Release Notes for Intrusion Prevention System 7.1(11)E4

---

---

---

---

---

Upgrade Notes and Caveats

Pay attention to the following upgrade notes and caveats when upgrading to IPS 7.1(11)E4:

• You cannot upgrade to 7.1(11)E4 if the sensor license was generated for 6.0.x versions and earlier. The upgrade fails and the following message is displayed:

• If you are upgrading the IPS 4270-20 and you have a license for 6.0. x and earlier, you receive the following error message:

You must get a new license before upgrading your IPS 4270-20.

• Anomaly detection has been disabled by default. If you did not configure the operation mode manually before the upgrade, it defaults to inactive after you upgrade to IPS 7.1(11)E4. If you configured the operation mode to detect, learn, or inactive, the tuned value is preserved after the upgrade.
• You must have a valid maintenance contract per sensor to download software upgrades from Cisco.com.
• You must be running the following versions to upgrade the following platforms to IPS 7.1(11)E4:

– For the IPS 4200 series sensors, you must be running IPS 6.0(6)E4 or later.

– For the IPS 4300 series sensors and the ASA 5500-X IPS SSP series, you must be running IPS 7.1(3)E4 or later.

– For the IPS 4500 series sensors, you must be running IPS 7.1(4)E4 or later.

– For the ASA 5500 AIP SSM series, you must be running IPS 6.0(6)E4 or later.

– For the ASA 5585-X IPS SSP series, you must be running IPS 7.1(1)E4 or later.

• A generic upgrade package is no longer available for the IPS 4240, IPS 4255, IPS 4260, and ASA 5500 AIP SSM series. These platforms now have platform-specific filenames in accordance with the 7.1(x) format.
• This service pack automatically reboots the sensor to apply the changes. During reboot, inline network traffic is disrupted.
• You cannot uninstall 7.1(11)E4. To revert to a previous version, you must reimage the sensor using the appropriate system image file

For More Information

• For the procedure to download software from Cisco.com, see Obtaining Software.
• For the procedure for using the upgrade command to upgrade the sensor, see Upgrading the Sensor.
• For the procedure for using ROMMON to restore the IPS 4240 and IPS 4255 system image, see Installing the IPS 4240 and IPS 4255 System Image.
• For the procedure for using ROMMON to restore the IPS 4260 system image, see Installing the IPS 4260 System Image.
• For the procedure for using ROMMON to restore the IPS 4270-20 system image, see Installing the IPS 4270-20 System Image.
• For the procedure for using ROMMON to restore the IPS 4510 and IPS 4520 system image, see Installing the IPS 4510 and IPS 4520 System Image.
• For the procedure for installing the ASA 5500 AIP SSM system image, see Installing the ASA 5500 AIP SSM System Image.
• For the procedure for installing the ASA 5500-X IPS SSP system image, see Installing the ASA 5500-X IPS SSP System Image.
• For the procedure for installing the ASA 5585-X IPS SSP system image, see Installing the ASA 5585-X IPS SSP System Image.

Upgrading the Sensor

Use the upgrade source-url command to apply service pack, signature update, engine update, minor version, major version, or recovery partition file upgrades.

The following options apply:

• source-url —Specifies the location of the source file to be copied:

– ftp:—Source URL for an FTP network server. The syntax for this prefix is:

ftp://[[username@]location][/relativeDirectory]/filename

ftp://[[username@]location][//absoluteDirectory]/filename

---

Note You are prompted for a password.

– scp:—Source URL for the SCP network server. The syntax for this prefix is:

scp://[[username@]location][/relativeDirectory]/filename

scp://[[username@]location][//absoluteDirectory]/filename

---

Note You are prompted for a password. You must add the remote host to the SSH known hosts list.

– http:—Source URL for the web server. The syntax for this prefix is:

http://[[username@]location][/directory]/filename

---

Note The directory specification should be an absolute path to the desired file.

– https:—Source URL for the web server. The syntax for this prefix is:

https://[[username@]location][/directory]/filename

---

Note The directory specification should be an absolute path to the desired file. The remote host must be a TLS trusted host.

Upgrading the Sensor

To upgrade the sensor, follow these steps:

---

Step 1 Download the appropriate file to an FTP, SCP, HTTP, or HTTPS server that is accessible from your sensor.

Step 2 Log in to the CLI using an account with administrator privileges.

Step 3 Enter configuration mode.

Step 4 Upgrade the sensor.

The URL points to where the update file is located, for example, to retrieve the update using FTP, enter the following:

Step 5 Enter the password when prompted.

Step 6 Enter yes to complete the upgrade.

---

Note Major updates, minor updates, and service packs may force a restart of the IPS processes or even force a reboot of the sensor to complete installation.

---

Note The operating system is reimaged and all files that have been placed on the sensor through the service account are removed.

Step 7 Verify your new sensor version.

 

For More Information

For a list of the specific IPS upgrade filenames, see IPS File List.

---

---

Installing the IPS 4240 and IPS 4255 System Image

---

Note This procedure is for the IPS 4240, but is also applicable to the IPS 4255. The system image for the IPS 4255 has “4255” in the filename.

You can install the IPS 4240 and IPS 4255 system image by using the ROMMON on the appliance to TFTP the system image onto the compact flash device.

To install the IPS 4240 and IPS 4255 system image, follow these steps:

---

Step 1 Download the IPS 4240 system image file to the tftp root directory of a TFTP server that is accessible from your IPS 4240.

---

Note Make sure you can access the TFTP server location from the network connected to the Ethernet port of your IPS 4240.

Step 2 Boot the IPS 4240.

Step 3 Press Break or Esc at the following prompt while the system is booting to interrupt boot. Press the space bar to begin boot immediately.

---

Note You have ten seconds to press Break or Esc.

The system enters ROMMON mode. The rommon> prompt appears.

Step 4 Check the current network settings.

The variables have the following definitions:

• Address—Local IP address of the IPS 4240
• Server—TFTP server IP address where the application image is stored
• Gateway—Gateway IP address used by the IPS 4240
• Port—Ethernet interface used for the IPS 4240 management
• VLAN—VLAN ID number (leave as untagged)
• Image—System image file/path name
• Config—Unused by these platforms

---

Note Not all values are required to establish network connectivity. The address, server, gateway, and image values are required. If you are not sure of the settings needed for your local environment, contact your system administrator.

Step 5 If necessary, change the interface used for the TFTP download.

---

Note The default interface used for TFTP downloads is Management 0/0, which corresponds to the MGMT interface of the IPS 4240.

Step 6 If necessary, assign an IP address for the local port on the IPS 4240.

---

Note Use the same IP address that is assigned to the IPS 4240.

Step 7 If necessary, assign the TFTP server IP address.

Step 8 If necessary, assign the gateway IP address.

