Release Notes for Cisco Intrusion Prevention System 7.3(2)E4
Available Languages
Table of Contents
Release Notes for Cisco Intrusion Prevention System 7.3(2)E4
IPS Management and Event Viewers
AC Power Supply in the IPS4300 Series V01 and V02 Chassis
Applying IPS 7.3(2)E4 to sensors using CSM 4.6 SP1 or Later
Installing the IPS4345 and IPS4360 System Image
Installing the IPS4510 and IPS4520 System Image
Installing the ASA5500-X IPSSSP System Image
Installing the ASA 5585-X IPS SSP System Image
Licensing the ASA5500-X IPSSSP
Advanced Setup for the IPS Appliance
Advanced Setup for the ASA5500-X IPSSSP
Advanced Setup for the ASA 5585-X IPSSSP
Installing or Upgrading the IME
Cisco Security Intelligence Operations
Obtaining Documentation, Using the Cisco Bug Search Tool, and Submitting a Service Request
Contents
- IPS File List
- Supported Platforms
- Supported Servers
- ROMMON and TFTP
- IPS Management and Event Viewers
- New and Changed Information
- AC Power Supply in the IPS 4300 Series V01 and V02 Chassis
- Obtaining Software
- Upgrading to IPS 7.3(2)E4
- Applying IPS 7.3(2)E4 to sensors using CSM 4.6 SP1 or Later
- Reimaging the Sensor
- Licensing the Sensor
- Initializing the Sensor
- Logging In to the IDM
- Installing or Upgrading the IME
- Cisco Security Intelligence Operations
- Restrictions and Limitations
- Caveats
- Related Documentation
- Obtaining Documentation, Using the Cisco Bug Search Tool, and Submitting a Service Request
IPS File List
Note
Use the 4520 files to update the IPS 4520-XL.
The following files are part of Cisco IPS 7.3(2)E4:
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
ROMMON and TFTP
ROMMON uses TFTP to download an image and launch it. TFTP does not address network issues such as latency or error recovery. It does implement a limited packet integrity check so that packets arriving in sequence with the correct integrity value have an extremely low probability of error. But TFTP does not offer pipelining so the total transfer time is equal to the number of packets to be transferred times the network average RTT. Because of this limitation, we recommend that the TFTP server be located on the same LAN segment as the sensor. Any network with an RTT less than a 100 milliseconds should provide reliable delivery of the image. Be aware that some TFTP servers limit the maximum file size that can be transferred to ~32 MB.
IPS Management and Event Viewers
Use the following tools for configuring Cisco IPS 7.3(2)E4 sensors:
IDM 7.3.2 is included within the IPS 7.3(2)E4 files.
IDM 7.3.2 is included within IME 7.2.7.
IDM 7.3.2 requires JRE 1.6 or later.
You can use IDM 7.3.2 to configure IPS 7.3 sensors.
You can use IME 7.2.7 to configure IPS 6.1, 6.2, 7.0, 7.1, 7.2 and 7.3 sensors.
Use the following tools for monitoring Cisco IPS 7.3(2)E4 sensors:
You can use CSM 4.6 SP1 to manage the following IPS sensors:
Note You may need to configure viewers that are already configured to monitor the earlier version sensors to accept a new SSL certificate for the Cisco IPS 7.3 sensors.
For the procedure to apply IPS 7.3(2)E4 to sensors using CSM 4.4 SP1 or later, see Applying IPS 7.3(2)E4 to sensors using CSM 4.6 SP1 or Later.
New and Changed Information
Cisco IPS 7.3(2)E4 contains the following new and changed information:
Note
–
–
–
–
–
–
- The ASA 5585-X IPS SSP series and ASA 5500-X IPS SSP series are added back to the IPS 7.3 line.
- Updater client vulnerability—The updater client used by the IPS was not validating the certificate from the updater server (automatic update server and global correlation server). The server does provide a valid certificate, but the IPS was not verifying it. This vulnerability has been fixed in IPS 7.3(2)E4.
- Auto Flow Depth—To improve throughput and reduce latency, this new functionality automatically sets the flow depth to 800K to provide continuity of flows. Auto flow depth is only applied to inspection threads/cores with high inspection loads. Other threads/cores continue to provide full inspection. Prior to 7.3(2)E4, if you have flow depth configured, it overrides the new auto flow depth functionality and continues to limit inspection of ALL flows. To take advantage of the new auto flow depth functionality, you must disable flow depth.
