S189 resets some things to their default settings?

[jchrisos]

I didn't see anything in the release notes or the readme that comes with the update, but where can I find a list of what changes are made after applying this upgrade?

The reason I ask is because I have ssh on a non-standard port. After installing this patch, ssh was changed back to port 22. Also, I was having RDEP errors.

Any body know what changes are made to the defaults?

Thanks,

Jim

[ibanezm · Accepted solution]

Jim,

Supported sensor configurations are preserved when upgrading to 4.1(5). Cisco only supports configurations using the CLI. The ssh port cannot be changed via the CLI. Changing system config files via the service account is not a good idea and not supported.

-Mario

[jchrisos]

What does "not supported" exactly mean? If I change the ssh port, does that void my warranty or something? Or are you saying if I screw something up by changing the SSH port, Cisco won't help me fix it?

Thanks again!!!!!!!!

Jim

[ibanezm]

Jim - Doing non-supported configurations won't void your warranty. We'll do our best to help you. In this case it simply means that such system config file changes via the service account won't be preserved upon a subsequent upgrade.

[jchrisos]

I gotcha now. So that is the reason why my changes were lost then? Going from 4.1(4) to 4.1(5)?

Thanks again!

Jim

[randy.manning]

When I upgraded from sp 4 to sp 5 sig 189, I noticed NAC wouldn't shun connections, but hosts? Well, anyway... On Friday 9/23, upgrading from sig189 to sig191, my event filters for 3030 (which is configured to initiate a shun for that alert) stopped working and IDS started shunning servers that were once "protected" by the associated event filter. I downgraded back to 190 and the event filter started working again.

This ring a bell for anyone?

[ibanezm]

The event actions on 4.1(4) and 4.1(5) are the same:

log

reset

shunHost

shunConnection

ZERO

I just tested that event action configurations (including shunHost and shunConnection) are merged from 4.1(4) to 4.1(5)S189 to 4.1(5)S191. I configured additional signatures in each version and they were all preserved.