Step 9 Verify that you have access to the TFTP server by pinging it from your local Ethernet port with one of the following commands.

Step 10 If necessary define the path and filename on the TFTP file server from which you are downloading the image.

---

UNIX Example

---

Note The path is relative to the default tftpboot directory of the UNIX TFTP server. Images located in the default tftpboot directory do not have any directory names or slashes in the IMAGE specification.

Windows Example

Step 11 Enter set and press Enter to verify the network settings.

---

Note You can use the sync command to store these settings in NVRAM so they are maintained across boots. Otherwise, you must enter this information each time you want to boot an image from ROMMON.

Step 12 Download and install the system image.

---

---

Note If the network settings are correct, the system downloads and boots the specified image on the IPS 4240. Be sure to use the IPS 4240 image.

 

Installing the IPS 4260 System Image

You can install the IPS 4260 system image by using the ROMMON on the appliance to TFTP the system image onto the flash device.

To install the IPS 4260 system image, follow these steps:

---

Step 1 Download the IPS 4260 system image file to the tftp root directory of a TFTP server that is accessible from your IPS 4260.

Make sure you can access the TFTP server location from the network connected to your IPS 4260 Ethernet port.

Step 2 Boot the IPS 4260.

Step 3 Press Ctrl-R at the following prompt while the system is booting.

---

Note You have five seconds to press Ctrl-R.

Step 4 If necessary, change the port used for the TFTP download.

The port in use is listed just after the platform identification. In the example, port Management 0/0 is being used.

---

Note The default port used for TFTP downloads is Management 0/0, which corresponds with the command and control (MGMT) interface of the IPS 4260.

---

Note Ports Management 0/0 (MGMT) and GigabitEthernet 0/1 (GE 0/1) are labeled on the back of the chassis.

Step 5 Specify an IP address for the local port on the IPS 4260.

---

Note Use the same IP address that is assigned to the IPS 4260.

Step 6 Specify the TFTP server IP address.

Step 7 Specify the gateway IP address.

Step 8 Verify that you have access to the TFTP server by pinging it from the local Ethernet port.

Step 9 Specify the path and filename on the TFTP file server from which you are downloading the image.

UNIX Example

---

Note The path is relative to the default tftpboot directory of the UNIX TFTP server. Images located in the default tftpboot directory do not have any directory names or slashes in the file location.

Windows Example

Step 10 Download and install the system image.

---

Note The IPS 4260 reboots once during the reimaging process. Do not remove power from the IPS 4260 during the update process or the upgrade can become corrupted.

 

Installing the IPS 4270-20 System Image

You can install the IPS 4270-20 system image by using the ROMMON on the appliance to TFTP the system image onto the compact flash device.

To install the IPS 4270-20 system image, follow these steps:

---

Step 1 Download the IPS 4270-20 system image file to the tftp root directory of a TFTP server that is accessible from your IPS 4270-20.

---

Note Make sure you can access the TFTP server location from the network connected to the Ethernet port of your IPS 4270-20.

Step 2 Boot the IPS 4270-20.

---

Note The controller type errors are a known issue and can be disregarded.

Step 3 Press Break or Esc at the following prompt while the system is booting to interrupt boot. Press the space bar to begin boot immediately.

---

Note You have ten seconds to press Break or Esc.

The system enters ROMMON mode. The rommon> prompt appears.

Step 4 Check the current network settings.

The variables have the following definitions:

• Address—Specifies the local IP address of the IPS 4270-20.
• Server—Specifies the TFTP server IP address where the application image is stored.
• Gateway—Specifies the gateway IP address used by the IPS 4270-20.
• Port—Specifies the Ethernet interface used for IPS 4270-20 management.
• VLAN—Specifies the VLAN ID number (leave as untagged).
• Image—Specifies the system image file/path name.
• Config—Unused by these platforms.

---

Note Not all values are required to establish network connectivity. The address, server, gateway, and image values are required. If you are not sure of the settings needed for your local environment, contact your system administrator.

Step 5 If necessary, assign an IP address for the local port on the IPS 4270-20.

---

Note Use the same IP address that is assigned to the IPS 4270-20.

Step 6 If necessary, assign the TFTP server IP address.

Step 7 If necessary, assign the gateway IP address.

Step 8 Verify that you have access to the TFTP server by pinging it from your local Ethernet port with one of the following commands:

Step 9 If necessary define the path and filename on the TFTP file server from which you are downloading the image.

UNIX Example

---

Note The path is relative to the UNIX TFTP server default tftpboot directory. Images located in the default tftpboot directory do not have any directory names or slashes in the IMAGE specification.

Windows Example

Step 10 Enter set and press Enter to verify the network settings.

---

Note You can use the sync command to store these settings in NVRAM so they are maintained across boots. Otherwise, you must enter this information each time you want to boot an image from ROMMON.

Step 11 Download and install the system image.

---

---

Note If the network settings are correct, the system downloads and boots the specified image on the IPS 4270-20. Be sure to use the IPS 4270-20 image.

 

For More Information

• For the procedure for locating software, see Obtaining Software.
• For a list of supported TFTP servers, see Supported Servers.
• For a list of the specific IPS software files, see IPS File List.
• For the procedure for initializing the sensor with the setup command, see Initializing the Sensor.

Installing the IPS 4345 and IPS 4360 System Image

You can install the IPS 4345 and IPS 4360 system image by using the ROMMON on the appliance to TFTP the system image on to the compact flash device.

---

Note This procedure is for IPS 4345, but is also applicable to IPS 4360. The system image for IPS 4360 has “4360” in the filename.

To install the IPS 4345 and IPS 4360 system image, follow these steps:

---

Step 1 Download the IPS 4345 system image file to the tftp root directory of a TFTP server that is accessible from your IPS 4345.

---

Note Make sure you can access the TFTP server location from the network connected to the Ethernet port of your IPS 4345.

Step 2 Boot the IPS 4345.

Step 3 Press Break or Esc at the following prompt while the system is booting to interrupt boot. Press the space bar to begin boot immediately.

---

Note You have ten seconds to press Break or Esc.

The system enters ROMMON mode. The rommon> prompt appears.

Step 4 Check the current network settings.

The variables have the following definitions:

• Address—Local IP address of the IPS 4345.
• Server—TFTP server IP address where the application image is stored.
• Gateway—Gateway IP address used by the IPS 4345.
• Port—Ethernet interface used for the IPS 4345 management.
• VLAN—VLAN ID number (leave as untagged).
• Image—System image file/path name.
• Config—Unused by these platforms.

---

Note Not all values are required to establish network connectivity. The address, server, gateway, and image values are required. If you are not sure of the settings needed for your local environment, contact your system administrator.

Step 5 If necessary, change the interface used for the TFTP download.

