Reimaging a sensor?

[lcuchisanmillan]

How can i reimage a sensor?

Thank you

[andrew.burns]

which one?

[lcuchisanmillan]

IDS 4250XL 5.1(1)

[andrew.burns]

Hi,

The book you need is:

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_book09186a008055dbb1.html

There is a chapter called "Upgrading, Downgrading, and Installing System

Images" which contains detailed instructions.

HTH

Andrew.

[npham]

You will need the Recovery/Upgrade CD that came with your sensor. Most likely it will be a 4.1 disk. Stick the disk in, and power cycle the sensor. Follow the onscreen prompts. To go onto 5.1, download the following from CCO and follow the directions in the readme.

1. install 5.0(1c) major upgrade from 21-JUL-2006

2. install 5.1(1g) minor update from 31-JUL-2006

3. now is a good time to apply the sensor license through IDM

4. install 5.1(3) service pack from 21-JUL-2006

5. apply S241 or later sig update

Or, order the IPS upgrade CD, IPS-SW-K9-UPE (it will be free if you have maintenace support). You will get a recovery CD which will put your sensor at 5.0(2) S152. Follow through at step 2.

[dondongamo]

Are these procedures applicable also to IDS4215? what about the memory requirements for 4215 if the user prefer to use ver5.1, does it requires a memory upgade?

TIA.

[rhermes]

The 4215 has enough memory to run 5.1

You should use the new 5.0(1)e file to upgrade, it came out on Monday and fixes a few more things than the last 5.0(1) patch.

The 4215 doesn't have a CDROM drive so all your upgrades will be done via FTP or SCP.

upgrade ftp://user@IPADDRESS/IPS-K9-maj-5.0-1e-S149.rpm.pkg

Wait until the Analysis Engine is running before proceeding to the next upgrade

upgrade ftp://user@IPADDRESS/IPS-K9-min-5.1-1g.pkg

Wait until the Analysis Engine is running before proceeding to the next upgrade

upgrade user@IPADDRESS/IPS-K9-sp-5.1-3.pkg

[lcuchisanmillan]

If i need to do a reimage of a 4215, what should i do? As it does not have a CDROM drive. Which files do i need?

If i try to follow your steps the analysis engine crashs.

Thanks in advanced,

[jwalker]

Sometimes the analysis engine will "crash" for 30-45 minutes. Just wait it out... It should eventually restart itself. If it doesn't you can restart it manually by running the following command with a service account (not recommended though).

/etc/init.d/cids restart

[marcabal]

If you don't care about maintaining your sensor configuration then you can use ROMMON and a System Image.

4.1 System Image: IDS-4215-K9-sys-4.1-4-S91a.img

http://www.cisco.com/cgi-bin/tablebuild.pl/ids4-app-recovr

5.0 System Image: IPS-4215-K9-sys-1.1-a-5.0-2.img

http://www.cisco.com/cgi-bin/tablebuild.pl/ips5-system

5.1 System Image: IPS-4215-K9-sys-1.1-a-5.1-1.img

http://www.cisco.com/cgi-bin/tablebuild.pl/ips5-system

I would recommend reading the readme file for the specific image you are attempting to load. The readme file has almost the same name as the image file, but ends in ".txt".

Here is the link to the User's Guide that explains how to use ROMMON to install them:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids12/cliguide/cliimage.htm#wp1030874

You should also upgrade your IDS-4215's BIOS and ROMMON if they are not up to date:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids12/cliguide/cliimage.htm#wp1060088

IDS-4215-bios-5.1.7-rom-1.4.bin

http://www.cisco.com/cgi-bin/tablebuild.pl/ips5-firmware

[lcuchisanmillan]

The problem is that Cisco IOS TFTP client can not transfer files larger than 16Mb in size and the .img file is too large (80Mb).

[marcabal]

I assume you are trying to image the IPS-4215 with an IPS 4.1 version.

Be sure to upgrade the IDS-4215 BIOS to version 5.1.7 and the ROMMON to version 1.4.

The original BIOS and ROMMON can not handle the large file size.

And refer to this link to see which tftp servers are recommended because of the large file size:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/hwguide/hwclipr.htm#wp200511