane to download a copy of your license key to the computer that IDM or IME is running on and save it to a local file. You can then replace a lost or corrupted license, or reinstall your license after you have reimaged the sensor.
Service Programs for IPS Products
You must have a Cisco Services for IPS service contract for any IPS product so that you can download a license key and obtain the latest IPS signature updates. If you have a direct relationship with Cisco Systems, contact your account manager or service account manager to purchase the Cisco Services for IPS service contract. If you do not have a direct relationship with Cisco Systems, you can purchase the service account from a one-tier or two-tier partner.
When you purchase the following IPS products you must also purchase a Cisco Services for IPS service contract:
•
•
•
•
•
•
•
For ASA 5500 series adaptive security appliance products, if you purchased one of the following ASA 5500 series adaptive security appliance products that do not contain IPS, you must purchase a SMARTnet contract:
•
•
•
•
•
•
•
•
•
Note
If you purchased one of the following ASA 5500 series adaptive security appliance products that ships with AIP-SSM installed or if you purchased to add to your ASA 5500 series adaptive security appliance product, you must purchase the Cisco Services for IPS service contract:
•
•
•
•
•
•
•
•
•
Note
For example, if you purchased an ASA-5510 and then later wanted to add IPS and purchased an ASA-SSM-AIP-10-K9, you must now purchase the Cisco Services for IPS service contract.
After you have the Cisco Services for IPS service contract, you must also have your product serial number to apply for the license key.
Caution
Obtaining and Installing the License Key
You can install the license key through the CLI, IDM, or IME. This section describes how to obtain and install the license key, and contains the following topics:
Using IDM or IME
Note
To obtain and install the license key, follow these steps:
Step 1
Step 2
The Licensing pane displays the status of the current license. If you have already installed your license, you can click Download to save it if needed.
Step 3
•
IDM or IME contacts the license server on Cisco.com and sends the server the serial number to obtain the license key. This is the default method. Go to Step 4.
•
To use this option, you must apply for a license key at this URL: www.cisco.com/go/license.
The license key is sent to you in e-mail and you save it to a drive that IDM or IME can access. This option is useful if your computer cannot access Cisco.com. Go to Step 7.
Step 4
The Status dialog box informs you that the sensor is trying to connect to Cisco.com. An Information dialog box confirms that the license key has been updated.
Step 5
Step 6
Step 7
Caution
Your license key will be sent to the e-mail address you specified.
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
Using the CLI
Note
Use the copy source-url license_file_name license-key command to copy the license key to your sensor.
The following options apply:
•
•
•
•
The exact format of the source and destination URLs varies according to the file. Here are the valid types:
•
ftp:[//[username@] location]/relativeDirectory]/filename
ftp:[//[username@]location]//absoluteDirectory]/filename
•
scp:[//[username@] location]/relativeDirectory]/filename
scp:[//[username@] location]//absoluteDirectory]/filename
Note
•
http:[[/[username@]location]/directory]/filename
•
https:[[/[username@]location]/directory]/filename
Note
To install the license key, follow these steps:
Step 1
Note
Step 2
Note
Your Cisco IPS Signature Subscription Service license key will be sent by e-mail to the e-mail address you specified.
Step 3
Step 4
Step 5
sensor# copy scp://user@10.89.147.3://tftpboot/dev.lic license-keyPassword: *******Step 6
sensor# show versionApplication Partition:Cisco Intrusion Prevention System, Version 7.0(1)E3Host:Realm Keys key1.0Signature Definition:Signature Update S391.0 2008-04-16Virus Update V1.2 2005-11-24OS Version: 2.4.30-IDS-smp-bigphysPlatform: ASA-SSM-20Serial Number: P300000220Sensor up-time is 3 days.Using 1031888896 out of 2093682688 bytes of available memory (49% usage)system is using 17.8M out of 29.0M bytes of available disk space (61% usage)application-data is using 52.4M out of 166.6M bytes of available disk space (33% usage)boot is using 37.8M out of 68.5M bytes of available disk space (58% usage)MainApp N-2007_JUN_19_16_45 (Release) 2007-06-19T17:10:20-0500 RunningAnalysisEngine N-2007_JUN_19_16_45 (Release) 2007-06-19T17:10:20-0500 RunningCLI N-2007_JUN_19_16_45 (Release) 2007-06-19T17:10:20-0500Upgrade History:IPS-K9-7.0-1-E3 15:36:05 UTC Thu Apr 24 2008Recovery Partition Version 1.1 - 7.0(1)E3Host Certificate Valid from: 25-Apr-2008 to 26-Apr-2010sensor#Step 7
sensor# copy license-key scp://user@10.89.147.3://tftpboot/dev.licPassword: *******sensor#
Installing or Upgrading Cisco IME
This section describes how to install and upgrade IME, and contains the following topics:
•
•
Before Installing or Upgrading IME
Caution
IME 7.0 detects previous versions of IEV and prompts you to manually remove the older version before installing IME 7.0 or to install IME on another system. The installation program then stops.
