First configuration of NME-IPS-K9

hi Everybody
I have trouble for initialising the NME that I just bougth; in fact I use a cisco router 2811 on which I have installed the NME, the command "
service-module" seem to not exist in my router, when I enter it the router display an error.
also, when I enter this command : "show inventory", I have this output:
NAME: "unknown on Slot 1", DESCR: "unkonown"
PID: NME IPS-K9 , VID: V02, SN: FOC13091TNT
is this output normal?
please help me it is my first time to work on NME.
thanks a lot in advance

HI,
after changing the IOS version of my router, the module is now display when show inventory is enter.
but I have a question, this is the message that I have when I session into the module:
***LICENSE NOTICE***
There is no license key installed on the NM-IPS.
The system will continue to operate with the currently installed
signature set. A valid license must be obtained in order to apply
signature updates. Please go to http://www.cisco.com/go/license
to obtain a new license or install a license.
Is this means that after buying the module, we must buy also a new licence?
thank you in advance

Similar Messages

Sample configuration of IME 7.0 with NME-IPS-K9 and How to get licence for NME-IPS-K9?

Dear all,
I already installed NME-IPS-K9 with Cisco Router 2821 series successfully and I used IME(Cisco IPS Manager Express 7.0.1) to configure NME-IPS-K9 but I never try with this before. I have some issue need everyone help:
1. Could you share the sameple for configuring IME with NME-IPS-K9 to monitor and manage all network traffice or package that attack to NME-IPS-K9?
2. Could you show me how to get licence for NME-IPS-K9?
Thanks everyone for your time to help me and share your great ideas.
I am really appreciated and looking for forward to hearing response from you all.
With my warm regards,
Sarem Phy
H/P:092562530

CPU 100% on the NME-IPS module is normal. It will always show 100%. CPU on IPS is not related to the inspection load.
To check if the IPS module is overloaded, please check the "Inspection Load" speedometer.

Router NME IPS - use promiscuous and inline mode simultaneous

Hi all,
we are using the IPS module NME-IPS-K9 on a Cisco 2951 router. We like to use the IPS in promiscuous and inline mode simultaneous. For example traffic from a client to a server should pass through the IPS. But the IPS should only recieve a copy of the VoIP traffic.
In the interface configuration mode the following command is set.
     ids-service-module monitoring promiscuous access-list 101
If I try to set a interface to inline mode I get the following message:
     "Only either Inline or Promiscuous
     monitoring is supported on the router at one time.
     Please remove Promiscuous monitoring on all interfaces
     before configuring Inline monitoring. Only either Inline or Promiscuous
     monitoring is supported on the router at one time.
     Please remove Promiscuous monitoring on all interfaces
     before configuring Inline monitoring."
Is there any way to use promiscuous and inline monitoring at the same time? Is there a firmware update available which includes this feature? Any other idears?
IOS version of the router: 15.0(1)M4
IPS version: 7.0(2)E4
Kind Regards

In promiscuous mode your sensor doesn't affect the traffic but it only listen and analyze it.
In inline mode you direct all your traffic on this network segment you want to protect to IPS and it analyze it and block some actions according to your settings.
It is the main difference. Which mode to prefer must be your decision.

NME-IPS K9 running in 3845 not accessible

I am not able to ping or ssh into my IPS module. I am not able to access it via the router either. When I try to create a session via the router I get the following : Trying xx.xxx.xxx.xxxx, 2114 Open..... and it just sits there. Is there another way to access it and/or reboot the module, without restarting the router.

Hello,
1. You can reset the NME-IPS module from the Router CLI.
This will only reset the NME-IPS not the Router.
router# service-module ids-sensor 1/0 reset
       Use reset only to recover from shutdown or failed state
       Warning: May lose data on the hard disc!
       Do you want to reset?[confirm]
http://tools.cisco.com/squish/b63A4
2. After it comes back up, check if the module is responsive.
You can also issue: 'show inventory' and check if the module is even detected by the router.
If the module is not even detected by the router, it may be an hardware issue.
3. Check if the module is correctly configured.
Check my configuration document for this.
https://supportforums.cisco.com/docs/DOC-12364
Sid Chandrachud
TAC Security Solutions

How can I reset the age entered during the first configuration set up?

how can i reset the age entered during the first configuration of a brand new i pod touch. The age is incorrect and does not allow me to open a new i-tunes at a later configuration step. Error meesage: you are not old enough to open a new i-tunes account.
Thanks for support to solve the problem.

