Upgrading ids 4.1 to IPS 5

I have a 4235 with 4.1 I am trying to upgrade with IPS-K9-maj-5.0-1e-S149.rpm.pkg the sensor does it's reboot but in the end it just hangs on "uncompressing Linux....ok, booting the kernel" any idea why it stops there.

Call me stupid but I always have the same problem so I have got in the habit of backing up my config on the IDS and downloading the new .img file for the upgrades. I have had that happen to me way to many times.. It wont happen if you use the .img file though.. I promise you that ;)
Note: I said i backed up my IDS config because if you use the .img file you lose the config on the IDS as well.. Just an FYI.

Similar Messages

Upgrade IDS (4.1- 5.1)

How to upgrade my IDS 4215 from v4.1 to v5.1?
Does my ciscowork be upgraded at same time?
Thanks

Hi .. as per the below link upgrading from 4.1 to 5.1 is two steps procedure.
1.- Upgrading from 4.1 to 5.0
2.- Upgrading from 5.0 to 5.1
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_installation_guide_chapter09186a008055fc78.html
For upgrading from 4.1 to 5.0 youc an download the software to a local ftp server and follow the below steps.
Log in to the CLI using an account with administrator privileges.
Step 3 Enter configuration mode:
sensor# configure terminal
Step 4 Upgrade the sensor:
sensor# configure terminal
sensor(config)# upgrade ftp://FTPusername@ftp_serverIP_IP_ddress//directory path/IPS package name-pkg
Step 5 Enter the password when prompted:
Enter password: ********
Re-enter password: ********
Step 6 Type yes to complete the upgrade.
Note Major updates, minor updates, and service packs may force a restart of the IPS processes or even
force a reboot of the sensor to complete installation.
Step 7 Verify your new sensor version:
sensor# show version
Application Partition:
Cisco Intrusion Prevention System, Version 6.0(1)S149.0
NOTE: as of version5.X you need a license for getting signatures updates.
You can repeat similar procedure for upgrading from 5.0 to 5.1
I hope it helps .. please rate it if it does !!!!

Upgrading IDS 4210 from 4.1 to 5.2

I received the S253 sig update notification yesterday and for the first time it appears the text indicates that I can upgrade my IDS 4210 to the 5.2 version needed to have continued sig support. What is the upgrade path? What do I need to order? Everytime I use the PUT it only shows me the upgrade package for my current 4.1 version. I think I would much rather upgrade my current sensor than spend $$$ on purchasing a whole new one. Thanks.

Just to add a little more information.
The IDS-4210 has been End of Saled, but not yet End Of life.
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/prod_eol_notice09186a008032d508.html
The IDS-4210 IS capable of running IPS version 5.1 software and will continue to receive signature updates as long as IPS 5.1 signature updates continue to be created.
No date has yet been announced for when IPS 5.1 signature updates will stop, but I would expect no less that 18 months from now.
An IPS Service Contract and associated Signature Update License is required for installing signature updates in IPS 5.1.
If you already have an IPS Service Contract then you can upgrade to 5.1 and request the associated License for your sensor.
(NOTE: A Service Contract has always been required for the installation of signature updates, but was previously not enforced by software. It is now being enforced by the IPS 5.1 software through the use of the License received through the Service Contract)
As for memory requirements. The following is stated in the 5.0(1e) Readme file:
- 512 MB of RAM memory on the IDS-4210, IDS-4210-K9, and IDS-4210-NFR (NOTE: this upgrade is no longer available as the IDS-4210-MEM-U= part has been end-of-saled).
If you previously upgraded to 512MB then you are fine.
If not, you would need to open the IDS-4210 and determine what the memory part number is and attempt to purchase additional memory matching that part number from any vendor that you can find (does not have to have been specifically sold by Cisco, but should match the part number of the memory already in the system). The memory is longer being manufactured so Cisco was no longer able to sell that part.
You should NOT attempt to install 5.0 or 5.1 on a sensor running only 256MB of memory. The sensor will never run properly.
Specific upgrade files to use:
http://www.cisco.com/cgi-bin/tablebuild.pl/ips5
IPS-K9-maj-5.0-1e-S149.rpm.pkg
IPS-K9-min-5.1-1g.pkg
IPS-K9-sp-5.1-3.pkg
If you do not already have an IPS Service Contract for your sensor, then you need to contact your Cisco Sales Representative. The last day you could have purchased a new service contract for the IDS-4210 was back on December 6, 2004.
Yoru Cisco Sales Representative may be able to give you a discount on upgrading your IDS-4210 to a newer IDS-4215.