IME 7.0 coexists with other instances of the MySQL database. If you have a MySQL database installed on your system, you do NOT have to uninstall it before installing IME 7.0.
Migrating IEV Data
To migrate IEV 5.x events to IME, you must exit the installation and manually export the old events by using the IEV 5.x export function to move the data to local files. After installing IME 7.0, you can import these files to the new IME system.
Note
To export event data from IEV 5.x to a local file:
Step 1
Step 2
Step 3
The events in the selected table(s) are exported to the specified local file.
Importing IEV Event Data In to IME
To import event data in to IME, follow these steps:
Step 1
Step 2
The contents of the selected file are imported in to IME.
Cisco IME Installation and Upgrade Instructions
Cisco IPS Event Viewer and Cisco IOS IPS
If you have a version of Cisco IPS Event Viewer installed, the Install wizard prompts you to remove it before installing IME.
IME event monitoring is also supported in IOS-IPS versions that support the Cisco IPS 5.x/6.x signature format. We recommend IOS-IPS 12.4(15)T4 if you intend to use IME to monitor an IOS IPS device. Some of the new IME functionality including health monitoring is not supported.
IME Installation and Upgrade Caveats
•
•
•
Installing or Upgrading to IME 7.0
You can install IME 7.0 over IME 6.2. All alert database and user settings are preserved.
To install IME, follow these steps:
Step 1
IME-7.0.1.exe is an example of what the IME executable file might look like.
Step 2
The Cisco IPS Manager Express - InstallShield Wizard appears.
Step 3
Step 4
The Cisco IPS Manager Express - InstallShield Wizard appears.
Step 5
Step 6
Step 7
The Cisco IME and Cisco IME Demo icons are now on your desktop.
For More Information
For more information about Cisco IME, refer to Installing and Using Cisco Intrusion Prevention System Manager Express 7.0.
Restrictions and Limitations
The following restrictions and limitations apply to Cisco IPS 7.0(1)E3 software and the products that run it:
•
•
•
•
•
•
•
•
•
AIM-IPS and NME-IPS and the IOS firewall complement abilities of each other to create security zones in the network and inspect traffic in those zones. Because AIM-IPS and NME-IPS and the IOS firewall operate independently, sometimes they are unaware of the activities of the other. In this situation, the IOS firewall is the best defense against a SYN flood attack.
•
•
•
•
This is true for any string that is used by CLI as an identifier, for example, names of time periods, inspect maps, server and URL lists, and interfaces.
•
•
•
For More Information
•
•
Caveats
This section lists the resolved and known caveats, and contains the following topics:
Bug Navigator Tool
For the most complete and up-to-date list of caveats, use the Bug Navigator Tool to refer to the caveat release notes. The Bug Navigator Tool is found at this URL:
http://www.cisco.com/pcgi-bin/Support/Bugtool/launch_bugtool.pl
Resolved Caveats
The following known issues have been resolved in the 7.0(1)E3 release:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
The following known IDM issues have been resolved in the 7.0(1)E3 release:
•
•
The following known IME issues have been resolved in the 7.0(1)E3 release:
•
•
Known Caveats
The following known issues are found in Cisco IPS 7.0(1)E3:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
The following known issues are found in Cisco IPS 7.0(1)E3 IDM:
•
•
•
•
•
•
•
•
•
•
The following known issues are found in Cisco IPS 7.0(1)E3 IME:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Related Documentation
For more information on Cisco IPS, refer to the following documentation found at this URL:
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/tsd_products_support_series_home.html
•
•
•
•
•
•
•
•
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0910R)
Copyright © 2009 Cisco Systems, Inc. All rights reserved.
Guest
