Updating from 3.x to 4.x

[ljones]

With VMS/MC - there is an Update Sensor Version option. Is there any detailed information as to exactly what it does and doesn't update? What else do I need to do?

[mhoda]

Hi,

On IDS MC, update allows you update the service pack or the signature upgrade, it will not allow you to upgrade from 3.x to 4.x. For version upgrade, you need to insert the 4.x cd to sensor and reboot, rest would be done by sensor. Thanks,

Mynul

[ljones]

Everything I have or have seen on-line indicates using the CD to re-image the sensor and then selecting Configurations-Updates-Upgrade sensor version. Is Cisco documentation incorrect??

[8rpalmer]

Ok...so I've re-imaged my sensor via the upgrade CD. Now can I update the sensor version in IDS-MC and then generate a config and deploy that config out to the sensor? I'm wondering if I do this in this sequence if I'll preserve my original signature and filter settings? In other words, what from the original 3.x configuration is preserved when you perform a sensor version update?

[a.arndt]

Bad news - the short answer is nothing is retained from 3.1 if you re-image the drive using the 4.x recovery CD.

Based on personal experience during our upgrade here, my suggestion is to make a copy of some files in the directory /usr/nr/etc on your sensor(s) running 3.1, since this is where key configuration files reside.

Specific files that have customization settings can be found there as follows:

SigUser.conf - holds any changes to the default signatures and any custom signatures

SigSettings.conf - holds info about custom signatures and exclusions

To get your 4.x sensors to do the same thing that your 3.1 sensors were doing, you'll have to take the information from these files and manually input them using IDM or IDSMC.

Hope this helps...

[abwood]

The option in IDSMC under updates to upgrade the sensor version from v3 to v4 should take the previous configuration (filters, tuning, etc) and translate it to a new v4 config that can be deployed to your updated sensor. I have had limited results on the information that it translates. Some of the information needs to be scrubbed once you do the conversion. I have also had issues with errors that won't allow the new config to be generated. So technically you can convert the configs but I haven't had it work well.