- Terminate the setup for obtain the account and then try again with same email address.
- Next would be to contact iTunes.
Contact iTunes

Connecting to NME-IPS results in connecting to cisco router itself

Suddenly, without any clear reason, I cannot access the NME-IPS in my router.
Instead it connects to the router console.
The IP address is also pingable.
Output:
gateway#service-module IDS-Sensor 1/0 status
Service Module is Cisco IDS-Sensor1/0
Service Module supports session via TTY line 66
Service Module is in Steady state
Service Module heartbeat-reset is enabled
Getting status from the Service Module, please wait..
Cisco Systems Intrusion Prevention System Network Module
Software version: 7.0(6)E4
Model:             NME-IPS
Memory:            443504 KB
Mgmt IP addr:      192.168.11.99
Mgmt web ports:    443
Mgmt TLS enabled: true
gateway#service-module IDS-Sensor 1/0 session
Trying 192.168.11.99, 2066 ... Open
C
Cisco Router and Security Device Manager (SDM) is installed on this device.
This feature requires the one-time use of the username "cisco"
with the password "cisco". The default username and password have a privilege level of 15.
Please change these publicly known initial credentials using SDM or the IOS CLI.
Here are the Cisco IOS commands.
username <myuser> privilege 15 secret 0 <mypassword>
no username cisco
Replace <myuser> and <mypassword> with the username and password you want to use.
For more information about SDM please follow the instructions in the QUICK START
GUIDE for your router or go to http://www.cisco.com/go/sdm
User Access Verification
Username:

If IME is not connecting, is it giving you some sort of error?
Do you have ASDM launcher loaded? if so, does it also fail to connect?
When you launch IME are you prompted for a password, is that failing on the password entry or does it simply fail to connect to the device?
I have not been able to access my NME via https either, I get a Java error, but I pretty much always use Cisco IME to access my NME module so I have not chased down the Java issue.

Configuring signature through IPS Manager in CSM3.0

I was trying to customize the siganture with IPS manager in CSM3.0.Any changes in CSM3.0 only displays in the window but looks like it is not been applied to IDSM2 which has IPS v5.1.The same change If I make through IDM to idsm2
it works fine.
This how I am testing: Just changed the sev level (low to high) in one of the bulit in siganture (say 2100 sweep)
from the IPS manager in CSM3.0.Then, when a traffic triggers that signature,the IPS Eventviewer still shows the sev level as "low" only.
But if I do the same changes though IDM I can see the sev level as "high" in the IPS event viewer5.0.
I also have 2 x 6500 with single IDSM2 on both switches.I could add only one IDSM2 to IPS manager (via DCR in comman services )and the other one I couldnot.Any suggestions please

Hi,Thanks for your response.IPS Sensor is configured.I use the same username/password with priv15 through IDM as well.
Here is the Problem Summary:
============================
We are using CSM3.0 for managing IDSM2 modules and we are having the following difficulties
I. Adding new IDSM2 sensor module into CSM3.0 through IPS
II.Customization of any signature
I.Adding new IDSM2 sensor module into CSM3.0 through IPS
We followed up the below procedures to add the IDSM2 modules
1.Go to CCS, device crenditials, select the type as cisco service modules and give the device crenditials like IP Address, username/password etc
2.Go to IPS Manager, under device tab we could see the IDSM2 module has been added.Then go to sensor group and re-import it.It works fine ie we could add and see the same in IPS manager.
Note: 1st sensor was successfully added where as the 2nd sensor couldnot be added in IPS
3.We could see that the same has been added into common services.But when we see in IPS Manager Device sensor or sensor group, we could not see the IDSM2 module.
Only the 1st sensor is showed in the IPS window.So we couldnot re-import the second sensor in to the specified group ( the group is same as the 1st sensor)
II.Customization of any signature:
We followed up the above said procedures ( as per I 1 to 2) to add the IDSM2 modules
Note: 1st sensor was successfully added where as the 2nd sensor couldnot be added in IPS
1.Go to configuration, select the IPS siganture5.1, apply some changes like
Changing the sev level from ?low? to ? high? for one of the built in signature ( ID 2100) by tuning. The changes appear in the CSM IPS console. But it doesn?t apply to the IDSM module. After this change, if the signature triggers IEV should show the changed level ? high?. But the IEV still shows the old level for the signature ID 2100 as ?low? only. The main screen under device tab still shows that configuration as pending.ie it looks like the changes made in CSM/IPS manager doesn?t applied to IDSM2 module
Note: If we make the same changes by using the IDM which behaves as expected.ie IEV shows the sev level for the tuned signatureID (2100) as ?high?
Please suggest us where are we missing?
Here are the details about the modules
Module: IDSM2 module
Ver: 5.1(1)S229.0V1.0
CSM : 3.0
IEV: 5.1.1