Screen Upgrade 1366x768 TN to 1920x1080 ips?????

Hello! I'm consider swapping out my L540 1366x768 for a compatible 1920x1080 display. I'm pretty sure a TN panel will fit (I assume Lenovo don't make a different screen chassis based on screen type?) I'm just wondering if it's possible to replace the TN panel with an IPS one? I can see a few posts on the subject already but none I've found relating to the L540. Anyone managed this? Any issues? I'm very comfortable working on computers.

Hi Happyjolly,
Thank you for the response.
I had actually bought this L540 manufacture refurbished from a store after a lot of researching, hoping and believing that the IPS display switch might work... but it did not hence I have now sold it... I also have returned the IPS Panel to the online shop... however before returning I did some tests and found that when I connected the eDP port to the IPS panel and turned on the system , I could see the BIOS boot (Thinkpad logo) and the windows logo (blue square thingy with a black cross), but after that all I got is a black screen, so I left the laptop running, plugged out the eDP cable and put it into the original display just to see it come back to life with the home screen. I think this has something to do with windows or something else like TN being normally white and IPS being normally black etc, but I could not test any further.
I hope this experiment of mine proves useful to someone else trying the same thing.
Now I have sold everything and ordered a new Thinkpad T550 with a 15.5 3K IPS screen, Core i5-5200U, nVidia GeForce 940M, 8GB DDR3L, 1TB HDD, 24 GB SSD, backlit US layout keyboard. I certainly hope that the display will be really awesome on this one..
So that's the end of my experiments with displays (for now).. Rama Krishna signing out!

Upgrading IDS4.0 to IPS

Can I upgrade IDS 4.0 to IPS. If so, pls tell me what procedure i have to follow.

Following page shows the list of supported sensors that can be upgrated to IPS5.1:
http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps4077/products_installation_guide_chapter09186a008055fc77.html#wp498739
The upgrade procedure to upgrade from IPS 4.1 to 5.x is given here:
http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps4077/products_installation_guide_chapter09186a008055fc78.html#wp1032104

IDS 4235 upgrade problem

hi,
i have IDS 4235 running ver 4.1(1)S47
i want to upgrade it to act as ips i have upgrdae file IPS-K9-maj-5.0-1-S149.rpm.pkg when i start upgrade process i strats copying file from ftp to ids then i got a message
Error: This hardware platform, , is not supported in version 5.x
is there any solution for this problem

Hi,
Logon to your sensor to CLI. Run show users all to see your users. If there is one with a Privilege of Service, logoff and login again with that user account. If a service account does not exist (only one allowed), create one with the following:
configure terminal
username service privilege service
Best of Luck.

Upgrading a 4215 to IPS

I would like an explanation of the upgrade process from a Cisco 4215 IDS sensor to the IPS 5.0 capabilities. Does it require extra hardware?

If you do not have the 4FE card installed, you will need to purchase/install one in order to create inline pairs on a 4215 with IPS 5.0 software. In a future release, you will be able to take advantage of the inline capabilities with a single sensing interface.
Regarding the upgrade process, this can be found in the readme file for the 5.0 Major Upgrade (to maintain current settings) or the 5.0(2) system image (for clean system image). Both of these install files, as well as the associated readmes, can be found on the software download page on CCO:
http://www.cisco.com/kobayashi/sw-center/ciscosecure/ids/crypto/
-Rusty

Can i upgrade my HP ENVY J001TX Laptop Screen to IPS Screen.

Hi,
I am currently using HP Envy J001tx Laptop. All are exceptional in this other than the laptop display.Is there any way i can upgrade my laptop screen to IPS Screen or some othe screen with good color calibration with better viewing angles???????
Note : My Display is FHD Brighview display (but viewing angles and color richness is very poor)

Hello Vashif, welcome to the HP Forums.
According to the Maintenance and Service guide for your notebook, these are the screen's available for your notebook:
(2) 17.3-in, LED. HD, BrightView display panel (includes 2 rubber screw covers):
17.3-in, AG, FHD, LED 720256-001
17.3-in, BV, HD, LED 720257-001
You can find this on page 28.
I hope this answers your question. Thank you for posting on the HP Forums.
I worked on behalf of HP.

