IDS-4215 virtual sensors

Similar Questions

• Troubleshooting of the IDS 4215 interface detection

  Hello!

  I am deploying IDS4215 with interface of remote sensing (Fa0/1) connected to the SPAN Cat3750 Gig1/0/1 interface.

  The problem is the following. The ID works for a while (I am able to view alerts and States 'show int' Fa0/1 located upward). Then after awhile Fa0/1 goes down, I don't know why.

  The Cat3750 shows that State of Gig1/0/1 passes the "follow-up" to "notconnect. All I can do is restart IDS.

  Catalyst shows no error on the interface.

  I am a novice in ID, and I appreciate any idea where to start troubleshooting.

  Thanks in advance!

  SSM

  Catalyst settings:

  GigabitEthernet1/0/1 interface

  Span ID description

  full duplex

  Speed 100

  end

  control interface of the session 1 source article gi1/0/27 - 28

  control interface of the session 1 source Gi2/0/27 - 28

  control interface of destination session 1 item in gi1/0/1

  Config of IDS:

  ! ------------------------------

  ! Version 5.1 (1)

  ! Current configuration changed the game 22 dec 10:11:22 2005

  ! ------------------------------

  service interface

  Physics-interface FastEthernet0/0

  automatic duplex

  automatic speed

  output

  Physics-interface FastEthernet0/1

  FE0/1 description

  Admin-state enabled

  full duplex

  Speed 100

  output

  output

  ! ------------------------------

  service-analysis engine

  vs0 virtual sensor

  Physics-interface FastEthernet0/1

  output

  output

  In my view, that there is something seriously wrong with version 5.1 (1). Why Cisco continues to allow users to download is beyond comprehension. I will be rebuild about 20 sensors today because of this problem. I have rebuilt 6 sensors Friday [from an ISO image, models 4235,4240,4255] and let them run this weekend. 5 out of 6 have the sensor interface down once again.

• IDS 4215, good place for an interface sniff (LAN or DMZ)

  I have this sensor with two interfaces only at work, I was asked to check that

  See the IDSWORK version #.

  Application partition:

  The Cisco Systems Version 1.0000 S47 Intrusion detection sensor

  2.4.18 - 5smpbigphys-4215 OS version

  Platform: IDS-4215

  an interface that is Ethernet 0 connected to switch in the DMZ, and 1 Ethernet connected to switch 4005, logically I have to monitor DMZ not switch box 4005 (since I had only two interfaces, my case), I'm right?

  That means that ethernet 0 should be to sniff (surveillance) since it is connected to the DMZ and interface 1 for command and control, since it is connected to switch 4005, but according to cisco specifications

  http://Cisco.com/en/us/products/HW/vpndevc/PS4077/products_configuration_guide_chapter09186a008055df7d.html#wp1051279

  Table 5-2

  FastEthernet0/0: Interfaces supporting VLAN pairs Inline (port detection)

  FastEthernet0/1: Interfaces do not support Inline (command and control Port)

  Note: Cisco has mentioned FastEthernet, one I had Ethernet, makes all the difference?

  Because I did not have this configuration, he made by another, should I change this?

  It seems that your credentials are equipped with the basic ports (2 x Ethernet) with E0 C & C port, while E1 is followed by port.

  BTW, Ethernet/FastEthernet ports are in fact the same.

  To monitor your DMZ segment, then place the E1 in this segment, as E0 on inside segment where in addition to directing the Manager of its web management or CLI interface box, you probably can use basic VMS that comes free with it.

  And since you have dedicated switch to host the entire DMZ segment, you can easily monitor box (SPAN) all and send all traffic to the IDS.

  If you need to change the configuration, you may need to test at least to verify signatures is enabled/disabled and pc/mgt host is allowed to access the box and so on. But it is a good practice for audit and review the new config/setup, as it is a security zone, you need to do to monitor trust and you talk about all the possible threats, attacks or violations.

  HTH

  AK

• License on Cisco IDS 4215 box

  I have IDS 4215 (version 4) works fine for 2 years. All of a sudden I could not access the IDS4215 via the console or telnet last month. I rebooted it, but there is no change.

  Then we get the ROMMON prompt via CTRL-R. We performed procedures "Installation image of the system IDS-4215. We have installed version 5. So, we lost the old license for IDS 4215 ver 4. How can I get old license?

  We want to make the 4215 IDS to work with version 5 and the latest signatures. What should we do in this regard?

  It wasn't a license file in ver 4.