QoS Configuration for NME-AIR-WLC

Hello,
I have a question on the correct QoS configuration for a VoIP deployment. I have followed the steps referenced here but have two questions..
1) The last recommendation in the list is to set DCA channel sensitivity to High to avoid changes during business hours. I think this should be Low? The manual states "Low—The DCA algorithm is not particularly sensitive to environmental changes."
2) The recommendation is to trust dscp on AP uplinks and to trust cos on the WLC uplink. However I can't find any configuration guidelines for configuring QoS if the WLC in question is an NME hosted in a 2921.
2a) The link between the switch and the 2921 is an 802.1q trunk so should I trust cos on this link rather than dscp?
2b) What configuration should be on the 2921? Create a policy-map and apply it to the uplink port?
2c) Should there be a service policy assigned to the In1/0 interface for the WLC itself?
Any thoughts appreciated.
Thanks,
Dave

Well I appear to have answered question 2 after I stopped being lazy and did some packet captures.
No configuration required on 2921 as packets captured from In1/0 and Gi0/0 show correct DSCP markings on RTP and SCCP packets.
Would still be interested to know on question 1 though.

First Configuration for CRM 5.5

Hi Experts,
Please e-mail me the configuration guide for CRM5.5
i'm doing this for the first time [email protected]
Regards
Ricky

I dont think CRM has a version 5.5.Its latest is 5.0
And regarding the configuration document.U can download it by:
http://help.sap.com/bp_crmv250/CRM_DE/index.htm
thanks,
ashish.

Waas configuration with NME

I have a branch deployed with an appliance using WCCP and I just purchased a module for a smaller site. I am having trouble equating wccp config over to the module. Read all the white papers but I am missing something really simple.
I will apreciate to help me about this issue, I have two week with the same issue.
I send the configuration the remote BRANCH and the topology..
I wait for your coments , specially with the words marks.
ip wccp 61 redirect-list CRONOS
ip wccp 62
interface Loopback1
description Loopback BGP
ip address 192.168.249.8 255.255.255.255
interface GigabitEthernet0/0
description Interface LAN
ip address 192.168.161.4 255.255.255.0
no ip proxy-arp
ip accounting output-packets
ip wccp 61 redirect in
ip wccp 62 redirect out
ip route-cache flow
duplex auto
speed auto
standby 1 ip
standby 1 priority 220
standby 1 preempt
service-policy input LAN-PANA2-MARQ
service-policy output WAN-PANA2-QOS
interface GigabitEthernet0/1
description ENLACE TLC_ASB_50
ip address 192.168.167.13 255.255.255.252
no ip proxy-arp
duplex auto
speed auto
service-policy input LAN-PANA2-MARQ
interface Serial0/0/0
description Enlace a PERU
bandwidth 2048
ip address 192.168.114.9 255.255.255.252
ip accounting output-packets
ip wccp 61 redirect in
ip wccp 62 redirect in
ip flow ingress
ip flow egress
encapsulation ppp
load-interval 30
shutdown
interface Serial0/0/1
no ip address
shutdown
clock rate 2000000
interface Integrated-Service-Engine1/0
ip address 192.168.165.129 255.255.255.128
ip wccp redirect exclude in
service-module ip address 192.168.165.140 255.255.255.128
service-module ip default-gateway 192.168.165.129
no keepalive
router eigrp 12
redistribute static
redistribute bgp 250 metric 10000000 1 255 255 1500
network 192.168.161.0
network 192.168.167.12 0.0.0.3
network 192.168.249.0
no auto-summary
ip flow-cache timeout active 1
ip flow-export source Loopback1
ip flow-export version 9
ip flow-export destination 130.1.8.30 2055
p access-list extended CRONOS
permit ip host 192.168.161.13 192.168.112.0 0.0.0.255
permit ip host 192.168.161.16 192.168.112.0 0.0.0.255
permit ip host 192.168.161.23 192.168.112.0 0.0.0.255
permit ip host 192.168.161.91 192.168.112.0 0.0.0.255
permit ip host 192.168.161.71 192.168.112.0 0.0.0.255
permit ip host 192.168.161.72 192.168.112.0 0.0.0.255
permit ip host 192.168.161.76 192.168.112.0 0.0.0.255
permit ip host 192.168.161.77 192.168.112.0 0.0.0.255!
Regards,

