IDS Maintenance

[kapishmohole.cisco]

Hello,

How to upgrade signatures in IDS sensor?

How to maintain IDS hard drive?

[nkhawaja]

Hi,

To upgrade the signature in IDS 4.x, you need to issue this command

config t

upgrade ftp://username@ipaddress/imagename

for any signature update, there is a readme file available that has the complete procedure for updating

you dont need to do any thing to maintain ids hard drive

Thanks

Nadeem

[dharminatocwen]

I am a new user for IDS. Can I know the sequence in which the signatures and services packs are to be installed, if there is one? I need to install 1 service pack and 2 of the signature packs.

[kapishmohole.cisco]

Hello,

You can add the signature updates step by step, cant exclude much updates...means not directly jump to highest update in service pack.

But you can jump to service pack...means if you have service pack one then you can directly upgrade to service pack four(the K9 file)...and then upgrade the signatures in that service pack.....

Kapish

[marcabal]

This is always documented in the readme for the latest signature update.

In the future you can simply read through the readme to see what you need to do for each of your sensors to get it to that latest version.

From the readme:

-----------------------------------------------------

The sensor must report the version of sensor as 4.1(4)S91 or later

before you can apply this signature update. To determine the current

sensor version, log in to CLI and type the following command at the

prompt:

show version

Version 4.1(1)S47 to 4.1(3)S61 sensors must first be updated with the

4.1(4)S91 Service Pack before applying the 4.1(4)S120 Signature Update.

Install the following binary:

IDS-K9-sp-4.1-4-S91.rpm.pkg

Version 3.x and earlier sensors must first be upgraded to 4.1(1)S47

using the IDS Version 4.1 Recovery/Upgrade CD or the 4.0 Recover/Upgrade

CD and the IDS-K9-min-4.1-1-S47.rpm.pkg minor update package and then

upgraded with the 4.1(4)S91 Service Pack before applying the 4.1(4)S120

Signature Update. The Recovery/Upgrade CD and minor upgrade packages

are available free to customers with active SMARTnet maintenance

contracts at the following urls:

Recovery CD: http://tools.cisco.com/gct/Upgrade/jsp/index.jsp

Minor Update Package: http://www.cisco.com/cgi-bin/tablebuild.pl/ids4

Refer to the Quick Start Guide for the Cisco Intrusion Detection System

Version 4.0 for instructions on upgrading version 3.x IDS-42xx sensors:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids9/15282_01.htm

-------------------------------------------------

So if you are running 4.1(4)S91 or higher then you just need to install the latest 4.1(4)S120 signature update. You can jump straight from S91 to S120 without having to load the 29 versions in between.

http://www.cisco.com/cgi-bin/tablebuild.pl/ids4-sigup

If you are running 4.1(1)S47 to 4.1(3)S61 then first install the 4.1(4) service pack, and then install the sigupdate. You can jump straight to the 4.1(4) service pack without having to load the 4.1(2) or 4.1(3) service packs.

http://www.cisco.com/cgi-bin/tablebuild.pl/ids4

If you are running an older 4.1 version the first install the 4.1(1) minor version update available at the same site as the service pack.

If you are running version 3.x you need to order an upgrade CD from Cisco to first get you to either 4.0 or 4.1.