AC Power Supply in the IPS 4300 Series V01 and V02 Chassis
The Cisco IPS 4300 series sensors with the AC power supply can restore the previous power state of the system if AC power is lost. Earlier IPS 4300s (V01) require you to turn on the power with the power switch. Newer IPS 4300s (V02) automatically turn on when you plug in the power cable.
To determine your version, do one of the following:
- At the CLI, enter the show inventory command and look for V01 or V02 in the output.
- On the back of the chassis, look at the VID PID label for V01 or V02.
The V01 chassis has the following limitations (these limitations do not apply to the V02 chassis):
- The sensor requires 50 seconds from the time that AC power is applied before the power state can be updated and stored. This means that any changes to the power state within the first 50 seconds of applying AC power will not be observed if AC power is removed within that time.
- The sensor requires 10 seconds from the time it is placed into standby mode before the power state can be updated and stored. This means any changes to the power state within the first 10 seconds of entering standby mode (including the standby mode itself) will not be observed if AC power is removed within that time.
For information on the AC power supplies in the IPS 4300 series sensors, refer to Installing the IPS 4345 and IPS 4360.
Obtaining Software
You can find major and minor updates, service packs, signature and signature engine updates, system and recovery files, firmware upgrades, and Readmes on the Download Software site on Cisco.com. Signature updates are posted to Cisco.com approximately every week, more often if needed. Service packs are posted to Cisco.com in a release train format, a new release every three months. Major and minor updates are also posted periodically. Check Cisco.com regularly for the latest IPS software.
You must have an account with cryptographic access before you can download software. You set this account up the first time you download IPS software from the Download Software site.
Note
Downloading Cisco IPS Software
To download software on Cisco.com, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Note
Step 7
Step 8
Step 9
Step 10
a.
b.
If you previously filled out the Encryption Software Export Distribution Authorization form, and read and accepted the Cisco Systems Inc. Encryption Software Usage Handling and Distribution Policy, these forms are not displayed again.
Step 11
Step 12
Upgrading to IPS 7.3(2)E4
This section describes how to upgrade the IPS 4345, IPS 4360, IPS 4510, IPS 4520, IPS 4520-XL, ASA 5500-X IPS SSP series, and ASA 5585-X IPS SSP series, and contains the following topics:
Upgrade Notes and Caveats
Pay attention to the following upgrade notes and caveats when upgrading to IPS 7.3(2)E4:
- You cannot upgrade to 7.3(2)E4 if the sensor license was generated for 6.0.x versions and earlier. The upgrade fails and the following message is displayed:
Error: execUpgradeSoftware : This license is a IPS version 6.0 or earlier license which is not compatible with platforms running 7.1.X IPS Versions. Please install a IPS version 6.1 or later license type. Refer to 7.3.X IPS version README or IPS documents for the details of generating a new license.
- Anomaly detection has been disabled by default. If you did not configure the operation mode manually before the upgrade, it defaults to inactive after you upgrade to IPS 7.3(2)E4. If you configured the operation mode to detect, learn, or inactive, the tuned value is preserved after the upgrade.
- You must have a valid maintenance contract per sensor to download software upgrades from Cisco.com.
- You must be running the following versions to upgrade the following platforms to IPS 7.3(2)E4:
–
–
–
- This service pack automatically reboots the sensor to apply the changes. During reboot, inline network traffic is disrupted.
- You cannot uninstall 7.3(2)E4. To revert to a previous version, you must reimage the sensor using the appropriate system image file. All configuration settings are lost.
- For the procedure to download software from Cisco.com, see Obtaining Software.
- For the procedure for using the upgrade command to upgrade the sensor, see Upgrading the Sensor.
- For the procedure for installing the IPS 4345 and IPS 4560 system images, see Installing the IPS 4345 and IPS 4360 System Image.
- For the procedure installing the IPS 4510 and IPS 4520 system images, see Installing the IPS 4510 and IPS 4520 System Image.
- For the procedure for installing the ASA 5500-X IPS SSP system image, see Installing the ASA 5500-X IPS SSP System Image.
- For the procedure for installing the ASA 5585-X IPS SSP system image, see Installing the ASA 5585-X IPS SSP System Image.
Upgrading the Sensor
Use the upgrade source-url command to apply service pack, signature update, engine update, minor version, major version, or recovery partition file upgrades.
–
ftp://[[username@]location][/relativeDirectory]/filename
ftp://[[username@]location][//absoluteDirectory]/filename
Note You are prompted for a password.