  Licenses were introduced in ver 5.

  Licenses are included as part of your Cisco Service for IPS maintenance contract.

  To see if you have a contract to day just go in the license of IDM configuration page and click on the button to say IDM to check cisco.com for a license.

  If she comes back with a license while your contract is up to date and everything is good.

  If she does not return with a license, then probably you don't have a Service Cisco IPS service contract for your sensor.

  Your Cisco or an authorized Cisco reseller sales Reprentative contract and request a quote for Service Cisco IPS contract for your sensor.

  Don't forget to give them the serial number of your sensor when you buy the contract so it is followed correctly in the database of contract of Cisco.

• Questions of IDS-4215

  I bought this unit and I have problems with it, I did the restore and I put the new password and pick-me-up Dungeon to it, how to make out of it?

  CISCO SYSTEMS IDS-4215
  Embedded BIOS Version 5.1.7 03/02/04 11:20:35.01
  Compiled by dnshep
  Evaluate the Options of execution...
  Check for disc Image valid
  GRUB, loading stage1.5.

  GRUB loading, please wait...

  GRUB version 0.91 (632K lower / higher than 523264K memory)

  -------------------------------------------------------------------
  0: cisco IDS (vmlinuz - 2.4.26 - IDS-smp-bigphys}
  1: cisco IDS recovery
  -------------------------------------------------------------------

  Use the ^ and v keys to select which input is highlighted.
  Press ENTER to start the operating system selected, 'e' to change the
  orders before starting, 'a' to change the kernel arguments
  before you start, or 'c' for a command line.

  Entry 0 will be started automatically in 1 seconds.
  Start ' Cisco IDS (vmlinuz - 2.4.26 - IDS-smp-bigphys} ")

  root (hd0, 0)
  Filesystem type is ext2fs, partition type 0 x 83
  kernel (hd0,0)/boot/vmlinuz-2.4.26-IDS-smp-bigphys ro root = / dev/hdb1 had = flash)
  Console = ttyS0 bigphysarea = 16384
  [Linux bzImage, setup = 0 x 1400, size = 0x11b282]