---

Note The default interface used for TFTP downloads is Management 0/0, which corresponds to the MGMT interface of the IPS 4345.

Step 6 If necessary, assign an IP address for the local port on the IPS 4345.

---

Note Use the same IP address that is assigned to the IPS 4345.

Step 7 Assign the TFTP server IP address.

Step 8 If necessary, assign the gateway IP address.

Step 9 Verify that you have access to the TFTP server by pinging it from your local Ethernet port with one of the following commands:

Step 10 If necessary define the path and filename on the TFTP file server from which you are downloading the image.

---

UNIX Example

---

Note The path is relative to the default tftpboot directory of the UNIX TFTP server. Images located in the default tftpboot directory do not have any directory names or slashes in the IMAGE specification.

Windows Example

Step 11 Enter set and press Enter to verify the network settings.

---

Note You can use the sync command to store these settings in NVRAM so they are maintained across boots. Otherwise, you must enter this information each time you want to boot an image from ROMMON.

Step 12 Download and install the system image.

---

---

Note If the network settings are correct, the system downloads and boots the specified image on the IPS 4345. Be sure to use the IPS 4345 image.

 

For More Information

• For the procedure for locating software, see Obtaining Software.
• For a list of supported TFTP servers, see Supported Servers.
• For a list of the specific IPS software files, see IPS File List.
• For the procedure for initializing the sensor with the setup command, see Initializing the Sensor.

Installing the IPS 4510 and IPS 4520 System Image

You can install the IPS 4510 and IPS 4520 system image by using the ROMMON on the appliance to TFTP the system image onto the compact flash device.

---

Note The following procedure references the IPS 4510 but it also refers to the IPS 4520.

To install the IPS 4510 system image, follow these steps:

---

Step 1 Download the IPS 4510 system image file to the tftp root directory of a TFTP server that is accessible from your IPS 4510.

---

Note Make sure you can access the TFTP server location from the network connected to the Management port of your IPS 4510.

Step 2 Boot the IPS 4510.

Step 3 Press Break or Esc at the following prompt while the system is booting to interrupt boot. Press the space bar to begin boot immediately.

---

Note You have ten seconds to press Break or Esc.

The system enters ROMMON mode. The rommon> prompt appears.

Step 4 Check the current network settings.

The variables have the following definitions:

• Address—Specifies the local IP address of the IPS 4510.
• Server—Specifies the TFTP server IP address where the application image is stored.
• Gateway—Specifies the gateway IP address used by the IPS 4510.
• Port—Specifies the Ethernet interface used for IPS 4510 management.
• VLAN—Specifies the VLAN ID number (leave as untagged).
• Image—Specifies the system image file/path name.
• Config—Unused by these platforms.

---

Note Not all values are required to establish network connectivity. The address, server, gateway, and image values are required. If you are not sure of the settings needed for your local environment, contact your system administrator.

Step 5 If necessary, assign an IP address for the local port on the IPS 4510.

---

Note Use the same IP address that is assigned to the IPS 4510.

Step 6 If necessary, assign the TFTP server IP address.

Step 7 If necessary, assign the gateway IP address.

Step 8 Verify that you have access to the TFTP server by pinging it from your local Ethernet port with one of the following commands:

Step 9 If necessary define the path and filename on the TFTP file server from which you are downloading the image.

UNIX Example

---

Note The path is relative to the UNIX TFTP server default tftpboot directory. Images located in the default tftpboot directory do not have any directory names or slashes in the IMAGE specification.

Windows Example

Step 10 Enter set and press Enter to verify the network settings.

---

Note You can use the sync command to store these settings in NVRAM so they are maintained across boots. Otherwise, you must enter this information each time you want to boot an image from ROMMON.

Step 11 Download and install the system image.

---

---

Note If the network settings are correct, the system downloads and boots the specified image on the IPS 4510. Be sure to use the IPS 4510 image.

 

For More Information

• For the procedure for locating software, see Obtaining Software.
• For a list of supported TFTP servers, see Supported Servers.
• For a list of the specific IPS software files, see IPS File List.
• For the procedure for initializing the sensor with the setup command, see Initializing the Sensor.

Installing the ASA 5500 AIP SSM System Image

---

Note Be sure the TFTP server that you specify can transfer files up to 60 MB in size.

---

Note This process can take approximately 15 minutes to complete, depending on your network and the size of the image.

If the ASA 5500 AIP SSM suffers a failure and the module application image cannot run, you can transfer application images from a TFTP server to the module using the adaptive security appliance CLI. The adaptive security appliance can communicate with the module ROMMON application to transfer the image.

To install the system image of the ASA 5500 AIP SSM, follow these steps:

---

Step 1 Download the system image file to the tftp root directory of a TFTP server that is accessible from your adaptive security appliance.

---

Note Make sure you can access the TFTP server location from the network connected to the Ethernet port of the adaptive security appliance.

Step 2 Log in to the adaptive security appliance.

Step 3 Enter enable mode.

Step 4 Configure the recovery settings for the ASA 5500 AIP SSM.

---

Note If you make an error in the recovery configuration, use the hw-module module 1 recover stop command to stop the system reimaging and then you can correct the configuration.

Step 5 Specify the TFTP URL for the system image.

Example

Step 6 Specify the command and control interface of the ASA 5500 AIP SSM.

---

Note The port IP address is the management IP address of the ASA 5500 AIP SSM.

Example

Step 7 Leave the VLAN ID at 0.

Step 8 Specify the default gateway of the ASA 5500 AIP SSM.

Example

Step 9 Execute the recovery. This transfers the image from the TFTP server to the ASA 5500 AIP SSM.

Step 10 Periodically check the recovery until it is complete.

---

Note The status reads Recovery during recovery and reads Up when reimaging is complete.

---

Note The Status field in the output indicates the operational status of the ASA 5500 AIP SSM. An ASA 5500 AIP SSM operating normally shows a status of “Up.” While the adaptive security appliance transfers an application image to the ASA 5500 AIP SSM, the Status field in the output reads “Recover.” When the adaptive security appliance completes the image transfer and restarts the ASA 5500 AIP SSM, the newly transferred image is running.

---

Note To debug any errors that may happen in the recovery process, use the debug module-boot command to enable debugging of the system reimaging process.

Step 11 Session to the ASA 5500 AIP SSM and initialize it with the setup command.

 

Installing the ASA 5500-X IPS SSP System Image

---

Note Be sure the TFTP server that you specify can transfer files up to 60 MB in size.

To install the system image on the ASA 5500-X IPS SSP, follow these steps:

---

Step 1 Download the IPS system image file corresponding to your ASA platform to the tftp root directory of a TFTP server that is accessible from your adaptive security appliance.

---

Note Make sure you can access the TFTP server location from the network connected to the Ethernet port of the adaptive security appliance.