–
scp://[[username@]location][/relativeDirectory]/filename
scp://[[username@]location][//absoluteDirectory]/filename
Note You are prompted for a password. You must add the remote host to the SSH known hosts list.
–
http://[[username@]location][/directory]/filename
Note The directory specification should be an absolute path to the desired file.
–
https://[[username@]location][/directory]/filename
Note The directory specification should be an absolute path to the desired file. The remote host must be a TLS trusted host.
To upgrade the sensor, follow these steps:
Step 1
Step 2
Step 3
The URL points to where the update file is located, for example, to retrieve the update using FTP, enter the following:
Step 5
Step 6
Note
Note
Step 7
For a list of the specific IPS upgrade filenames, see IPS File List.
Applying IPS 7.3(2)E4 to sensors using CSM 4.6 SP1 or Later
Note
To apply the 7.3(2)E4 service pack to sensors using CSM 4.6 SP1 or later, follow these steps:
Step 1
Step 2
Step 3
Step 5
Step 6
Step 7
Reimaging the Sensor
This section describes how to reimage the sensor using the system image, and contains the following topics:
- Installing the IPS 4345 and IPS 4360 System Image
- Installing the IPS 4510 and IPS 4520 System Image
- Installing the ASA 5500-X IPS SSP System Image
- Installing the ASA 5585-X IPS SSP System Image
Installing the IPS 4345 and IPS 4360 System Image
You can install the IPS 4345 and IPS 4360 system image by using the ROMMON on the appliance to TFTP the system image on to the compact flash device.
Note
To install the IPS 4345 and IPS 4360 system image, follow these steps:
Step 1
Note
Step 3
Note
The system enters ROMMON mode. The
rommon>prompt appears.Step 4
The variables have the following definitions:
- Address—Local IP address of the IPS 4345.
- Server—TFTP server IP address where the application image is stored.
- Gateway—Gateway IP address used by the IPS 4345.
- Port—Ethernet interface used for the IPS 4345 management.
- VLAN—VLAN ID number (leave as untagged).
- Image—System image file/path name.
- Config—Unused by these platforms.
Note
Step 5
Note
Step 6
Note
Step 7
Step 8
Step 9
Step 10
Caution
Note
Step 11
Note
Step 12
Caution
Note
- For the procedure for locating software, see Obtaining Software.
- For a list of supported TFTP servers, see Supported Servers.
- For a list of the specific IPS software files, see IPS File List.
- For the procedure for initializing the sensor with the setup command, see Initializing the Sensor.
Installing the IPS 4510 and IPS 4520 System Image
You can install the IPS 4510 and IPS 4520 system image by using the ROMMON on the appliance to TFTP the system image onto the compact flash device.
Note
To install the IPS 4510 system image, follow these steps:
Step 1
Note
Step 3
Note
The system enters ROMMON mode. The
rommon>prompt appears.Step 4
The variables have the following definitions:
- Address—Specifies the local IP address of the IPS 4510.
- Server—Specifies the TFTP server IP address where the application image is stored.
- Gateway—Specifies the gateway IP address used by the IPS 4510.
- Port—Specifies the Ethernet interface used for IPS 4510 management.
- VLAN—Specifies the VLAN ID number (leave as untagged).
- Image—Specifies the system image file/path name.
- Config—Unused by these platforms.
Note
Step 5
Note
Step 6
Step 7
Step 8
Step 9
Note
Step 10
Note
Step 11
Caution
Note
- For the procedure for locating software, see Obtaining Software.
- For a list of supported TFTP servers, see Supported Servers.
- For a list of the specific IPS software files, see IPS File List.
- For the procedure for initializing the sensor with the setup command, see Initializing the Sensor.
Installing the ASA 5500-X IPS SSP System Image
Note
To install the system image on the ASA 5500-X IPS SSP, follow these steps:
Step 1
Note
Step 2
Step 4
Step 5
Step 6
Step 7
Note
Note
Step 8
- For the procedure for locating software, see Obtaining Software.
- For a list of supported TFTP servers, see Supported Servers.
- For a list of the specific IPS software files, see IPS File List.
- For the procedure for initializing the sensor with the setup command, see Initializing the Sensor.
Installing the ASA 5585-X IPS SSP System Image
This section describes how to install the ASA 5585-X IPS SSP system image using the hw-module command or ROMMON, and contains the following topics:
Using the hw-module Command
To install the system image, transfer the software image from a TFTP server to the ASA 5585-X IPS SSP using the adaptive security appliance CLI. The adaptive security appliance can communicate with the ROMMON application of the ASA 5585-X IPS SSP to transfer the image.
