Please help me understand this...

nalmaleh · ‎06-15-2004

I have 3 IDS sensors 3.1(3)s42 and I use CSPM 2.2.3 to monitor the alarms;

I would like to upgrade these to 4.1 and use Threat response v.2.0 or some kind mentoring/Reporting software with it. since CSPM 2.2.3 will not work with 4.0 or 4.1

I tried TR 2.0 but it's trial and can't find a way to get it even my channel rep.

from reading this forum that it's a limited trial and it will be in Cisco Works 2000 VMS 2.2

Any advice on what I can use to monitor the IDS when I upgrade them to 4.1

marcabal · ‎06-15-2004

CTR can be downloaded from this location:

http://www.cisco.com/cgi-bin/tablebuild.pl/ctr

(The link is also available from the main IDS download page on CCO)

The current version is a trial version so there is no additional cost for users with up to date service contracts on their sensors.

It will be incorporated into the next major version of VMS. I am not sure what if any pricing structure will be put in place when that happens.

Your other alternatives for viewing 4.1 alarms are:

IEV 4.1 - Intrusion Detection Event Viewer which can monitor up to 5 sensors and runs on Windows 2000. It is available at no additional cost for users with up to date service contracts.

It can be downloaded directly from CCO.

There are links from the main IDS download page.

VMS Basic - VMS Basic is all of the same VMS code as the regular VMS and has all the features of the regular VMS, but it has a license limited to only 5 devices.

Security Monitor is the utility within VMS that is used for monitoring the alerts from the sensors.

This Basic VMS is available at no additional cost for users with up to date service contracts.

Unfortunately the VMS Basic is too large to put on CCO. So if you want a copy you will need to order the VMS Basic disk through the Product Upgrade Tool (PUT) on CCO.

http://tools.cisco.com/gct/Upgrade/jsp/index.jsp

You will need to enter your up to date service contract number.

Then you should be able to order the VMS Basic CD free of charge.

For configuration, you can also use the VMS Basic CD. IDS Management Center is the utility in VMS used for configuring the sensors.

The other alternatives are to use the CLI on the sensor, or IDM (IDS Device Manager) which is a web based configuration tool on the sensor itself.

Both IDM and CLI work well for configuration when using IEV or CTR for alert viewing.

rwassom · ‎06-16-2004

VMS Basic 2.2 is also included in the IDS Sensor Software Upgrade Entitlement (IDS-SW-K9-UPE), along with the 4.1 Recovery/Upgrade CD. If you don't have the 4.1 CD already, this may be the route you want to go.

If you have a valid contract number, you can order the SW Upgrade Entitlement through PUT at no cost. Otherwise, you will have to order the regular SW Upgrade through Cisco.com or your preferred reseller.