Installing the NME IPS
Note All IPS platforms allow ten concurrent CLI sessions.
This chapter describes how to install the NME IPS. It contains the following sections:
•Before Installing the NME IPS
•Software and Hardware Requirements
•Interoperability With Other IPS Modules
•Installation and Removal Instructions
Table 8-1 lists the specifications for the NME IPS.
Table 8-1 NME IPS Specifications
Dimensions (H x W x D)
1.55 x 7.10 x 7.2 in. (3.9 x 18.0 x 19.3 cm)
1 lb (0.45 kg) (maximum)
+32° to +104°F (+0° to +40°C)
-40° to +185°F (-40° to +85°C)
5% to 95% noncondensing
0 to 10,000 ft (0 to 3,000 m)
Before Installing the NME IPS
Follow these recommendations before installing the NME IPS:
•Upgrade or downgrade software when you can take all applications that run on the router out of service or offline.
•Make sure that you have the correct router and software for the module.
•For safety and regulatory information, read Cisco Network Modules and Interface Cards Regulatory Compliance and Safety Information.
•Make a note of the location of the module in the router (slot_number/port_number). The port value is 0, and the slot number field specifies the physical slot number for the NME IPS (slot_number/IDS-Sensor 0).
Note After you install the module, you can get this information by using the show running-config command. You need the module slot number to configure the interfaces on the module.
For More Information
•For the supported routers and software, see Software and Hardware Requirements.
•For more information, refer to Setting Up Interfaces on the NME IPS and the Router.
Software and Hardware Requirements
The router and the NME IPS have the following software and hardware requirements:
•The router must be running Cisco IOS release 12.4(20)YA or 12.4(22)T or later.
Note Use the show version command in the router CLI to determine which Cisco IOS release your router is running.
•The module must be running IPS 6.1(1) or later.
Note Use the service-module IDS-Sensor slot/port status command in the IOS CLI to determine which IPS release your sensor is running. Or use the show version command in the module CLI.
–Cisco 2800 series (2811, 2821, and 2851)
–Cisco 3800 series (3825 and 3845)
Note The Cisco routers support up to one NME IPS per platform.
•Supported Cisco IOS Feature Sets:
–Cisco IOS Advanced Security
–Cisco IOS Advanced IP Services
–Cisco IOS Advanced Enterprise Services
Interoperability With Other IPS Modules
You cannot upgrade an NM CIDS to an NME IPS.
The Cisco access routers only support one IDS/IPS module per router. If you have more than one IDS/IPS module installed, the most capable card is enabled. The most capable hierarchy is:
1. NME IPS
2. AIM IPS
3. NM CIDS
This means, for example, that if all modules are installed, the NME IPS disables all other modules. The AIM IPS disables all NM CIDS. If there are multiple modules with the same level of capability, the first one discovered is enabled and all others are disabled.
You cannot bring up, enable, or configure a disabled module. To bring up a less capable module, you must remove the more capable module from the router and reboot. Disabled modules are reported in the show diag command output. The state of the module is reported as present but disabled.
If the most capable module slot and port do not match the interface ids slot/port configuration command, the most capable module is disabled with the following warning:
The module in slot x will be disabled and configuration ignored.
The correct slot/port number are displayed so that you can change the configuration.
For More Information
For more information on NM CIDS, refer to Introducing NM CIDS and Installing NM CIDS.
The following restrictions apply to the NME IPS:
•Do not deploy IOS IPS and the NME IPS at the same time.
•When the NME IPS is used with an IOS firewall, make sure SYN flood prevention is done by the IOS firewall.
The NME IPS and the IOS firewall complement each other's abilities to create security zones in the network and inspect traffic in those zones. Because the NME IPS and the IOS firewall operate independently, sometimes they are unaware of the other's activities. In this situation, the IOS firewall is the best defense against a SYN flood attack.
•The Cisco access routers only support one IDS/IPS per router.
•When you reload the router, the NME IPS also reloads. To ensure that there is no loss of data on the NME IPS, make sure you shut down the module using the shutdown command before you use the reload command to reboot the router.
For More Information
•For more information on how the NME IPS functions with other IPS modules, see Interoperability With Other IPS Modules.