Daniel,
I send a topology, for your opinio and best practice the how configurate the WAAS in WCCP.
I hope your help for this issue,
It posible to configure this command in the router WAN (ip wccp 62 redirect in) and the router WAAS ((ip wccp 62 redirect out , (ip wccp 61 redirect in)?.
Or I need more commands for this configuration.
Yesterday I sent the configuration the R1, today I send you agein.
ip wccp 61 redirect-list CRONOS
ip wccp 62
interface Loopback1
description Loopback BGP
ip address 192.168.249.8 255.255.255.255
interface GigabitEthernet0/0
description Interface LAN
ip address 192.168.161.4 255.255.255.0
no ip proxy-arp
ip accounting output-packets
ip wccp 61 redirect in
ip wccp 62 redirect out
ip route-cache flow
duplex auto
speed auto
standby 1 ip
standby 1 priority 220
standby 1 preempt
service-policy input LAN-PANA2-MARQ
service-policy output WAN-PANA2-QOS
interface GigabitEthernet0/1
description ENLACE TLC_ASB_50
ip address 192.168.167.13 255.255.255.252
no ip proxy-arp
duplex auto
speed auto
service-policy input LAN-PANA2-MARQ
interface Serial0/0/0
description Enlace a PERU
bandwidth 2048
ip address 192.168.114.9 255.255.255.252
ip accounting output-packets
ip wccp 61 redirect in
ip wccp 62 redirect in
ip flow ingress
ip flow egress
encapsulation ppp
load-interval 30
shutdown
interface Serial0/0/1
no ip address
shutdown
clock rate 2000000
interface Integrated-Service-Engine1/0
ip address 192.168.165.129 255.255.255.128
ip wccp redirect exclude in
service-module ip address 192.168.165.140 255.255.255.128
service-module ip default-gateway 192.168.165.129
no keepalive
I wait your answers,
Thanks
Best Regards,

How would you configure ports and IPs for FMS 4.5 to allow RTMFP streaming across the Internet?

Basically I've got an AS3 app set up that allows video chats between n number of parties, using RTMFP. The problem is that when I tried to connect a computer from across the Internet, as opposed to our intranet, suddenly it couldn't connect at all to RTMFP for that app (though it was able to succeed in using an RTMP fallback that was in there).
So after hunting around, I got the network administrator to supposedly open up 1935-1960 UDP for outbound traffic on the external IP for the FMS's server (same server as the AS3 app), and he apparently opened them up for inbound traffic as well. I also went into Adaptor.xml and changed this element:
<HostPort>:19350-19360</HostPort>
to say this:
<HostPort public="XX.XX.XXX.XXX:19350-19360">:19350-19360</HostPort>
where XX.XX.XXX.XXX is the external IP for that computer. At this point in time though, even though computers across the Internet are able to connect through RTMFP, the video/audio streams aren't getting through at all across the Internet. What's more is that even on our intranet, there are one-way versions of that problem now.
Network administration is not my strong suit, in all honesty. Where would I need to start looking in order to solve this problem? Thanks!

Found the answer to the problem. It was something fairly specific to our internal network. For anyone else who runs into something like this, use cc.rtmfp.net on each client computer and refer to stuff described at http://help.adobe.com/en_US/flashmediaserver/configadmin/WSdb9a8c2ed4c02d261d76cb3412a40a4 90be-8000.html#WSec225f632fa008755a148c52131fca3d386-7ffe, especially under "Understanding the RTMFP Connectivity test".

