Resolution
In order to upgrade an Intrusion Detection System (IDS) Appliance Sensor from version 3.1 or earlier to 4.0, or from version 2.2 to 3.0, use the Upgrade/Recovery CD. In order to obtain the Upgrade/Recovery CD, a valid support contract is required. SMARTnet customers can order this CD with the Product Upgrade Tool. The part number for the CD to upgrade from version 3.1 to 4.0 is IDS-SW-K9-UPE or IDS-SW-K9-U.
In order to upgrade an IDS appliance from version 4.0 to 4.1, from 3.0 to 3.1, or from 2.5 to 3.0, download the respective upgrade files from Cisco Downloads.
In order to upgrade an IDS appliance from version 4.x to 5.0, refer to the guidelines and instructions in the Upgrading from 4.x to 5.0 section of Release Notes for Cisco Intrusion Prevention System 5.0.
Note: The specific instructions on how to upgrade the Sensor software are located in the readme files that accompany the software. Refer to the IDS Software Image Naming Conventions section of Obtaining Software in order to understand the software nomenclature.
Periodic signature updates, which also contain Network Security Database (NSDB) updates, are posted to Cisco.com approximately every two weeks. Service packs are posted to Cisco.com as needed. Major and minor feature releases are also posted periodically.
An active IDS maintenance contract and a Cisco.com password are required in order to download updates. Refer to the Applying for a Cisco.com Account with Cryptographic Access section of Obtaining Software for more information on how to obtain software.
Backup the old configuration and events:
Its highly recommended to backup the sensor configuration in case something fails with the upgrade.
In order to backup the sensor configuration, issue this command in the command line interface (CLI) of the Sensor:
copy current-config ftp://
This is an example:
Sensor#copy current-config ftp://
User: user1
Server's IP Address: 10.1.100.12
Port[21]:
File name: test-backup
Password: *****
The IDS Sensor can not archive the signature events for a long time as they have a fixed memory space of 30 MB in order to store the signature events, which is overwritten when full. But, these events can be stored to an external management system such as CiscoWorks VPN/Security Management Solution (VMS), Cisco Security Monitoring, Analysis and Response System (CS-MARS), or IDS Event Viewer (IEV).
Refer to Cisco Downloads in order to download the IDS Event Viewer.