Note
Note
To install the ASA 5585-X IPS SSP software image, follow these steps:
Step 1
Note
Step 2
Step 4
Note
Step 5
Step 6
Note
Step 7
Step 8
Step 9
Step 10
Note
Recoveryduring recovery and readsUpwhen installation is complete.
Note
Note
Step 11
Step 12
Step 13
- For the procedure for locating software, see Obtaining Software.
- For a list of supported TFTP servers, see Supported Servers.
- For a list of the specific IPS software files, see IPS File List.
- For the procedure for initializing the sensor with the setup command, see Initializing the Sensor.
Using ROMMON
You can install the ASA 5585-X IPS SSP system image by using the ROMMON on the adaptive security appliance to TFTP the system image onto the ASA 5585-X IPS SSP.
To install the ASA 5585-X IPS SSP system image, follow these steps:
Step 1
Note
Step 2
Com KbdBuf SMM UsbHid Msg0 Prompt Pmrt Cache1 LowM ExtM HugeM Cache2 Flg Siz0 Amrt PMM PnpDsp Smbios Lpt0 Npx1 Apm Lp1 Acpi Typ Dbg Enb Mp MemReduce MemSync1 CallRoms MemSync2 DriveInitStep 3
Note
The system enters ROMMON mode. The
rommon>prompt appears.Step 4
The variables have the following definitions:
- Address—Specifies the local IP address of the ASA 5585-X IPS SSP.
- Server—Specifies the TFTP server IP address where the application image is stored.
- Gateway—Specifies the gateway IP address used by the ASA 5585-X IPS SSP.
- Port—Specifies the ethernet interface used for the ASA 5585-X IPS SSP management.
- VLAN—Specifies the VLAN ID number (leave as untagged).
- Image—Specifies the system image file/path name.
- Config—Specifies the unused by these platforms.
Note
Step 5
Note
Step 6
Note
Step 7
Step 8
Step 9
Step 10
Caution
Note
Step 11
Note
Step 12
Note
Caution
- For the procedure for locating software, see Obtaining Software.
- For a list of supported TFTP servers, see Supported Servers.
- For a list of the specific IPS software files, see IPS File List.
- For the procedure for initializing the sensor with the setup command, see Initializing the Sensor.
Licensing the Sensor
You can install the license key through the CLI, IDM, or IME. This section describes how to obtain and install the license key, and contains the following topics:
Using the IDM or IME
Note
To obtain and install the license key, follow these steps:
Step 1
Step 2
Step 3
Step 4
- Click the Cisco.com radio button to obtain the license from Cisco.com. The IDM or the IME contacts the license server on Cisco.com and sends the server the serial number to obtain the license key. This is the default method. Go to Step 5.
- Click the License File radio button to use a license file. To use this option, you must apply for a license key at this URL: www.cisco.com/go/license. The license key is sent to you in e-mail and you save it to a drive that the IDM or the IME can access. This option is useful if your computer cannot access Cisco.com. Go to Step 7.
Step 5
Step 7
Step 8
Step 9
Caution
Step 10
Step 11
Step 12
Step 13
Step 14
Step 15
Using the CLI
Note
Use the copy source-url license_file_name license-key command to copy the license key to your sensor.
- source-url —The location of the source file to be copied. It can be a URL or keyword.
- destination-url —The location of the destination file to be copied. It can be a URL or a keyword.
- license-key —The subscription license file.
- license_file_name —The name of the license file you receive.
The exact format of the source and destination URLs varies according to the file. Here are the valid types:
ftp://[[username@]location][/relativeDirectory]/filename
ftp://[[username@]location][//absoluteDirectory]/filename
Note
scp://[[username@]location][/relativeDirectory]/filename
scp://[[username@]location][//absoluteDirectory]/filename
Note
http://[[username@]location][/directory]/filename
Note
https://[[username@]location][/directory]/filename
Note
To install the license key, follow these steps:
Step 1
Step 2
Note
Step 3
Note
Step 4
Step 5
Step 6
Step 7
Licensing the ASA 5500-X IPS SSP
For the ASA 5500-X series adaptive security appliances with the IPS SSP, the ASA requires the IPS Module license. To view your current ASA licenses, in ASDM choose Home > Device Dashboard > Device Information > Device License. For more information about ASA licenses, refer to the licensing chapter in the configuration guide. After you obtain the ASA IPS Module license, you can obtain and install the IPS license key.
- For more information about getting started using the ASA 5500-X IPS SSP, refer to the Cisco IPS Module on the ASA Quick Start Guide.
