topic Re: Reimaging a sensor? in Network Security

Reimaging a sensor?

lcuchisanmillan — Sun, 10 Mar 2019 10:10:21 GMT

How can i reimage a sensor?

Thank you

Re: Reimaging a sensor?

andrew.burns — Wed, 16 Aug 2006 13:26:59 GMT

which one?

Re: Reimaging a sensor?

lcuchisanmillan — Thu, 17 Aug 2006 05:44:04 GMT

IDS 4250XL 5.1(1)

Re: Reimaging a sensor?

andrew.burns — Thu, 17 Aug 2006 08:00:58 GMT

Hi,

The book you need is:

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_book09186a008055dbb1.html

There is a chapter called "Upgrading, Downgrading, and Installing System

Images" which contains detailed instructions.

HTH

Andrew.

Re: Reimaging a sensor?

npham — Thu, 17 Aug 2006 18:51:00 GMT

You will need the Recovery/Upgrade CD that came with your sensor. Most likely it will be a 4.1 disk. Stick the disk in, and power cycle the sensor. Follow the onscreen prompts. To go onto 5.1, download the following from CCO and follow the directions in the readme.

1. install 5.0(1c) major upgrade from 21-JUL-2006

2. install 5.1(1g) minor update from 31-JUL-2006

3. now is a good time to apply the sensor license through IDM

4. install 5.1(3) service pack from 21-JUL-2006

5. apply S241 or later sig update

Or, order the IPS upgrade CD, IPS-SW-K9-UPE (it will be free if you have maintenace support). You will get a recovery CD which will put your sensor at 5.0(2) S152. Follow through at step 2.

Re: Reimaging a sensor?

dondongamo — Wed, 20 Sep 2006 14:00:36 GMT

Are these procedures applicable also to IDS4215? what about the memory requirements for 4215 if the user prefer to use ver5.1, does it requires a memory upgade?

TIA.

Re: Reimaging a sensor?

rhermes — Wed, 20 Sep 2006 16:41:31 GMT

The 4215 has enough memory to run 5.1

You should use the new 5.0(1)e file to upgrade, it came out on Monday and fixes a few more things than the last 5.0(1) patch.

The 4215 doesn't have a CDROM drive so all your upgrades will be done via FTP or SCP.

upgrade ftp://user@IPADDRESS/IPS-K9-maj-5.0-1e-S149.rpm.pkg

Wait until the Analysis Engine is running before proceeding to the next upgrade

upgrade ftp://user@IPADDRESS/IPS-K9-min-5.1-1g.pkg

Wait until the Analysis Engine is running before proceeding to the next upgrade

upgrade user@IPADDRESS/IPS-K9-sp-5.1-3.pkg

Re: Reimaging a sensor?

lcuchisanmillan — Fri, 22 Sep 2006 06:10:38 GMT

If i need to do a reimage of a 4215, what should i do? As it does not have a CDROM drive. Which files do i need?

If i try to follow your steps the analysis engine crashs.

Thanks in advanced,

Re: Reimaging a sensor?

jwalker — Fri, 22 Sep 2006 13:36:20 GMT

Sometimes the analysis engine will "crash" for 30-45 minutes. Just wait it out... It should eventually restart itself. If it doesn't you can restart it manually by running the following command with a service account (not recommended though).

/etc/init.d/cids restart

Re: Reimaging a sensor?

marcabal — Fri, 22 Sep 2006 14:12:31 GMT

If you don't care about maintaining your sensor configuration then you can use ROMMON and a System Image.

4.1 System Image: IDS-4215-K9-sys-4.1-4-S91a.img

http://www.cisco.com/cgi-bin/tablebuild.pl/ids4-app-recovr

5.0 System Image: IPS-4215-K9-sys-1.1-a-5.0-2.img

http://www.cisco.com/cgi-bin/tablebuild.pl/ips5-system

5.1 System Image: IPS-4215-K9-sys-1.1-a-5.1-1.img

http://www.cisco.com/cgi-bin/tablebuild.pl/ips5-system

I would recommend reading the readme file for the specific image you are attempting to load. The readme file has almost the same name as the image file, but ends in ".txt".

Here is the link to the User's Guide that explains how to use ROMMON to install them:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids12/cliguide/cliimage.htm#wp1030874

You should also upgrade your IDS-4215's BIOS and ROMMON if they are not up to date:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids12/cliguide/cliimage.htm#wp1060088

IDS-4215-bios-5.1.7-rom-1.4.bin

http://www.cisco.com/cgi-bin/tablebuild.pl/ips5-firmware

Re: Reimaging a sensor?

lcuchisanmillan — Mon, 25 Sep 2006 07:58:56 GMT

The problem is that Cisco IOS TFTP client can not transfer files larger than 16Mb in size and the .img file is too large (80Mb).

Re: Reimaging a sensor?

marcabal — Mon, 25 Sep 2006 14:14:51 GMT

I assume you are trying to image the IPS-4215 with an IPS 4.1 version.

Be sure to upgrade the IDS-4215 BIOS to version 5.1.7 and the ROMMON to version 1.4.

The original BIOS and ROMMON can not handle the large file size.

And refer to this link to see which tftp servers are recommended because of the large file size:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/hwguide/hwclipr.htm#wp200511