Is there a way to automate IOS IPS signature updates without CSM?

I have a growing number of 891 routers running IOS IDS/IPS. My Cisco vendor has stated repeatedly that CSM is the only way to manage signature updates to multiple routers, but I'm finding CSM to be incredibly tedious and slow. It also wants to manage a lot more than just the IPS policies and signatures which causes other problems.
I have about 160 routers deployed now and that will grow to at least 600. I have CSM 3.3.1. I'm told 4.x would make it easier becasue it can be configured to ignore more of the non-IPS bits of the router configs, but the upgrade is a big chunk of money that wouldn't be in the budget until at least 2012.
Is anybody doing this with an expect script or EEM applets or something else? It seems to me that I could manually upload an update to one router and push the resulting XML files to all the other routers a lot easier and faster than I could "discover" a bunch of routers in CSM (and rediscover them every time we make a CLI change), add the routers to a group, apply updates to a sig policy, lather, rinse, repeat..., not to mention troubleshooting the weird errors and completely wron "warnings" that CSM spews.
               Thanks in advance!

From IOS version 15.1(1)T, you can configure the IOS IPS to auto update from cisco.com which would help I believe.
Here is the configuration guide for your reference:
http://www.cisco.com/en/US/docs/ios/sec_data_plane/configuration/guide/sec_ips5_sig_fs_ue_ps10591_TSD_Products_Configuration_Guide_Chapter.html#wp1138659

Similar Messages

  • IOS IPS auto-update without CSM

    Hi,
    We have 400 x 1811 router on which we need to update the IPS signature definition and custom signature.
    What is the best way to do it withou running CSM ?
    According to Cisco documentation, we need to add the auto-update command with an .XML extention. But when we load a .pkg in a router, the output is 4 different files. Unfortunalty we can auto-update only one file. Which one to I need to load on our TFTP server ?
    All the exemples of Cisco are using one single XML file.
    Does a single file with the signature defenition, category, default and type exist ?
    Since all our router have the same IPS config, I tought I could use one router at the central office with the configuration we want. And by someway asking the remote routers to auto-update their XML file on that router on which I would have activated a TFTP server.
    Anyone ever had to upgrade a lot of router IOS IPS signature?

    This can now be done in the 15.1T branch using cisco.com to download the update directly, see :
    http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151TNEWF.html#wp1040750
    http://www.cisco.com/en/US/docs/ios/sec_data_plane/configuration/guide/sec_ips5_sig_fs_ue.html#wp1137583

  • IOS IPS Signature Updates

    Hi,
    Is it possible to update signatures for IOS IPS or do we need to update the IOS to get more signatures?
    Thanks and rgds
    Rajesh

    hi,
    if you have cisco sdm, then it would be easy to update your IOS IPS signatures. You may need to upgrade IOS of the router only when the ips signature requires you to do it.

  • Is there a way to get iOS 6 on an iPod touch 3rd gen?

    I have an iPod touch 3.  Is there a way to get iOS 6 on it without jailbreaking?

    No. The 3G can only go to 5.1.1

  • IOS IPS Sig Updates

    It seems like whenever there is an IDS sensor/appliance update for defending against the latest virus/worm but there is no update for IOS IPS signatures.
    Case in point - on June 3 there was an IDS update for W32/Bobax.worm.o S174. The IOS IPS zip file as of today is S169 from May 25, What gives?
    Also, why isn't their any release notes for the IOS IPS zip files to document what was added? That way we can read it to judge if we need to download the zip file or not.

    There are a couple of extra steps in producing the IOS IPS signature update. The IOS IPS solution is a subset of the full appliance solution and is further constrained by memory limitations inherent in the routers that it runs in. Because of this, once the signature development team puts together an appliance update, that update has to be reviewed to make sure that the appliance signatures won't crash the IOS implementation. Any issues found during the review have to be addressed before the IOS update can be posted. This extra review step is the cause for the delay.
    Regarding the release notes. The signatures usable by the IOS solution are a subset of the appliance update. You can look at the appliance update release notes to see what *might* be available. I say might because of the subset issues....
    SC

  • IOS IPS SIG Updates via IDSMDC

    When using IDSMSC to push out updates for Sensors and IOS IPS devices, the signature update process pushes the updates to the sensors during the udate process. However the IOS IPS devices pulls their signature definitions from the server itself.
    So my question is, do you need to "Generate" and "Deploy" to all IOS IPS devices to insure the devices are updated with the latest signature definitions after the update?
    SHM

    There are a couple of extra steps in producing the IOS IPS signature update. The IOS IPS solution is a subset of the full appliance solution and is further constrained by memory limitations inherent in the routers that it runs in. Because of this, once the signature development team puts together an appliance update, that update has to be reviewed to make sure that the appliance signatures won't crash the IOS implementation. Any issues found during the review have to be addressed before the IOS update can be posted. This extra review step is the cause for the delay.
    Regarding the release notes. The signatures usable by the IOS solution are a subset of the appliance update. You can look at the appliance update release notes to see what *might* be available. I say might because of the subset issues....
    SC