- For the procedures for obtaining and installing the IPS License key, see Licensing the Sensor.
Initializing the Sensor
This section describes how to initialize the sensor using the setup command, and contains the following sections:
- Understanding Initialization
- Simplified Setup Mode
- System Configuration Dialog
- Basic Sensor Setup
- Advanced Setup for the IPS Appliance
- Advanced Setup for the ASA 5500-X IPS SSP
- Advanced Setup for the ASA 5585-X IPS SSP
- Verifying Initialization
Understanding Initialization
Note
After you install the sensor on your network, you must use the setup command to initialize it so that you can communicate with it over the network. You cannot use the IDM or the IME to configure the sensor until you initialize the sensor using the setup command.
With the setup command, you configure basic sensor settings, including the hostname, IP interfaces, access control lists, global correlation servers, and time settings. You can continue using advanced setup in the CLI to enable Telnet, configure the web server, and assign and enable virtual sensors and interfaces, or you can use the Startup Wizard in the IDM or the IME. After you configure the sensor with the setup command, you can change the network settings in the IDM or the IME.
Caution
Simplified Setup Mode
The sensor automatically calls the setup command when you connect to the sensor using a console cable and the sensor basic network settings have not yet been configured. The sensor does not call automatic setup under the following conditions:
- When initialization has already been successfully completed.
- If you have recovered or downgraded the sensor.
- If you have set the host configuration to default after successfully configuring the sensor using automatic setup.
When you enter the setup command, an interactive dialog called the System Configuration Dialog appears on the system console screen. The System Configuration Dialog guides you through the configuration process. The values shown in brackets next to each prompt are the default values last set.
System Configuration Dialog
When you enter the setup command, an interactive dialog called the System Configuration Dialog appears on the system console screen. The System Configuration Dialog guides you through the configuration process. The values shown in brackets next to each prompt are the current values.
You must go through the entire System Configuration Dialog until you come to the option that you want to change. To accept default settings for items that you do not want to change, press Enter.
To return to the EXEC prompt without making changes and without going through the entire System Configuration Dialog, press Ctrl-C. The System Configuration Dialog also provides help text for each prompt. To access the help text, enter ? at a prompt.
When you complete your changes, the System Configuration Dialog shows you the configuration that you created during the setup session. It also asks you if you want to use this configuration. If you enter yes, the configuration is saved. If you enter no, the configuration is not saved and the process begins again. There is no default for this prompt; you must enter either yes or no.
You can configure daylight savings time either in recurring mode or date mode. If you choose recurring mode, the start and end days are based on week, day, month, and time. If you choose date mode, the start and end days are based on month, day, year, and time. Choosing disable turns off daylight savings time.
Note
Note
Example 1 shows a sample System Configuration Dialog.
Example 1 Sample System Configuration Dialog
Participation in the SensorBase Network allows Cisco to collect aggregated statistics about traffic sent to your IPS.If you agree to participate in the SensorBase Network, Cisco will collect aggregated statistics about traffic sent to your IPS.This includes summary data on the Cisco IPS network traffic properties and how this traffic was handled by the Cisco appliances. We do not collect the data content of traffic or other sensitive business or personal information. All data is aggregated and sent via secure HTTP to the Cisco SensorBase Network servers in periodic intervals. All data shared with Cisco will be anonymous and treated as strictly confidential.Basic Sensor Setup
To perform basic sensor setup using the setup command, follow these steps:
Step 1
Note
Step 2
Step 3
Step 4
Step 5
Step 6
a.
b.
Note
c.
Step 7
a.
b.
Caution
Step 8
a.
Note
b.
c.
d.
e.
f.
Note
g.
h.
i.
j.
k.
l.
m.
n.
o.
p.
Step 9
- Off—No data is contributed to the SensorBase Network.
- Partial—Data is contributed to the SensorBase Network, but data considered potentially sensitive is filtered out and never sent.
- Full—All data is contributed to the SensorBase Network except the attacker/victim IP addresses that you exclude.
The SensorBase Network Participation disclaimer appears. It explains what is involved in participating in the SensorBase Network.
Step 10
Step 11
Step 12
Advanced Setup for the IPS Appliance
Note
Note
To continue with advanced setup for the appliance, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Note
https://appliance_ip_address:port(for example,https://10.1.9.201:1040).
