IOS IPS new definitions

[ROBERTO TACCON]

Hi,

when i try to install on a cisco 1721 router the new IPS definitions with the command 'copy flash:virtualSensor.xml ips-sdf' i meet the following error

it-vr-ipnetworks.it-gw1#sh flash

System flash directory:

File Length Name/status

1 12332180 c1700-advsecurityk9-mz.123-11.T2.bin

2 93095 attack-drop.sdf

3 3883008 sdm.tar

4 270848 home.tar

5 1463 home.html

6 1187840 ips.tar

[17768820 bytes used, 15523464 available, 33292284 total]

32768K bytes of processor board System flash (Read/Write)

it-vr-ipnetworks.it-gw1#copy tftp:virtualSensor.xml flash:virtualSensor.xml

Address or name of remote host []? 172.16.0.1

Destination filename [virtualSensor.xml]?

Accessing tftp://172.16.0.1/virtualSensor.xml...

Erase flash: before copying? [confirm]n

Loading virtualSensor.xml from 172.16.0.1 (via FastEthernet0): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!

[OK - 1917467 bytes]

Verifying checksum... OK (0x63A9)

1917467 bytes copied in 55.368 secs (34631 bytes/sec)

it-vr-ipnetworks.it-gw1#conf t

Enter configuration commands, one per line. End with CNTL/Z.

it-vr-ipnetworks.it-(config)#no ip ips sdf location flash:attack-drop.sdf

it-vr-ipnetworks.it-(config)#ip ips fail closed

it-vr-ipnetworks.it-(config)#exit

it-vr-ipnetworks.it-gw1#copy flash:virtualSensor.xml ips-sdf

% Failed to allocate regular expression state table: 7575360

% Failed to allocate regular expression state table: 3450200

How can install and active the IOS new IPS definitions ?

[gabelar · Accepted solution]

I checked all of the Cisco internal TAC cases and error messages and I wasn't able to pinpoint this problem. It doesn't look like you have a memory problem, you have 15meg available. I would try three things and then maybe contact TAC to see if they can help.

1. Download the file again just in case it is corrputed.

2. Give your file a .sdf extension just in case the file name ips_sdf in a problem (shouldn't be).

3. Download the previous sdf file, just in case there is some invalid content in the file you currently have.

4. It looks like you have SDM installed. Try SDM to install the signatures.

Hopefully this will help, if not repost or give the TAC guys a shot.

[ROBERTO TACCON]

Thanks it's a memory problem.