SSM IPS Configuration

I have a couple of questions regarding the ASA that deal with the SSM module.
I have read the document "Configuring ASA-SSM" and am confused by the command logic. I realize that you need to specify a service-policy globally that defines the traffic being sent to the SSM module. My concern is that the configuration document lists as one of it's steps to define an ACL for the IPS traffic and then apply it to an interface before configuring the class map, policy map, and service-policy. Why would this ACL need to be applied to an interface when it is being used for defining IPS traffic? Shouldn't the ASA send whatever traffic is defined globally in the service-policy to the SSM without attaching the ACL to an interface?
Also, on the ASA factory default configuration there is a service-policy defined as:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
service-policy global_policy global
But, if I define a global service-policy for the SSM I would lose this default service-policy as only one global service policy is allowed. Is the default service-policy providing the fixup protocol services as in the PIX that I am used to seeing? If so do I lose this functionality by applying a global service-policy for IPS/
Sorry for the length of the post and thanks for your help in advance.

The configuration in the IPS User's Guide is just one method for settings up the ASA to send packets to the SSM.
It is an extremely basic configuration on the ASA where all the ASA is doing is copying packets to the SSM and the ASA is not doing any of it's firewall functionality.
This configuration is only practical if the ASA was purchased and used only for housing the SSM and sending it traffic ( a rare deployment in the field ).
If your ASA is already configured for firewall functionality then the only additional command(s) that need to be added to your config are:
ips inline|promiscuous fail-open|fail-close
Take your existing policy-map and for every class in that policy you will need to decide if the traffic should be monitored promiscuously, inline, or not monitored by the SSM.
In your example, if you wanted to monitor all of the traffic inline on the SSM and want to continue passing traffic if the SSM fails. Then simply add the line "ips inline fail-open" within the existing "class inspection_default".
NOTE: If you change the policy you need to understand that the new policy will only affect new connections and not existing connections.
The only reason you would have to create additional acls and class maps using the acls would be if you did not want all of the traffic monitored inline by the SSM.
If you want different traffic monitored promiscuous and other inline (or not monitored), then you need to include additional classes in your policy-map so that a different ips configuration line can be added for each class.

NME-WAE-502-K9 configuration question

Hi,
It is not clear to me from the configuration guide how we configure WCCP using WAE-502 module which is embedded on the 2811 router, and especially the concept of subinterfaces. I understand when the WAAS is an external appliance connected to the router, but what happens when the card is embedded?
Any help would be greatly appreciated.

You configure the interface for the integrated service module as a normal interface on the router (Ip addresses, etc.). Then you configure the NME's IP address and the default gateway from the router. Then you should be able to ping the device, and you can either session into the module from the router or telnet directly to the device like an appliance.
A very helpful guide is posted here...
http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v403/module/configuration/guide/wsnmecfg.html
Hope that helps,
Dan

Can we change the UCCX server from single node to the first node without affecting it's configurations

Hi all,
Firstly I was using the single CUCM7.0 server with the single UCCX 7.0 server. Now I am going to add the second CUCM and UCCX in the cluster. I was first configured the UCCX server as a single node. Now I have to configure this as a first node. How I could configure this from single node to the first node without affecting it's configurations..??????
Regards
Ali Raza