Note
Step 7
Step 8
Note
Step 9
Step 10
Step 11
Step 12
Step 13
Note
Note
Step 14
Step 15
Step 16
Step 17
Step 18
Step 19
Step 20
Step 21
Step 22
Step 23
Step 24
Step 25
Note
Virtual sensor newVs is configured to prevent high risk threats in inline mode. (Risk Rating 90-100)Step 26
Step 27
Step 28
Step 30
Step 31
Advanced Setup for the ASA 5500-X IPS SSP
To continue with advanced setup for the ASA 5500-X IPS SSP, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Note
https://ips_ssp_ip_address:port(for example,https://10.1.9.201:1040).
Note
Step 7
Step 8
Note
Step 9
Step 10
Step 11
Step 12
Note
Step 13
Step 14
Step 15
Step 16
Step 17
Step 18
Step 19
Note
Step 20
Step 21
Note
Virtual sensor newVs is configured to prevent high risk threats in inline mode. (Risk Rating 90-100)Step 22
Step 23
Step 24
Step 25
Step 26
Step 27
Step 28
Advanced Setup for the ASA 5585-X IPS SSP
To continue with advanced setup for the ASA 5585-X IPS SSP, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Note
https://ips_ssp_ip_address:port(for example,https://10.1.9.201:1040).
Note
Step 7
Step 8
Note
Step 9
Step 10
Step 11
Step 12
Note
Step 13
Step 14
Step 15
Step 16
Step 17
Step 18
Step 19
Note
Step 20
Step 21
Note
Virtual sensor newVs is configured to prevent high risk threats in inline mode. (Risk Rating 90-100)Step 22
Step 23
Step 24
Step 25
Step 26
Step 27
Step 28
Verifying Initialization
Note
To verify that you initialized your sensor, follow these steps:
Step 2
Note
Step 3
Step 4
Logging In to the IDM
The IDM is a web-based, Java Web Start application that enables you to configure and manage your sensor. The web server for the IDM resides on the sensor. You can access it through Internet Explorer or Firefox web browsers.
Note
To log in to the IDM, follow these steps:
Step 1
Note
Step 2
Step 3
Step 4
Step 5
Note
Step 6
The main window of the IDM appears.
Note
Installing or Upgrading the IME
This section describes how to install and upgrade the IME, and how to migrate data from IEV or a previous version of IME.
Cisco IEV, Cisco IOS IPS, and CSM
If you have a version of Cisco IPS Event Viewer installed, the Install wizard prompts you to remove it before installing the IME.
The IME event monitoring is also supported in IOS-IPS versions that support the Cisco IPS 5.x/6.x signature format. We recommend IOS-IPS 12.4(15)T4 if you intend to use the IME to monitor an IOS IPS device. Some of the new IME functionality including health monitoring is not supported.
Caution
Installation Notes and Caveats
Note
Observe the following when installing or upgrading the IME:
- You can install the IME over all versions of the IME but not over IEV. All alert database and user settings are preserved.
- The IME detects previous versions of IEV and prompts you to manually remove the older version before installing the IME or to install the IME on another system. The installation program then stops.
- Make sure you close any open instances of the IME before upgrading to a new version of the IME.
- Disable any anti-virus or host-based intrusion detection software before beginning the installation, and close any open applications. The installer spawns a command shell application that may trigger your host-based detection software, which causes the installation to fail.
- You must be administrator to install the IME.
- The IME coexists with other instances of the MySQL database. If you have a MySQL database installed on your system, you do NOT have to uninstall it before installing the IME.
Installing or Upgrading the IME
To install the IME, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Note
To migrate IEV 5. x events to the IME, you must exit the installation and manually export the old events by using the IEV 5. x export function to move the data to local files. After installing the IME, you can import these files to the new IME system.
Note
To export event data from IEV 5. x to a local file:
Step 1
Step 2
Step 3
Importing IEV Event Data In to IME
To import event data in to the IME, follow these steps:
Step 1
Step 2
For more information about the IME, refer to Cisco Intrusion Prevention System Manager Express Installation Guide for IPS 7.3.
Cisco Security Intelligence Operations
The Cisco Security Intelligence Operations site on Cisco.com provides intelligence reports about current vulnerabilities and security threats. It also has reports on other security topics that help you protect your network and deploy your security systems to reduce organizational risk.
You should be aware of the most recent security threats so that you can most effectively secure and manage your network. Cisco Security Intelligence Operations contains the top ten intelligence reports listed by date, severity, urgency, and whether there is a new signature available to deal with the threat.
Cisco Security Intelligence Operations contains a Security News section that lists security articles of interest. There are related security tools and links.