  • IPS signature update

    i would like to get some idea for IOS IPS signature update.
    example currently the router fresh install using IOS-S416-CLI.pkg, IOS category ios_ips in advanced mode, with retired false.
    Just wonder what if next time download and loading with latest patch of the IOS-SXXX-CLI.pkg into the machine, what will effect on the current compiled signature?
    will it just loaded in incremental form?  (meaning is it the signature in latest patch will added as new enable signature), then what about the signature previously being modified and save one, any effect on it? (like re-write my previous save signature)
    with the new patch install, would it also effect on the router DRAM and flash size? (my router with 384 mb DRAM and 128mb flash)
    thanks

    Hi,
    When you compile a new signature package on a router that carries an existing signature database, the signature configuration in the new signature package will supersede the router's existing database's signature configuration. Thus, if you have made changes to the signature database on the your router, and you compile in an updated signature package that contradicts your changes, your changes will be overwritten!!, and will need to be re-created.
    You can avoid having to re-create your changes if you copy the "routername-sigdef-delta.xml" or "iosips-sigdef-delta.xmz" file to some other location on the router's local storage, and re-apply the original "routername-sigdef-delta.xml" or "iosips-sigdef-delta.xmz" to the updated signature database after you have compiled the updated signature package to the router's database.
    And don't forget, the basic signature category is appropriate for routers with less than 128 MB of flash memory, and the advanced signature category is appropriate for routers with more than 128 MB of flash memory.
    Hope this helps,
    Thank You,

  • OOB warning during IPS 4260 signature update via CSM

    Hi,
    During the recent IPS signatures updates via CSM, i have noticed that there was warning (below).
    >OOB change detected - Out of Band(OOB)and sensor configuration change happened on device. But you selected to continue deployment in case of OOB. Continuing...
    what is the cause & impact of such event?
    As i suspected there is a mismatch of configuration, my inline interfaces are no longer applied to the virtual sensor 'VS0'. Could it be due to the mis-synchronisation?
    Apprepriate for any advice.
    thanks
    cash

    CSM keeps an internal copy of the configuration it last pushed to the sensor.
    Each portion of the configuration has a configToken assigned to it by the sensor. The config token is a base 64 encoding of that configuration portion.
    Each time CSM goes to push a new configuration it will compare the configToken of it's previously saved configuration for that sensor against the configToken of the configuration currently on the sensor.
    If the 2 configTokens match, then no configuration change has been made since the last time that CSM pushed a configuration to the sensor. CSM can safely push the new configuration to the sensor.
    If the 2 configTokens do not match, then an Out Of Band (OOB) configuration change has been made to the sensor. This means that the sensor's configuration has been modified by something other than CSM. This may have been a user changing something through the CLI or IDM instead of using CSM.
    In these situations CSM gives you the option of either stopping the push of the new configuration so the detected changes can be imported and evaluated by the user, or to go ahead and push the changes to the sensor.
    If you decide to go ahead and push the changes to the sensor, the outcome of the configuration change is not guaranteed.
    The sensor may wind up merging the OOB changes in with the new configuration from CSM, or the CSM changes may wind up overwriting the OOB changes.
    So telling CSM to push the new configuration even when OOB changes have been detected can be risky and can cause loss of some of your configuration.
    I fyou will be making changes with CLI or IDM, then it is always best to import those changes into CSM before making further configuration changes in CSM.

  • Is there any way to automatically update not on cellular

    Is there any way to automatically update not on cellular but on wifi like on android? I am wanting to leave update automatically on but not cellular for updates but I need cellular for iTunes match. It seams that there is no choice for wifi when available. I went through a ton of data with app updates on cellular.

    Hi All updates since ios 7 can be done over Wifi I have not used a pc for updates or anything for over a year Go to settings turn cellular data off that will restrict all data to Wifi Cheers Brian

  • Is there a way to automatically add another of the same page while a form is being filled?

    Is there a way to automatically add another of the same page while a form is being filled?
    I have a two-page form of which the second page is essentially a spreadsheet analog.  Often, there is need for for more lines than are available on the page.  Is there a way in which to add another or even multiple copies of the second page? 
    Thanks ahead...
    TG

    You can do that with a dynamic XFA form created in LiveCycle Designer, which comes with Acrobat Pro for Windows. For more information, you can ask over at the LiveCycle Designer forum.

  • Is there a way to automatically insert the filename in the footer of a spreadsheet using iWork's numbers 3.2?

    Is there a way to automatically insert the filename of a spreadsheet into the footer when using iworks numbers 3.2?  iworks 09 had this feature and I can't find this feature in the new version of numbers.