Filtering IPs on a IDS/IPS signature

Forgive me, I am pretty green when it comes to manipulting IDS/IPS signatures.
Is there a way to filter an IP or subnet from a IDS/IPS signature?
Senario:
We have 2 ASAs with IPS modules and 2 4260 IDS's, we use IPS Manager Express 6.1 to manage them. I keep getting a mail server that is triggering signature 5748-x because its sending a helo verb instead of a noop. This is fine for this paticular mail server. So i would like to remove its IP or filter its IP from the signature so when this happens the signature doesnt fire. However I dont want to disable the signature in case it happens somewhere else.
any help is greatly appreciated.
e-

It's not really too bad. I would encourage you to read still though;-)
Each signature can be configured with any number of actions. by default, a lot of them have the "product alert" action.
event action filters are basically a way to suppress all or some actions based on various criteria, like sigid and source (attacker) ip address. I've attached an example.

Ids to ips license

Dear All,
i upgraded my nids 4235 to ips 5.0(1)s49 , but when i logged into the nids it says
There is no license key installed on the system.
Please go to http://www.cisco.com/go/license
to obtain a new license or install a license.
are they charge for this license ?? when i went into this http://www.cisco.com/go/license
i found Cisco Services for IPS service license Cisco Services for IPS service license
Cisco Services for IPS trial license
... these things..which license will work ??
can anybody clear me.. thanks in advance
nataraj

Licensing is not yet enforced. In the near future it will be required to get sig-updates.
See excerpt from the readme:
IPS SUBSCRIPTION SERVICE LICENSE
You must have a valid maintenance contract per sensor to receive and use
software upgrades, including signature updates from Cisco.com. Beginning with
IPS 5.0, an IPS Subscription Service License is required to install signature
updates.
You can request an IPS Subscription Service License for all sensors covered by a maintenance contract at this URL:
http://www.cisco.com/go/license
To manage your maintenance contracts use the Service Contract Center found at this URL:
http://www.cisco.com/cgi-bin/front.x/scccibdispatch?AppName=ContractAgent
With the initial release of 5.0, the first several signature updates will be
released without the license enforcement to allow you time to get your
maintenance contracts in order and your sensors licensed.
Hope this helps.
-Mario

IDS upgrade

Hi
While trying to upgrade IDS 4235 (Version 4.1(1)S47) using FTP or IDM, it gives "Error: exp timeout" message. What could be the reason?
If the FTP server is a Windows XP machine, and the signature/service pack file is in C:\Inetpub\ftproot, what is the exact URL we have to specify with the upgrade command / IDM. Does it need to specify the relative directory or absolute directory in the URL?
Thanks in advance.
Regards // Anoop

The ftp client logic in the 4.1(1) sensor was not very robust. It is probably not compatible with your ftp server. The ftp client in 4.1(5) and 5.x is much more robust. Here is a workaround until you get to 4.1(5):
- from service account, manually ftp the upgrade pkg file over to the sensor (into /tmp directory for this example)
- from cli "conf t; ssh host
- now perform a "local upgrade using scp":
up scp://service@//tmp/

Ips 4215 Upgrade to version 6

Hi there, I got a IPS 4215 on Ebay, then I want to upgrade it to 6.XX versions of IPS Software (currently I run 5.0.1).
I downloaded the following files:
IPS-4215-K9-sys-1.1-a-6.0-6-E3.img
IPS-4215-K9-sys-1.1-a-6.0-5-E3.img
But when I flash using them under rommon, everything goes fine, It restart, flash the partition, reboot, then I goot kernel panic : not enough memmory and no killable processes. I added a 512Mb of ram, which bring the IPS to a total of 768Mbps...
ANyone did have this issue ?
I successfully upgraded to 5.1 image, but then I can't upgrade to a 6x image using the upgrade command, it tells me I need a version 1 or earlier of the engine.
Did anyone upgraded its IDS4215 to a IPS 6.X image ? If so, could you please give me image name(s)/procedures ?
THanks.

So it sounds like I can just import them from that folder into the current version of palm 6.2. Or is it better to go back to the previous version? The only issue I had with the previous version was difficulty in hotsyncing a program called Thomson clinical xpert, it would allow it to expire.
Post relates to: Tungsten E2

Upgradation of IPS in AIPSSM Module

Hi All,
Can we upgrade the Engine Version of IPS from 6.0(3)E1 to the latest engine version directly in AIPSSM Module . If yes,please let me know if any steps to be noted down while upgrading the same.
Regards
Kiran

Please refer to the following link:
http://www.cisco.com/en/US/partner/docs/security/ips/7.0/release/notes/22789_01.html#wp1235012
SongL

Upgrading IPS strings, ASA SSM-10 module

I am having a challenging time upgrading the ASA SSM-10 IPS module. I down loaded the IPS-sig-s327-req-e1.pkg to Win XP ftp server (my workstation). The instructions in following does not work: http://download-sj.cisco.com/cisco/ciscosecure/ips/6.x/sigup/IPS-sig-S327.readme.txt
"error: execUpgradeSoftware : Connect failed". Any suggestion would be appreciated.