You can access Cisco Security Intelligence Operations at this URL:
http://tools.cisco.com/security/center/home.x
Cisco Security Intelligence Operations is also a repository of information for individual signatures, including signature ID, type, structure, and description.
You can search for security alerts and signatures at this URL:
Restrictions and Limitations
The following restrictions and limitations apply to the Cisco IPS 7.3(2)E4 software and the products that run it:
- IME 7.2.7 is the only supported IME release for IPS 7.3(2)E4.
- After upgrading to 7.3(2)E4, you cannot create a hostname that contains '/'(slash) character.
- The IDM has been built and tested with JAVA 7 Update 45 and earlier. The IDM is not compatible with JAVA 7 Update 51. For IDM to function, you must use the older version of Java. Refer to CSCum55433 if you must use Java 7u51 and there is no option to use earlier versions.
- While executing the autoupgradenow command, you cannot use the IDM, IME or the CLI or start any new sessions until the upgrade is complete.
- IPS 7.3(2)E4 supports TLS 1.0 and later. If the peer uses an older SSL version, the connection cannot be established. All management applications using the IPS Web server, such as the IDM or CSM, are affected by this change. If the management application does not support TLS1.0 or later, the management connectivity is lost after upgrading to IPS 7.3(2) because it does not support TLS versions earlier than TLS1.0.
- If the client does not support SSHv2 or if SSHv2 is disabled, the management connectivity is lost after upgrading from IPS 7.1( x)E4 to IPS 7.3(2)E4 because SSHv1 is disabled by default in IPS 7.3(2) and later.
- LACP has been tested only on the IPS sensor and the Nexus 7000 switch and the Catalyst 6000 switch. Other combinations of IPS sensors and switches have not been tested. It is unknown if the solution will work as expected with other switches. Also, VPC/VSS configurations are NOT supported.
- Link state mirroring applies to the inline interface pair configuration only. Detecting that the peer interface is up or down and setting the state of the link may take up to 3.5 seconds.
- The IPS 4520 is the only platform that supports the dual configuration. You can add another 4520 module to an existing 4520 or you can order the 4520-XL with two modules already installed. Mixing 4510s and 4520s is not a valid configuration.
- To support the immediate automatic update feature, a default update schedule with a start time of 00:00:00 and interval of 24 hours has been set. You must enable the automatic update settings before issuing an immediate automatic update. Disable the automatic update schedule if you do not want to use the default scheduled update.
- The ASA 5512-X IPS SSP and the ASA 5515-X IPS SSP do not support the Regex accelerator card and the String XL engines.
- Applying any signature template erases any existing tunings associated with the targeted signature definition file. The ASA 5512-X IPS SSP and ASA 5515-X IPS SSP do not support signature templates (signature threat profiles).
- The ASA 5512-X IPS SSP and ASA 5515-X IPS SSP do not support HTTP advanced decoding.
- Enabling HTTP advanced decoding can have a significantly negative performance and memory impact on the sensor.
- Use the show statistics virtual-sensor | include load command (CLI) or look at the statistics for the virtual sensor at Configuration > Sensor Monitoring > Support Information > Statistics (IDM/IME) to determine the load value over a longer period of time. The show statistics analysis-engine command (CLI) and the statistics for the Analysis Engine show values over a shorter period of time. If you compare the output, the values will appear to be inconsistent due to the different time periods. To get an accurate comparison between them, compare the processing load percentage from the statistics for the virtual sensor and the one-minute averaged value from the statistics for the Analysis Engine.
- TACACS+ authentication is not supported in IPS 7.3(2)E4.
- The CLI timeout feature is applicable only for sessions established through SSH, Telnet, and the console. Service account logins are not affected.
- Anomaly detection does not support IPv6 traffic; only IPv4 traffic is directed to the anomaly detection processor.
- IPv6 does not support the following event actions: Request Block Host, Request Block Connection, or Request Rate Limit.
- Global correlation does not support IPv6.
- There is no support for IPv6 on the management (command and control) interface.
- ICMP signature engines do not support ICMPv6, they are IPv4-specific, for example, the Traffic ICMP signature engine. ICMPv6 is covered by the Atomic IP Advanced signature engine.
- CSM and MARS do not support IPv6.
- When deploying an IPS sensor monitoring two sides of a network device that does TCP sequence number randomization, we recommend using a virtual senor for each side of the device.