    Hi rhyolite,
    In Numbers 3.x, The Print View and Layout View have gone (for now at least). Page Headers and Footers can only be reached under Menu > File > Print... to open Print Preview. Hover the cursor to reveal the Page Header and Footer fields.
    The only inserts that I can get to work in Print Preview are Page Number, Page Count and Date & Time. Filename is no longer in the Insert menu.
    Regards,
    Ian.

  • Is there a way to automate the CFX tags installation?

    Hello,
    I'm currently in the process of re-installing a web farm of ColdFusion 8 servers (W2K8, IIS 7.5).
    I have to install a number of CFX tags (C++) on each server to get the code running.
    Is there a way to automate the installation of the CFX tags (regedit imports, VBS, PowerShell...)?
    I found some link indicating that keys should be imported in the registry at: HKLM\Software\Allaire, but Allaire does not even exist in this branch (I believe that the instructions were true of older versions of CF).
    I installed one of the tags manually and noticed that the file neo-runtime.xml was updated with:
    <?xml version="1.0"?>
    <wddxPacket version="1.0">
      <header/>
      <data>
        <array length="18">
          <boolean value="true"/>
          <struct type="coldfusion.server.ConfigMap">
            <var name="session_variables">
              <boolean value="false"/>
            </var>
            <var name="application_variables">
              <boolean value="false"/>
            </var>
            <var name="server_variables">
              <boolean value="false"/>
            </var>
          </struct>
          <struct type="coldfusion.server.ConfigMap">
            <var name="cfx_http5">
              <struct type="coldfusion.server.ConfigMap">
                <var name="NAME">
                  <string>cfx_http5</string>
                </var>
                <var name="CACHE">
                  <string>true</string>
                </var>
                <var name="PROCEDURE">
                  <string>ProcessTagRequest</string>
                </var>
                <var name="DESCRIPTION">
                  <string/>
                </var>
                <var name="TYPE">
                  <string>cpp</string>
                </var>
                <var name="LIBRARY">
                  <string>D:\ColdFusion8\cfx\cfx_http5\cfxhttp5.dll</string>
                </var>
              </struct>
            </var>
          </struct>
    Can I simply add the XML node to get it running?
    Thanks in advance for any lead to the solution.

    This is great! but I'm not there yet. I figured how to assign little midi triggered melodies to a touch track. I used to do stuff like this on an old Buchla years ago. How do I get the automation on the midi track to control the filter on an audio track? I created regions with the automation I want on a midi track, then I assigned those regions to keys with touch tracks. How do I get that to control the filter on the audio track?
    thanks,
    Lee

  • HT202299 Is there a way to automatically upload videos that last more than 5 minutes on icloud ?

    I saw that icloud has a limitation of 5 minutes on the videos :
    Is there a way to automatically upload videos that last more than 5 minutes from iphoto/photos ?
    I'm trying to find a way to store my photo library on the cloud, AND keep to acces to each photos/videos from the net (not just storing the .iphotolibrary on the icloud folder) but i cant do it for the videos of more than 5min ...

    I believe you are probably referring to iCloud photo sharing. If you wait a while, the next version of Yosemite will include the new Photos application which will sync video through the iCloud photo library feature.

  • Is there a way to automatically detect and delete duplicate photos in a library

    I just imported a load of photos into my main iPhoto '11 Library from several older MAC's Photo Libraries. Despite repeatedly using the "Don't Import Duplicate Photos" dialogue box, I have many duplicate photos. Is there a way to automatically detect and delete Duplicate Photos?
    I also have iPhoto Library Manager installed on my MAC, but cannot seem to locate on it anything that would do this.
    I have over 4,000 photos, so would really appreciate some help here! Thanks in advance...

    duplicate annihilator - http://www.brattoo.com/propaganda/
    And NEVER import an iPhoto library into another iPhoto library - doing so des not work and creates massive duplication
    if you still have all of the original iPhoto libraries I recommend you drag the bad one you created to the desktop (delete it later when everythin has successfully been completed) and start over usin iPhoto Library Manager - http://www.fatcatsoftware.com/iplm/ -  to merge the libraries
    LN

  • Is there a way to automatically backup the Airport Extreme Configuration file (.baseconfig)?

    Is there a way to automatically backup the Airport Extreme Configuration file (.baseconfig).
    I know (in hindsight) that I can manually export it from the Airport Utility, but ideally I would like to include it in my Time Machine backup. I had a situation where my Airport Extreme (3rd generation) just stopped working (no lights, no power). I had not exported the config file. I bought a new Airport Extreme (5th generation) and had to manually configure the new router.
    Thanks

    One option would be to use Automator and record the actions to run the AirPort Utility; save the configuration file to the desktop (or any other location you want), and then, close the utility. You can then either make this a part of your login startup programs. Time Machine then should be able to make backups.

Maybe you are looking for