•For more information about shutting down the NME IPS, refer to Rebooting, Resetting, and Shutting Down the NME IPS.
Figure 8-1 shows the router and the NME IPS interfaces used for internal and external communication. You can configure the router interfaces through the Cisco IOS CLI and the NME IPS interfaces through the IPS CLI, IDM, IME, or CSM.
Figure 8-1 NME IPS and Router Interfaces
Router interface to external link
Configure the standard router settings using the Cisco IOS CLI.
Router interface to the NME IPS (ids-sensor x/0)
Configure the IP address and default gateway router of the NME IPS using the Cisco IOS CLI.
The NME IPS interface to router (GigabitEthernet0/1)
Configure the interface as inline or promiscuous using the Cisco IOS CLI.
The NME IPS interface to external link (Management0/1)
Configure the command and control interface using the IPS CLI, IDM, IME, or CSM.
For More Information
•For more information on the IPS CLI, refer to Configuring the Cisco Intrusion Prevention System Sensor Using the Command Line Interface 7.0.
•For more information on IDM, refer to Installing and Using Cisco Intrusion Prevention System Device Manager 7.0.
•For IME, refer to Installing and Using Cisco Intrusion Prevention System Manager Express 7.0.
Installation and Removal Instructions
For instructions on how to install and remove the NME IPS, refer to Installing Cisco Network Modules in Cisco Access Routers.
To comply with the Telcordia GR-1089 NEBS standard for electromagnetic compatibility and safety, connect the NME IPS only to intrabuilding or nonexposed wiring or cabling. The intrabuilding cable must be shielded and the shield must be grounded at both ends.
For More Information
•For the procedure for verifying that the NME IPS is installed properly, see Verifying Installation.
•For the procedure for using the setup command to initialize the NME IPS, see Initializing the Sensor.
•For more information about obtaining the most recent Cisco IPS software, see Obtaining Cisco IPS Software.
•For the procedure to configure the NME IPS to receive IPS traffic, refer to Setting Up Interfaces on the NME IPS and the Router.
•For the procedure for using HTTPS to log in to IDM, refer to Logging In to IDM.
•For the procedures for configuring intrusion prevention on your sensor, refer to the following guides:
–Installing and Using Cisco Intrusion Prevention System Device Manager 7.0
–Installing and Using Cisco Intrusion Prevention System Manager Express 7.0
–Configuring the Cisco Intrusion Prevention System Sensor Using the Command Line Interface 7.0
Use the show inventory command in privileged EXEC mode to verify the installation of the NME IPS.
Note You can also use this command to find the serial number of your NME IPS for use in troubleshooting with TAC. The serial number appears in the PID line, for example, SN: FHH1117001R.
To verify the installation of the NME IPS, follow these steps:
Step 1 Log in to the router.
Step 2 Enter privileged EXEC mode on the router.
Step 3 Verify that the NME IPS is part of the router inventory.
NAME: "3845 chassis", DESCR: "3845 chassis"
PID: CISCO3845 , VID: V01 , SN: FTX1002C255
NAME: "c3845 Motherboard with Gigabit Ethernet on Slot 0", DESCR: "c3845 Motherb
oard with Gigabit Ethernet"
PID: CISCO3845-MB , VID: V03 , SN: FOC09514J4Y
NAME: "4 Port FE Switch on Slot 0 SubSlot 0", DESCR: "4 Port FE Switch"
PID: HWIC-4ESW , VID: V01 , SN: FOC1102394U
NAME: "High Speed WAN Interface Card - 1 Port Gigabit Ethernet on Slot 0 SubSlot
3", DESCR: "High Speed WAN Interface Card - 1 Port Gigabit Ethernet"
PID: HWIC-1GE-SFP , VID: V01 , SN: FOC10164DAR
NAME: "1000BASE-T SFP", DESCR: "1000BASE-T SFP"
PID: SP7041 , VID: C , SN: 00000MTC101608RB
NAME: "Cisco Intrusion Prevention System NM on Slot 2", DESCR: "Cisco Intrusion
PID: NME IPS-K9 , VID: V01, SN: FHH1117001R