Step 2 Log in to the adaptive security appliance.

Step 3 Enter enable mode.

Step 4 Copy the IPS image to the disk0 flash of the adaptive security appliance.

Step 5 Image the ASA 5500-X IPS SSP.

Step 6 Execute the recovery. This transfers the image from the TFTP server to the ASA 5500-X IPS SSP and restarts it.

Step 7 Periodically check the recovery until it is complete.

---

Note The Status field in the output indicates the operational status of the ASA 5500-X IPS SSP. An ASA 5500-X IPS SSP operating normally shows a status of “Up.” While the adaptive security appliance transfers an application image to the ASA 5500-X IPS SSP, the Status field in the output reads “Recover.” When the adaptive security appliance completes the image transfer and restarts the ASA 5500-X IPS SSP, the newly transferred image is running.

---

Note To debug any errors that may happen in the recovery process, use the debug module-boot command to enable debugging of the system reimaging process.

Step 8 Session to the ASA 5500-X IPS SSP and initialize it with the setup command.

 

For More Information

• For the procedure for locating software, see Obtaining Software.
• For a list of supported TFTP servers, see Supported Servers.
• For a list of the specific IPS software files, see IPS File List.
• For the procedure for initializing the sensor with the setup command, see Initializing the Sensor.

Installing the ASA 5585-X IPS SSP System Image

This section describes how to install the ASA 5585-X IPS SSP system image using the hw-module command or ROMMON, and contains the following topics:

• Using the hw-module Command
• Using ROMMON

Using the hw-module Command

To install the system image, transfer the software image from a TFTP server to the ASA 5585-X IPS SSP using the adaptive security appliance CLI. The adaptive security appliance can communicate with the ROMMON application of the ASA 5585-X IPS SSP to transfer the image.

---

Note Be sure the TFTP server that you specify can transfer files up to 60 MB in size.

---

Note This process can take approximately 15 minutes to complete, depending on your network and the size of the image.

To install the ASA 5585-X IPS SSP software image, follow these steps:

---

Step 1 Download the ASA 5585-X IPS SSP system image file to the tftp root directory of a TFTP server that is accessible from your adaptive security appliance.

---

Note Make sure you can access the TFTP server location from the network connected to the Ethernet port of your adaptive security appliance.

Step 2 Log in to the adaptive security appliance.

Step 3 Enter enable mode.

Step 4 Configure the recovery settings for the ASA 5585-X IPS SSP.

---

Note If you make an error in the recovery configuration, use the hw-module module 1 recover stop command to stop the system reimaging and then you can correct the configuration.

Step 5 Specify the TFTP URL for the software image.

Example

Step 6 Specify the command and control interface of the ASA 5585-X IPS SSP.

---

Note The port IP address is the management IP address of the ASA 5585-X IPS SSP.

Example

Step 7 Leave the VLAN ID at 0.

Step 8 Specify the default gateway of the ASA 5585-X IPS SSP.

Example

Step 9 Execute the recovery. This transfers the software image from the TFTP server to the ASA 5585-X IPS SSP and restarts it.

Step 10 Periodically check the recovery until it is complete.

---

Note The status reads Recovery during recovery and reads Up when installation is complete.

---

Note The Status field in the output indicates the operational status of the ASA 5585-X IPS SSP. An ASA 5585-X IPS SSP operating normally shows a status of “Up.” While the adaptive security appliance transfers the software image to the ASA 5585-X IPS SSP, the Status field in the output reads “Recover.” When the adaptive security appliance completes the software image transfer and restarts the ASA 5585-X IPS SSP, the newly transferred image is running.

---

Note To debug any errors that may happen during this process, use the debug module-boot command to enable debugging of the software installation process.

Step 11 Session to the ASA 5585-X IPS SSP.

Step 12 Enter cisco three times and your new password twice.

Step 13 Initialize the ASA 5585-X IPS SSP with the setup command.

 

For More Information

• For the procedure for locating software, see Obtaining Software.
• For a list of supported TFTP servers, see Supported Servers.
• For a list of the specific IPS software files, see IPS File List.
• For the procedure for initializing the sensor with the setup command, see Initializing the Sensor.

Using ROMMON

You can install the ASA 5585-X IPS SSP system image by using the ROMMON on the adaptive security appliance to TFTP the system image onto the ASA 5585-X IPS SSP.

To install the ASA 5585-X IPS SSP system image, follow these steps:

---

Step 1 Download the ASA 5585-X IPS SSP system image file to the tftp root directory of a TFTP server that is accessible from your adaptive security appliance.

---

Note Make sure you can access the TFTP server location from the network connected to the Ethernet port of your adaptive security appliance.

Step 2 Boot the ASA 5585-X IPS SSP.

Step 3 Press Break or Esc at the following prompt while the system is booting to interrupt boot. Press the space bar to begin boot immediately.

---

Note You have ten seconds to press Break or Esc.

The system enters ROMMON mode. The rommon> prompt appears.

Step 4 Check the current network settings.

The variables have the following definitions:

• Address—Specifies the local IP address of the ASA 5585-X IPS SSP.
• Server—Specifies the TFTP server IP address where the application image is stored.
• Gateway—Specifies the gateway IP address used by the ASA 5585-X IPS SSP.
• Port—Specifies the Ethernet interface used for the ASA 5585-X IPS SSP management.
• VLAN—Specifies the VLAN ID number (leave as untagged).
• Image—Specifies the system image file/path name.
• Config—Specifies the unused by these platforms.

---

Note Not all values are required to establish network connectivity. The address, server, gateway, and image values are required. If you are not sure of the settings needed for your local environment, contact your system administrator.

Step 5 If necessary, change the interface used for the TFTP download.

---

Note The default interface used for TFTP downloads is Management 0/0, which corresponds to the management interface of the ASA 5585-X IPS SSP.

Step 6 If necessary, assign an IP address for the local port on the ASA 5585-X IPS SSP.

---

Note Use the same IP address that is assigned to the ASA 5585-X IPS SSP.

Step 7 If necessary, assign the TFTP server IP address.

Step 8 If necessary, assign the gateway IP address.

Step 9 Verify that you have access to the TFTP server by pinging it from your local Ethernet port with one of the following commands.

Step 10 If necessary define the path and filename on the TFTP file server from which you are downloading the image.

---

UNIX Example

---

Note The path is relative to the default tftpboot directory of the UNIX TFTP server. Images located in the default tftpboot directory do not have any directory names or slashes in the IMAGE specification.

Windows Example

Step 11 Enter set and press Enter to verify the network settings.

---

Note You can use the sync command to store these settings in NVRAM so they are maintained across boots. Otherwise, you must enter this information each time you want to boot an image from ROMMON.

Step 12 Download and install the system image.

