How long does take to deploy the config on 4240?

I noticed a config very long deployment on 4240. In CLI I have several changes to the configuration of virtualSensor, answered Yes at the prompt 'Apply changes?' and it takes about 20 minutes to start sniffing interfaces (traffic started) again. That means the box do in the meantime and how to shorten that time. I have about six hundred signatures to listen (another integrated config) - can be the bottle?

The sensor is most likely regenerating tables to cache regular expressions.

Rather than analyze independently each signature regex when a package arrives, it will be rather combine regular expressions of all the signatures in a giant regex and generate a state table and then write the new status table in the disk/compactflash. (We call these tables to cache regular expressions).

When you enable or disable a signature, or when you add custom signatures, it should regenerate the cache tables, because this combined regex has now changed.

(NOTE: Version 5.0 has major improvements in this area.) Cache tables are now delivered directly from Cisco for standard signatures not removed as part of the signature update process. But if you add custom signatures or Kimbo signatures that Cisco has retired, then same 5.0 can take time to make the changes)

Creation of these tables is very intensive CPU, so the sensor is not able to monitor the traffic while the tables are created.

So it's best to save changes as toggle, retirement/unretiring, change regular expressions and create customized for the time signatures where you can afford the downtime of the sensor.

NOTE: Modifications to gravity, actions, recaps and filters do not affect the cache tables and should be able to be applied in a few seconds.

Tags: Cisco Security

Similar Questions

Maybe you are looking for