I can connect the LAN switch directly to the inside interface of the ASA5510 firewall. Hosts can get Internet connectivity while cabled to the switch. However, when the LAN switch is connected to the port on the IPS module, there is no Internet connectivity. Any suggestions would be appreciated. The following is the sh configuration and sh int output.
sh con_[Jfiguration
Version 5.1(6)
! Current configuration last modified Sat Apr 05 12:28:11 2008
service interface
exit
service analysis-engine
virtual-sensor vs0
physical-interface GigabitEthernet0/1
exit
exit
service authentication
exit
service event-action-rules rules0
exit
service host
network-settings
host-ip 192.168.1.36/24,192.168.1.10
host-name ips
telnet-option enabled
--MORE--
access-list 0.0.0.0/0
exit
time-zone-settings
offset 0
standard-time-zone-name UTC
exit
exit
service logger
exit
service network-access
exit
service notification
exit
service signature-definition sig0
exit
service ssh-known-hosts
exit
service trusted-certificates
--MORE--
exit
service web-server
exit
ips# sh inter_[Jfaces _[2C
Interface Statistics
Total Packets Received = 6806
Total Bytes Received = 2001784
Missed Packet Percentage = 0
Current Bypass Mode = Auto_off
MAC statistics from interface GigabitEthernet0/1
Interface function = Sensing interface
Description =
Media Type = backplane
Missed Packet Percentage = 0
Inline Mode = Unpaired
Pair Status = N/A
Link Status = Up
Link Speed = Auto_1000
Link Duplex = Auto_Full
Total Packets Received = 6807
Total Bytes Received = 2001866
Total Multicast Packets Received = 0
Total Broadcast Packets Received = 0
Total Jumbo Packets Received = 0
Total Undersize Packets Received = 0
Total Receive Errors = 0
Total Receive FIFO Overruns = 0
Total Packets Transmitted = 6807
--MORE--
Total Bytes Transmitted = 2017118
Total Multicast Packets Transmitted = 0
Total Broadcast Packets Transmitted = 0
Total Jumbo Packets Transmitted = 0
Total Undersize Packets Transmitted = 0
Total Transmit Errors = 0
Total Transmit FIFO Overruns = 0
MAC statistics from interface GigabitEthernet0/0
Interface function = Command-control interface
Description =
Media Type = TX
Link Status = Down
Link Speed = N/A
Link Duplex = N/A
Total Packets Received = 126
Total Bytes Received = 14255
Total Multicast Packets Received = 0
Total Receive Errors = 0
Total Receive FIFO Overruns = 0
Total Packets Transmitted = 1
Total Bytes Transmitted = 64
Total Transmit Errors = 0
Total Transmit FIFO Overruns = 0

Monitor IPS with IEV?

Got notified that we have to upgrade our IDS 4.1 to IPS 5.0.
We currently use Cisco IEV to monitor the IDS. Can we use IEV to monitor IPS or do we need something else?
Finding info on cisco.com is like a d@mn treasure hunt.

Hello Tscislaw,
We went thru the same routine a few months back. Yes, you can still use IEV with IPS 5.1.x. Just go to the link http://www.cisco.com/kobayashi/sw-center/ciscosecure/ids/crypto/ --- which is the Cisco Secure Software Software Center (Downloads) page. Go the bottom and look for the Network IDS Management/Monitoring Software section. There you will find the IDS Event Viewer (IEV) for IPS v5.x.
This version works fine with the new IPS v5.1.x software. It even has a few enhancements like a "reports tab" next to the "views" and "filter" tabs in the bottom left corner of the IEV Console.
There are two things that are different. One, the help files are the same as v4.1. Cisco is working on updating them. Second, the fields in the export file. IEV 5.1 no longer breaks out the unix local date/time code to readable date and time columns. You need to be aware of this if you try to export the csv to Excel. Cisco TAC has a BugTrack number for this. A human readable date and time field will be added in IEV v5.2(6) according to them. This will help a lot in creating adhoc reports from the export file (as a lot of people did with v4.1).
Hope this answers your question.
DF

Upgrading ids 4.1 to IPS 5

Similar Messages

Maybe you are looking for