---

Note If the network settings are correct, the system downloads and boots the specified image on the ASA 5585-X IPS SSP. Be sure to use the ASA 5585-X IPS SSP image.

---

 

For More Information

• For the procedure for locating software, see Obtaining Software.
• For a list of supported TFTP servers, see Supported Servers.
• For a list of the specific IPS software files, see IPS File List.
• For the procedure for initializing the sensor with the setup command, see Initializing the Sensor.

Using the IDM or IME

---

Note In addition to a valid Cisco.com username and password, you must also have a Cisco Services for IPS service contract before you can apply for a license key.

To obtain and install the license key, follow these steps:

---

Step 1 Log in to the IDM or the IME using an account with administrator privileges.

Step 2 For the IDM choose Configuration > Sensor Management > Licensing. For the IME choose Configuration > sensor_name > Sensor Management > Licensing.

Step 3 The Licensing pane displays the status of the current license. If you have already installed your license, you can click Download to save it if needed.

Step 4 Obtain a license key by doing one of the following:

• Click the Cisco.com radio button to obtain the license from Cisco.com. The IDM or the IME contacts the license server on Cisco.com and sends the server the serial number to obtain the license key. This is the default method. Go to Step 5.
• Click the License File radio button to use a license file. To use this option, you must apply for a license key at this URL: www.cisco.com/go/license. The license key is sent to you in e-mail and you save it to a drive that the IDM or the IME can access. This option is useful if your computer cannot access Cisco.com. Go to Step 7.

Step 5 Click Update License, and in the Licensing dialog box, click Yes to continue. The Status dialog box informs you that the sensor is trying to connect to Cisco.com. An Information dialog box confirms that the license key has been updated.

Step 6 Click OK.

Step 7 Log in to Cisco.com.

Step 8 Go to www.cisco.com/go/license.

Step 9 Fill in the required fields. Your license key will be sent to the e-mail address you specified.

---

Step 10 Save the license key to a hard-disk drive or a network drive that the client running the IDM or the IME can access.

Step 11 Log in to the IDM or the IME.

Step 12 For the IDM choose Configuration > Sensor Management > Licensing. For the IME choose Configuration > sensor_name > Sensor Management > Licensing.

Step 13 Under Update License, click the License File radio button.

Step 14 In the Local File Path field, specify the path to the license file or click Browse Local to browse to the file.

Step 15 Browse to the license file and click Open.

Step 16 Click Update License.

 

Using the CLI

---

Note You cannot install an older license key over a newer license key.

Use the copy source-url license_file_name license-key command to copy the license key to your sensor.

The following options apply:

• source-url —The location of the source file to be copied. It can be a URL or keyword.
• destination-url —The location of the destination file to be copied. It can be a URL or a keyword.
• license-key —The subscription license file.
• license_file_name —The name of the license file you receive.

The exact format of the source and destination URLs varies according to the file. Here are the valid types:

• ftp:—Source URL for an FTP network server. The syntax for this prefix is:

ftp://[[username@]location][/relativeDirectory]/filename

ftp://[[username@]location][//absoluteDirectory]/filename

---

Note You are prompted for a password.

• scp:—Source URL for the SCP network server. The syntax for this prefix is:

scp://[[username@]location][/relativeDirectory]/filename

scp://[[username@]location][//absoluteDirectory]/filename

---

Note You are prompted for a password. You must add the remote host to the SSH known hosts list.

• http:—Source URL for the web server. The syntax for this prefix is:

http://[[username@]location][/directory]/filename

---

Note The directory specification should be an absolute path to the desired file.

• https:—Source URL for the web server. The syntax for this prefix is:

https://[[username@]location][/directory]/filename

---

Note The directory specification should be an absolute path to the desired file. The remote host must be a TLS trusted host.

Installing the License Key

To install the license key, follow these steps:

---

Step 1 Log in to Cisco.com.

Step 2 Apply for the license key at this URL: www.cisco.com/go/license.

---

Note In addition to a valid Cisco.com username and password, you must also have a Cisco Services for IPS service contract before you can apply for a license key.

Step 3 Fill in the required fields. Your Cisco IPS Signature Subscription Service license key will be sent by email to the e-mail address you specified.

---

Note You must have the correct IPS device serial number and product identifier (PID) because the license key only functions on the device with that number.

Step 4 Save the license key to a system that has a Web server, FTP server, or SCP server.

Step 5 Log in to the CLI using an account with administrator privileges.

Step 6 Copy the license key to the sensor.

Step 7 Verify the sensor is licensed.

 

Obtaining a New License for the IPS 4270-20

If your IPS 4270-20 has a license that was generated for IPS 6.0. x versions or earlier, you need to get a new license.

To obtain a new license for your IPS 4270-20, follow these steps:

---

Step 1 Log in to Cisco.com.

Step 2 Go to www.cisco.com/go/license.

Step 3 Under Licenses Not Requiring a PAK, click Demo and Evaluation licenses.

Step 4 Under Security Products/Cisco Services for IPS service license (Version 6.1 and later), click All IPS Hardware Platforms.

Step 5 Fill in the required fields. Your license key will be sent to the email address you specified.

---

Step 6 Save the license key to a hard-disk drive or a network drive that the client running the IDM or the IME can access.

Step 7 Log in to the IDM or the IME.

Step 8 For the IDM choose Configuration > Sensor Management > Licensing. For the IME choose Configuration > sensor_name > Sensor Management > Licensing.

Step 9 Under Update License, click the License File radio button.

Step 10 In the Local File Path field, specify the path to the license file or click Browse Local to browse to the file.

Step 11 Browse to the license file and click Open.

Step 12 Click Update License.

 

Licensing the ASA 5500-X IPS SSP

For the ASA 5500-X series adaptive security appliances with the IPS SSP, the ASA requires the IPS Module license. To view your current ASA licenses, in ASDM choose Home > Device Dashboard > Device Information > Device License. For more information about ASA licenses, refer to the licensing chapter in the configuration guide. After you obtain the ASA IPS Module license, you can obtain and install the IPS license key.

For More Information

• For more information about getting started using the ASA 5500-X IPS SSP, refer to the Cisco IPS Module on the ASA Quick Start Guide.
• For the procedures for obtaining and installing the IPS License key, see Licensing the Sensor.

Understanding Initialization

---

Note You must be administrator to use the setup command.

After you install the sensor on your network, you must use the setup command to initialize it so that you can communicate with it over the network. You cannot use the IDM or the IME to configure the sensor until you initialize the sensor using the setup command.

With the setup command, you configure basic sensor settings, including the hostname, IP interfaces, access control lists, global correlation servers, and time settings. You can continue using advanced setup in the CLI to enable Telnet, configure the web server, and assign and enable virtual sensors and interfaces, or you can use the Startup Wizard in the IDM or the IME. After you configure the sensor with the setup command, you can change the network settings in the IDM or the IME.