Hi Aaron,
How could we do the change on Imhost file. How we add the both servers in that file?
Below is the Imhost file txt.
# Copyright (c) 1993-1999 Microsoft Corp.
# This is a sample LMHOSTS file used by the Microsoft TCP/IP for Windows.
# This file contains the mappings of IP addresses to computernames
# (NetBIOS) names. Each entry should be kept on an individual line.
# The IP address should be placed in the first column followed by the
# corresponding computername. The address and the computername
# should be separated by at least one space or tab. The "#" character
# is generally used to denote the start of a comment (see the exceptions
# below).
# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
# files and offers the following extensions:
#      #PRE
#      #DOM:
#      #INCLUDE
#      #BEGIN_ALTERNATE
#      #END_ALTERNATE
#      \0xnn (non-printing character support)
# Following any entry in the file with the characters "#PRE" will cause
# the entry to be preloaded into the name cache. By default, entries are
# not preloaded, but are parsed only after dynamic name resolution fails.
# Following an entry with the "#DOM:" tag will associate the
# entry with the domain specified by . This affects how the
# browser and logon services behave in TCP/IP environments. To preload
# the host name associated with #DOM entry, it is necessary to also add a
# #PRE to the line. The is always preloaded although it will not
# be shown when the name cache is viewed.
# Specifying "#INCLUDE " will force the RFC NetBIOS (NBT)
# software to seek the specified and parse it as if it were
# local. is generally a UNC-based name, allowing a
# centralized lmhosts file to be maintained on a server.
# It is ALWAYS necessary to provide a mapping for the IP address of the
# server prior to the #INCLUDE. This mapping must use the #PRE directive.
# In addtion the share "public" in the example below must be in the
# LanManServer list of "NullSessionShares" in order for client machines to
# be able to read the lmhosts file successfully. This key is under
# \machine\system\currentcontrolset\services\lanmanserver\parameters\nullsessionshares
# in the registry. Simply add "public" to the list found there.
# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
# statements to be grouped together. Any single successful include
# will cause the group to succeed.
# Finally, non-printing characters can be embedded in mappings by
# first surrounding the NetBIOS name in quotations, then using the
# \0xnn notation to specify a hex value for a non-printing character.
# The following example illustrates all of these extensions:
# 102.54.94.97     rhino         #PRE #DOM:networking #net group's DC
# 102.54.94.102    "appname \0x14"                    #special app server
# 102.54.94.123    popular            #PRE             #source server
# 102.54.94.117    localsrv           #PRE             #needed for the include
# #BEGIN_ALTERNATE
# #INCLUDE \\localsrv\public\lmhosts
# #INCLUDE \\rhino\public\lmhosts
# #END_ALTERNATE
# In the above example, the "appname" server contains a special
# character in its name, the "popular" and "localsrv" server names are
# preloaded, and the "rhino" server name is specified so it can be used
# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
# system is unavailable.
# Note that the whole file is parsed including comments on each lookup,
# so keeping the number of comments to a minimum will improve performance.
# Therefore it is not advisable to simply add lmhosts file entries onto the
# end of this file.
Regards
Ali Raza

Nme-wea-502 configure

HI Zack,
Under is the configuration about NME-WEA-502
APP#cms deregister force
Management service is not enabled/registered.
Based on the input, the following configuratio
       central-manager address 172.16.1.250
       ip name-server 172.16.1.253
       ip domain-name c.c
       primary-interface GigabitEthernet 1/0
       hostname APP
       clock timezone UTC 0 0
       cms enable
       wccp version 2
       wccp router-list 8 13.13.13.11
       wccp tcp-promiscuous router-list 8
APP#ping 172.16.1.250
PING 172.16.1.250 (172.16.1.250) 56(84) bytes of data.
64 bytes from 172.16.1.250: icmp_seq=1 ttl=61 time=0.943 ms
64 bytes from 172.16.1.250: icmp_seq=2 ttl=61 time=0.620 ms
64 bytes from 172.16.1.250: icmp_seq=3 ttl=61 time=0.669 ms
64 bytes from 172.16.1.250: icmp_seq=4 ttl=61 time=0.759 ms
64 bytes from 172.16.1.250: icmp_seq=5 ttl=61 time=0.811 ms
--- 172.16.1.250 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 3998ms
rtt min/avg/max/mdev = 0.620/0.760/0.943/0.115 ms
APP#conf t
APP(config)#cms enable
Registering WAAS Application Engine...
Sending device registration request to Central Manager with address 172.16.1.250
Failed to contact CDM 172.16.1.250(TIMEOUT). Please check connectivity with CDM
device and status of management service on CDM.
register: Registration failed(512).
cms: unable to register node i
FAILED to enable management services
I had registed to the CM before ,when NME-WEA-502 offline ,and I try to regist to the
CM again, show this error,could you mind to tell me how to fix it ?

Let's check a couple of things:
If you look at the list of devices in the CM, do you see the NME-WAE there? If so, delete the record of that device on the CM.
What is the output of sh cms info on the CM?
Thanks,
Zach

First configuration of NME-IPS-K9

Similar Messages

Maybe you are looking for