- For IPS 5.0 and later, you can no longer remove the cisco account. You can disable it using the no password cisco command, but you cannot remove it. To use the no password cisco command, there must be another administrator account on the sensor. Removing the cisco account through the service account is not supported. If you remove the cisco account through the service account, the sensor most likely will not boot up, so to recover the sensor you must reinstall the sensor system image.
- After you upgrade any IPS software on your sensor, you must restart the IDM to see the latest software features.
- The IDM does not support any non-English characters, such as the German umlaut or any other special language characters. If you enter such characters as a part of an object name through IDM, they are turned into something unrecognizable and you will not be able to delete or edit the resulting object through IDM or the CLI. This is true for any string that is used by the CLI as an identifier, for example, names of time periods, inspect maps, server and URL lists, and interfaces.
- When the SensorApp is reconfigured, there is a short period when the SensorApp is unable to respond to any queries. Wait a few minutes after reconfiguration is complete before querying the SensorApp for additional information.
- The IDM and IME launch MySDN from the last browser window you opened, which is the default setting for Windows. To change this default behavior, in Internet Explorer, choose Tools > Internet Options, and then click the Advanced tab. Scroll down and uncheck the Reuse windows for launching shortcuts check box.
Caveats
This section lists the resolved and unresolved caveats, and contains the following topics:
Resolved Caveats
The following known issues are resolved in the 7.3(2)E4 release:
- CSCum55433—IDM is being blocked by Java after an upgrade to Java 7u51
- CSCum84091—Slow Global Correlation Memory Leak
- CSCum94001—IPS: MainApp crash with multiple services monitoring the sensor
- CSCun45529—IPS mainApp fatal error occurs after setting cli-inactivity-timeout
- CSCum55373—Old and new alerts fire even after custom signature changed
- CSCul92594—Updater client does not verify server certificate
- CSCum25362—IPS: Failover occurs during an IPS config change
- CSCtz38411—IPS: Single Flow can Max a CPU and Affect it Processing Other Traffic
Unresolved Caveats
The following relevant issues are unresolved in the IPS 7.3(2)E4 release:
- CSCui08329—IPS43XX show interfaces not showing the correct vlans for vlan-pair
- CSCuo21458—Buffers not reclaimed even after stopping the traffic
- CSCul77466—6.7 % drop in CPS numbers in 4360 catamaran build
- CSCun58334—IPS-SSP10 hangs while enabling TCP and TCP-XL signatures with traffic.
- CSCug40004—Sensor App crashes while tuning string signatures - udp,icmp
- CSCuh89283—DMABuf(getBufferIndex) failure" when the load percentage is 61% in 4510
- CSCui76855—Flow gets dropped when the interface is detached and then attached to VS
- CSCuj80446—Creating new sig instance sometime trigger failover/fallback or bypass
- CSCul10316—4510 crashed during boot up
- CSCui40980—high memory usage can cause sensorApp hang during signature update
- CSCun97311—IPS stops responding to SNMP queries
- CSCuo15489—signature update fails with out of memory message
- CSCun03441—CLI config commands consume high memory
- CSCum11256—Adding valid IP via tls trusted-host does not use PROXY to reach the IP
- CSCum73327—Kernel Panic on enabling summertime to start from already elapsed time
- CSCuo21106—Observed Receive Error in promiscuous mode with Auto flow-depth in IPS
Related Documentation
For more information on Cisco IPS, refer to the following documentation found at this URL:
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/tsd_products_support_series_home.html
- Documentation Roadmap for Cisco Intrusion Prevention System
- Release Notes for Cisco Intrusion Prevention System
- Cisco Intrusion Prevention System Device Manager Configuration Guide
- Cisco Intrusion Prevention System Manager Express Configuration Guide
- Cisco Intrusion Prevention System Command Reference
- Cisco Intrusion Prevention System Sensor CLI Configuration Guide
- Cisco Intrusion Prevention System Appliance and Module Installation Guide
- Installling and Removing Interface Cards in Cisco IPS-4260 and IPS 4270-20
- Regulatory Compliance and Safety Information for the Cisco Intrusion Detection and Prevention System 4200 Series Appliance Sensor
- Regulatory Compliance and Safety Information for the Cisco ASA 5500-X Series Appliances and the Cisco Intrusion Prevention System 4300 Series Appliances
- Regulatory Compliance and Safety Information for the Cisco Intrusion Prevention System 4500 Series Sensor Appliance
Obtaining Documentation, Using the Cisco Bug Search Tool, and Submitting a Service Request
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information, see What’s New in Cisco Product Documentation at: http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html.
Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.
This document is to be used in conjunction with the documents listed in the “Related Documentation” section.Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)