---

Simplified Setup Mode

The sensor automatically calls the setup command when you connect to the sensor using a console cable and the sensor basic network settings have not yet been configured. The sensor does not call automatic setup under the following conditions:

• When initialization has already been successfully completed.
• If you have recovered or downgraded the sensor.
• If you have set the host configuration to default after successfully configuring the sensor using automatic setup.

When you enter the setup command, an interactive dialog called the System Configuration Dialog appears on the system console screen. The System Configuration Dialog guides you through the configuration process. The values shown in brackets next to each prompt are the default values last set.

System Configuration Dialog

When you enter the setup command, an interactive dialog called the System Configuration Dialog appears on the system console screen. The System Configuration Dialog guides you through the configuration process. The values shown in brackets next to each prompt are the current values.

You must go through the entire System Configuration Dialog until you come to the option that you want to change. To accept default settings for items that you do not want to change, press Enter.

To return to the EXEC prompt without making changes and without going through the entire System Configuration Dialog, press Ctrl-C. The System Configuration Dialog also provides help text for each prompt. To access the help text, enter ? at a prompt.

When you complete your changes, the System Configuration Dialog shows you the configuration that you created during the setup session. It also asks you if you want to use this configuration. If you enter yes, the configuration is saved. If you enter no, the configuration is not saved and the process begins again. There is no default for this prompt; you must enter either yes or no.

You can configure daylight savings time either in recurring mode or date mode. If you choose recurring mode, the start and end days are based on week, day, month, and time. If you choose date mode, the start and end days are based on month, day, year, and time. Choosing disable turns off daylight savings time.

---

Note You only need to set the date and time in the System Configuration Dialog if the system is an appliance and is NOT using NTP.

---

Note The System Configuration Dialog is an interactive dialog. The default settings are displayed.

Example 1 shows a sample System Configuration Dialog.

Example 1 Example System Configuration Dialog

Basic Sensor Setup

To perform basic sensor setup using the setup command, follow these steps:

---

Step 1 Log in to the sensor using an account with administrator privileges.

---

Note Both the default username and password are cisco.

Step 2 The first time you log in to the sensor you are prompted to change the default password. Passwords must be at least eight characters long and be strong, that is, not be a dictionary word. After you change the password, basic setup begins.

Step 3 Enter the setup command. The System Configuration Dialog is displayed.

Step 4 Specify the hostname. The hostname is a case-sensitive character string up to 64 characters. Numbers, “_” and “-” are valid, but spaces are not acceptable. The default is sensor.

Step 5 Specify the IP interface. The IP interface is in the form of IP Address/Netmask,Gateway: X.X.X.X/nn, Y.Y.Y.Y, where X.X.X.X specifies the sensor IP address as a 32-bit address written as 4 octets separated by periods, nn specifies the number of bits in the netmask, and Y.Y.Y.Y specifies the default gateway as a 32-bit address written as 4 octets separated by periods.

Step 6 Enter yes to modify the network access list:

a. If you want to delete an entry, enter the number of the entry and press Enter, or press Enter to get to the Permit line.

b. Enter the IP address and netmask of the network you want to add to the access list.

---

Note For example, 10.0.0.0/8 permits all IP addresses on the 10.0.0.0 network (10.0.0.0-10.255.255.255) and 10.1.1.0/24 permits only the IP addresses on the 10.1.1.0 subnet (10.1.1.0-10.1.1.255). If you want to permit access to a single IP address than the entire network, use a 32-bit netmask. For example, 10.1.1.1/32 permits just the 10.1.1.1 address.

c. Repeat Step b until you have added all networks that you want to add to the access list, and then press Enter at a blank permit line to go to the next step.

Step 7 You must configure a DNS server or an HTTP proxy server for global correlation to operate:

a. Enter yes to add a DNS server, and then enter the DNS server IP address.

b. Enter yes to add an HTTP proxy server, and then enter the HTTP proxy server IP address and port number.

---

Step 8 Enter yes to modify the system clock settings:

a. Enter yes to modify summertime settings.

---

Note Summertime is also known as DST. If your location does not use Summertime, go to Step m.

b. Enter yes to choose the USA summertime defaults, or enter no and choose recurring, date, or disable to specify how you want to configure summertime settings. The default is recurring.

c. If you chose recurring, specify the month you want to start summertime settings. Valid entries are january, february, march, april, may, june, july, august, september, october, november, and december. The default is march.

d. Specify the week you want to start summertime settings. Valid entries are first, second, third, fourth, fifth, and last. The default is second.

e. Specify the day you want to start summertime settings. Valid entries are sunday, monday, tuesday, wednesday, thursday, friday, and saturday. The default is sunday.

f. Specify the time you want to start summertime settings. The default is 02:00:00.

---

Note The default recurring summertime parameters are correct for time zones in the United States. The default values specify a start time of 2:00 a.m. on the second Sunday in March, and a stop time of 2:00 a.m. on the first Sunday in November. The default summertime offset is 60 minutes.

g. Specify the month you want summertime settings to end. Valid entries are january, february, march, april, may, june, july, august, september, october, november, and december. The default is november.

h. Specify the week you want the summertime settings to end. Valid entries are first, second, third, fourth, fifth, and last. The default is first.

i. Specify the day you want the summertime settings to end. Valid entries are sunday, monday, tuesday, wednesday, thursday, friday, and saturday. The default is sunday.

j. Specify the time you want summertime settings to end. The default is 02:00:00.

k. Specify the DST zone. The zone name is a character string up to 24 characters long in the pattern [A-Za-z0-9()+:,_/-]+$.

l. Specify the summertime offset. Specify the summertime offset from UTC in minutes (negative numbers represent time zones west of the Prime Meridian). The default is 60.

m. Enter yes to modify the system time zone.

n. Specify the standard time zone name. The zone name is a character string up to 24 characters long.

o. Specify the standard time zone offset. Specify the standard time zone offset from UTC in minutes (negative numbers represent time zones west of the Prime Meridian). The default is 0.

p. Enter yes if you want to use NTP. To use authenticated NTP, you need the NTP server IP address, the NTP key ID, and the NTP key value. If you do not have those at this time, you can configure NTP later. Otherwise, you can choose unauthenticated NTP.

Step 9 Enter off, partial, or full to participate in the SensorBase Network Participation:

• Off—No data is contributed to the SensorBase Network.
• Partial—Data is contributed to the SensorBase Network, but data considered potentially sensitive is filtered out and never sent.
• Full—All data is contributed to the SensorBase Network except the attacker/victim IP addresses that you exclude.

The SensorBase Network Participation disclaimer appears. It explains what is involved in participating in the SensorBase Network.

Step 10 Enter yes to participate in the SensorBase Network.

Step 11 Enter 2 to save the configuration (or 3 to continue with advanced setup using the CLI).

Step 12 If you changed the time setting, enter yes to reboot the sensor.

 

Advanced Setup for the IPS Appliance

---

Note The currently supported Cisco IPS appliances are the IPS 4240, IPS 4255, and IPS 4260 [IPS 7.1(5) and later], IPS 4270-20 [IPS 7.1(3) and later], IPS 4345 and IPS 4360 [IPS 7.1(3) and later], IPS 4510 and IPS 4520 [IPS 7.1(4) and later].

---

Note Adding new subinterfaces is a two-step process. You first organize the interfaces when you edit the virtual sensor configuration. You then choose which interfaces and subinterfaces are assigned to which virtual sensors.

To continue with advanced setup for the appliance, follow these steps:

---

Step 1 Log in to the appliance using an account with administrator privileges.

Step 2 Enter the setup command. The System Configuration Dialog is displayed. Press Enter or the spacebar to skip to the menu to access advanced setup.

Step 3 Enter 3 to access advanced setup.

Step 4 Specify the Telnet server status. The default is disabled.

Step 5 Specify the SSHv1 fallback setting. The default is enabled.

Step 6 Specify the web server port. The web server port is the TCP port used by the web server (1 to 65535). The default is 443.

---

Note The web server is configured to use TLS/SSL encryption by default. Setting the port to 80 does not disable the encryption.

Step 7 Enter yes to modify the interface and virtual sensor configuration and to see the current interface configuration.

Step 8 Enter 1 to edit the interface configuration.

---

Note The following options let you create and delete interfaces. You assign the interfaces to virtual sensors in the virtual sensor configuration. If you are using promiscuous mode for your interfaces and are not subdividing them by VLAN, no additional configuration is necessary.

Step 9 Enter 2 to add inline VLAN pairs and display the list of available interfaces.

---

Step 10 Enter 1 to add an inline VLAN pair to GigabitEthernet 0/0, for example.

Step 11 Enter a subinterface number and description.

Step 12 Enter numbers for VLAN 1 and 2.

Step 13 Press Enter to return to the available interfaces menu.

---

Note Entering a carriage return at a prompt without a value returns you to the previous menu.

---

Note At this point, you can configure another interface, for example, GigabitEthernet 0/1, for inline VLAN pair.

Step 14 Press Enter to return to the top-level interface editing menu.

Step 15 Enter 4 to add an inline interface pair and see these options.

Step 16 Enter the pair name, description, and which interfaces you want to pair.

Step 17 Press Enter to return to the top-level interface editing menu.

Step 18 Press Enter to return to the top-level editing menu.

Step 19 Enter 2 to edit the virtual sensor configuration.

Step 20 Enter 2 to modify the virtual sensor configuration, vs0.

Step 21 Enter 3 to add inline VLAN pair GigabitEthernet0/0:1.

Step 22 Enter 4 to add inline interface pair NewPair.

Step 23 Press Enter to return to the top-level virtual sensor menu.

Step 24 Press Enter to return to the top-level interface and virtual sensor configuration menu.

Step 25 Enter yes if you want to modify the default threat prevention settings.

---

Note The sensor comes with a built-in override to add the deny packet event action to high risk rating alerts. If you do not want this protection, disable automatic threat prevention.

Step 26 Enter yes to disable automatic threat prevention on all virtual sensors.

Step 27 Press Enter to exit the interface and virtual sensor configuration.

Step 28 Enter 2 to save the configuration.

Step 29 Reboot the appliance.

Step 30 Enter yes to continue the reboot.

Step 31 Apply the most recent service pack and signature update. You are now ready to configure your appliance for intrusion prevention.

 

Advanced Setup for the ASA 5500 AIP SSM

To continue with advanced setup for the ASA 5500 AIP SSM, follow these steps:

---

Step 1 Session in to the ASA 5500 AIP SSM using an account with administrator privileges.

Step 2 Enter the setup command. The System Configuration Dialog is displayed. Press Enter or the spacebar to skip to the menu to access advanced setup.

Step 3 Enter 3 to access advanced setup.

Step 4 Specify the Telnet server status. You can disable or enable Telnet services. The default is disabled.

Step 5 Specify the SSHv1 fallback setting. The default is enabled.

Step 6 Specify the web server port. The web server port is the TCP port used by the web server (1 to 65535). The default is 443.

---

Note The web server is configured to use TLS/SSL encryption by default. Setting the port to 80 does not disable the encryption.

Step 7 Enter yes to modify the interface and virtual sensor configuration.

Step 8 Enter 1 to edit the interface configuration.

---

Note You do not need to configure interfaces on the ASA 5500 AIP SSM. You should ignore the modify interface default VLAN setting. The separation of traffic across virtual sensors is configured differently for the ASA 5500 AIP SSM than for other sensors.

Step 9 Press Enter to return to the top-level interface and virtual sensor configuration menu.

Step 10 Enter 2 to edit the virtual sensor configuration.

Step 11 Enter 2 to modify the virtual sensor vs0 configuration.

Step 12 Enter 1 to add GigabitEthernet 0/1 to virtual sensor vs0.

---

Note Multiple virtual sensors are supported. The adaptive security appliance can direct packets to specific virtual sensors or can send packets to be monitored by a default virtual sensor. The default virtual sensor is the virtual sensor to which you assign GigabitEthernet 0/1. We recommend that you assign GigabitEthernet 0/1 to vs0, but you can assign it to another virtual sensor if you want to.

Step 13 Press Enter to return to the main virtual sensor menu.

Step 14 Enter 3 to create a virtual sensor.

Step 15 Enter a name and description for your virtual sensor.

Step 16 Enter 1 to use the existing anomaly detection configuration, ad0.

Step 17 Enter 2 to create a signature-definition configuration file.

Step 18 Enter the signature-definition configuration name, newSig.

Step 19 Enter 1 to use the existing event-action-rules configuration, rules0.

---

Note If GigabitEthernet 0/1 has not been assigned to vs0, you are prompted to assign it to the new virtual sensor.

Step 20 Press Enter to exit the interface and virtual sensor configuration menu.

Step 21 Enter yes if you want to modify the default threat prevention settings.

---

Note The sensor comes with a built-in override to add the deny packet event action to high risk rating alerts. If you do not want this protection, disable automatic threat prevention.

Step 22 Enter yes to disable automatic threat prevention on all virtual sensors.

Step 23 Enter 2 to save the configuration.

Step 24 Reboot the ASA 5500 AIP SSM.

Step 25 Enter yes to continue the reboot.

Step 26 After reboot, log in to the sensor, and display the self-signed X.509 certificate (needed by TLS).

Step 27 Write down the certificate fingerprints. You need the fingerprints to check the authenticity of the certificate when using HTTPS to connect to this ASA 5500 AIP SSM with a web browser.

Step 28 Apply the most recent service pack and signature update. You are now ready to configure your ASA 5500 AIP SSM for intrusion prevention.

 

Advanced Setup for the ASA 5500-X IPS SSP

To continue with advanced setup for the ASA 5500-X IPS SSP, follow these steps:

---

Step 1 Session in to the IPS using an account with administrator privileges.

Step 2 Enter the setup command. The System Configuration Dialog is displayed. Press Enter or the spacebar to skip to the menu to access advanced setup.

Step 3 Enter 3 to access advanced setup.

Step 4 Specify the Telnet server status. You can disable or enable Telnet services. The default is disabled.

Step 5 Specify the SSHv1 fallback setting. The default is enabled.

Step 6 Specify the web server port. The web server port is the TCP port used by the web server (1 to 65535). The default is 443.

---

Note The web server is configured to use TLS/SSL encryption by default. Setting the port to 80 does not disable the encryption.

Step 7 Enter yes to modify the interface and virtual sensor configuration.

Step 8 Enter 1 to edit the interface configuration.

---

Note You do not need to configure interfaces on the ASA 5500-X IPS SSP. You should ignore the modify interface default VLAN setting. The separation of traffic across virtual sensors is configured differently for the ASA 5500-X IPS SSP than for other sensors.

Step 9 Press Enter to return to the top-level interface and virtual sensor configuration menu.

Step 10 Enter 2 to edit the virtual sensor configuration.

Step 11 Enter 2 to modify the virtual sensor vs0 configuration.

Step 12 Enter 1 to add PortChannel 0/0 to virtual sensor vs0.

---

Note Multiple virtual sensors are supported. The adaptive security appliance can direct packets to specific virtual sensors or can send packets to be monitored by a default virtual sensor. The default virtual sensor is the virtual sensor to which you assign PortChannel 0/0. We recommend that you assign PortChannel 0/0 to vs0, but you can assign it to another virtual sensor if you want to.

Step 13 Press Enter to return to the main virtual sensor menu.

Step 14 Enter 3 to create a virtual sensor.

Step 15 Enter a name and description for your virtual sensor.

Step 16 Enter 1 to use the existing anomaly-detection configuration, ad0.

Step 17 Enter 2 to create a signature-definition configuration file.

Step 18 Enter the signature-definition configuration name, newSig.

Step 19 Enter 1 to use the existing event-action-rules configuration, rules0.

---

Note If PortChannel 0/0 has not been assigned to vs0, you are prompted to assign it to the new virtual sensor.

Step 20 Press Enter to exit the interface and virtual sensor configuration menu.

Step 21 Enter yes if you want to modify the default threat prevention settings.

---

Note The sensor comes with a built-in override to add the deny packet event action to high risk rating alerts. If you do not want this protection, disable automatic threat prevention.

Step 22 Enter yes to disable automatic threat prevention on all virtual sensors.

Step 23 Enter 2 to save the configuration.

Step 24 Reboot the ASA 5500-X IPS SSP.

Step 25 Enter yes to continue the reboot.

Step 26 After reboot, log in to the sensor, and display the self-signed X.509 certificate (needed by TLS).

Step 27 Write down the certificate fingerprints. You need the fingerprints to check the authenticity of the certificate when using HTTPS to connect to this ASA 5500-X IPS SSP with a web browser.

Step 28 Apply the most recent service pack and signature update. You are now ready to configure the ASA 5500-X IPS SSP for intrusion prevention.

 

Advanced Setup for the ASA 5585-X IPS SSP

To continue with advanced setup for the ASA 5585-X IPS SSP, follow these steps:

---

Step 1 Session in to the ASA 5585-X IPS SSP using an account with administrator privileges.

Step 2 Enter the setup command. The System Configuration Dialog is displayed. Press Enter or the spacebar to skip to the menu to access advanced setup.

Step 3 Enter 3 to access advanced setup.

Step 4 Specify the Telnet server status. You can disable or enable Telnet services. The default is disabled.

Step 5 Specify the SSHv1 fallback setting. The default is enabled.

Step 6 Specify the web server port. The web server port is the TCP port used by the web server (1 to 65535). The default is 443.

---

Note The web server is configured to use TLS/SSL encryption by default. Setting the port to 80 does not disable the encryption.

Step 7 Enter yes to modify the interface and virtual sensor configuration.

Step 8 Enter 1 to edit the interface configuration.

---

Note You do not need to configure interfaces on the ASA 5585-X IPS SSP. You should ignore the modify interface default VLAN setting. The separation of traffic across virtual sensors is configured differently for the ASA 5585-X IPS SSP than for other sensors.

Step 9 Press Enter to return to the top-level interface and virtual sensor configuration menu.

Step 10 Enter 2 to edit the virtual sensor configuration.

Step 11 Enter 2 to modify the virtual sensor vs0 configuration.

Step 12 Enter 1 to add PortChannel 0/0 to virtual sensor vs0.

---

Note Multiple virtual sensors are supported. The adaptive security appliance can direct packets to specific virtual sensors or can send packets to be monitored by a default virtual sensor. The default virtual sensor is the virtual sensor to which you assign PortChannel 0/0. We recommend that you assign PortChannel 0/0 to vs0, but you can assign it to another virtual sensor if you want to.

Step 13 Press Enter to return to the main virtual sensor menu.

Step 14 Enter 3 to create a virtual sensor.

Step 15 Enter a name and description for your virtual sensor.

Step 16 Enter 1 to use the existing anomaly-detection configuration, ad0.

Step 17 Enter 2 to create a signature-definition configuration file.

Step 18 Enter the signature-definition configuration name, newSig.

Step 19 Enter 1 to use the existing event action rules configuration, rules0.

---

Note If PortChannel 0/0 has not been assigned to vs0, you are prompted to assign it to the new virtual sensor.

Step 20 Press Enter to exit the interface and virtual sensor configuration menu.

Step 21 Enter yes if you want to modify the default threat prevention settings.

---

Note The sensor comes with a built-in override to add the deny packet event action to high risk rating alerts. If you do not want this protection, disable automatic threat prevention.

Step 22 Enter yes to disable automatic threat prevention on all virtual sensors.

Step 23 Enter 2 to save the configuration.

Step 24 Reboot the ASA 5585-X IPS SSP.

Step 25 Enter yes to continue the reboot.

Step 26 After reboot, log in to the sensor, and display the self-signed X.509 certificate (needed by TLS).

Step 27 Write down the certificate fingerprints. You need the fingerprints to check the authenticity of the certificate when using HTTPS to connect to this ASA 5585-X IPS SSP with a web browser.

Step 28 Apply the most recent service pack and signature update. You are now ready to configure your ASA 5585-X IPS SSP for intrusion prevention.