  Linux version 2.4.26 - IDS-smp-bigphys ([email protected] / * / _build_master) (version gcc 2.96 20000731 (Red Hat Linux 7.3 2, 96-112)) #2 SMP Thu Aug 18 11:03:13 CDT 2005
  BIOS fitness card RAM:
  BIOS-e820: 0000000000000000 - 000000000009e000 (usable)
  BIOS-e820: 000000000009e000 - 00000000000a 0000 (reserved)
  BIOS-e820: 00000000000e0000 - 0000000000100000 (reserved)
  BIOS-e820: 0000000000100000-0000000020000000 (usable)
  BIOS-e820: 00000000fff00000 - 0000000100000000 (reserved)
  0 MB HIGHMEM available.
  512 MB LOWMEM available.
  On the node 0 totalpages: 131072
  area (0): 4096 pages.
  area (1): 126976 pages.
  area (2): 0 pages.
  DMI does not exist.
  ACPI: Unable to locate the PDSP
  Kernel command line: ro root = / dev/hdb1 had flash = console = ttyS0 bigphysarea = 16384
  ide_setup: a = flash
  Local APIC disabled by BIOS - reactivation.
  Local APIC found and activated!
  The initialization of the #0 CPU
  Detected 845,655 MHz processor.
  Console: the unit dummy color 80 x 25
  Calibrating delay loop... 1684.27 BogoMIPS
  Memory: 449240 k/524288 KB available (kernel code of 1621 k, k 74656 reserved, 639 k data, 136 k init, 0 k highmem)
  Dentry cache hash table entries: 65536 (order: 7, 524288 bytes)
  Inode-cache hash table entries: 32768 (order: 6, 262144 bytes)
  Get cache hash table entries: 512 (order: 0, 4096 bytes)
  Buffer cache hash table entries: 32768 (order: 5, 131072 bytes)
  The page cache hash table entries: 131072 (order: 7, 524288 bytes)
  CPU: L1 I cache: 16K, D L1 cache: 16K
  CPU: L2 cache: 128K
  Architecture Intel machine control supported.
  Intel machine check reporting enabled on CPU #0.
  Enabling fast FPU save and restore... done.
  Allowing the use of unmasked SIMD FPU exception... done.
  Checking 'hlt' instruction... Ok.
  UNIFIX POSIX compliance test
  MTRR: v1.40 (20010327) Richard Gooch ([email protected] / * /)
  MTRR: detected mtrr type: Intel
  CPU: L1 I cache: 16K, D L1 cache: 16K
  CPU: L2 cache: 128K
  Intel machine check reporting enabled on CPU #0.
  CPU0: Intel Celeron (Coppermine) stepping 0
  by timeslice cut CPU: 365,62 usecs.
  Motherboard undetected SMP.
  Turned off turned on CPU #0
  Value of ESR before activating the vector: 00000000
  Value of ESR after activating the vector: 00000000
  Local APIC interrupt using timer.
  calibration of APIC timer...
  ..... CPU clock speed is 845,6568 MHz.
  ... bus clock speed host is 99,4889 MHz.
  CPU: 0, clocks: 994889, slice: 497444
  CPU0
  Waiting on wait_init_idle (card = 0x0)
  All processors have been init_idle
  PCI: PCI BIOS revision 2.10 to 0xff6a9, last bus = 1 entry
  PCI: Using configuration type 1
  PCI: Hardware probing PCI
  PCI: Hardware probing PCI (bus 00)
  Limitation of direct transfers of PCI/PCI.
  ISAPNP: digitization of the PnP cards...
  ISAPNP: no Plug Play devices & found
  Linux NET4.0 for Linux 2.4
  Swansea University Computer Society NET3.039-based
  The initialization of the RT netlink sockets
  From kswapd
  bigphysarea: 16384 pages for 0xc1606000.
  Responsible journaled block device driver
  Pty: 2048 Unix98 ptys configured
  keyboard: there is no Timeout - at THE keyboard? (ed)
  keyboard: there is no Timeout - at THE keyboard? (f4)
  Series c 5.05 driver version (2001-07-08) with MANY_PORTS MULTIPORT SHARE_IRQ SERIAL_PCI active ISAPNP
  ttyS00 at 0x03f8 (irq = 4) is a 16550
  ttyS01 at 0x02f8 (irq = 3) is a 16550
  V1.10F real time clock driver
  Initialized RAM disk driver: 16 discs RAM 4096 K size 1024 blocksize
  loop: loaded (max 8 devices)
  LPC: version 0.1 (August 18, 2005)
  Uniform cross-platform E-IDE review pilot: 7.00beta4 - 2.4
  IDE: assuming that the speed of the bus system 33 MHz for modes PIO; Override with idebus = xx
  PIIX4: Controller IDE PCI slot 00:07.1
  PIIX4: chipset revision 1
  PIIX4: not 100% natively: will probe IRQS later
  ide0: BM - DMA at 0xf800-0xf807, BIOS settings: had: pio, hdb:pio
  IDE1: BM - DMA at 0xf808-0xf80f, the BIOS settings: hdc:pio, hdd:pio
  has: SanDisk SDCFB-256, CFA HDD
  HDB: IC25N020ATCS04-0, ATA drive
  has: disable DMA (U) to SanDisk SDCFB-256
  BLK: queue c03bf1a8, I/O limit 4095 MB (mask 0xffffffff)
  ide0 at 0x1f0-0x1f7, 0x3f6 on irq 14
  has: attachment the ide disk driver.
  had: task_no_data_intr: status = 0 x 51 {DriveReady SeekComplete error}
  had: task_no_data_intr: error = 0 x 04 {DriveStatusError}
  had: 501760 sectors (257 MB) w/1KiB Cache, CHS = 497/16/63
  HDB: attached the ide disk driver.
  HDB: host protected area-online 1
  HDB: 39070080 sectors (20004 MB) w/1768KiB Cache, CHS = 2432/255/63, UDMA (33)
  Check the partition:
  has: hda1, hda2, hda3
  HDB: hdb1, hdb2 hdb3 hdb4
  IDE: late registration of the driver.
  Review SCSI subsystem driver: 1.00
  I2C-core. o: i2c core module version 2.8.7 (20040611)
  I2C - dev. o: i2c/dev entries driver module version 2.8.7 (20040611)
  I2C - proc.o version 2.8.7 (20040611)
  I2C-i801 version 2.8.7 (20040611)
  Net4: Linux 1.0 for NET4.0 TCP/IP
  IP protocols: ICMP, UDP, TCP, IGMP
  IP: routing 4096 buckets cache hash table, 32Kbytes
  TCP: Hash tables configured established 131072 bind (65536)
  Linux IP router multicast 0.06 and PIM - SM
  Net4: Unix domain sockets 1.0/SMP for Linux NET4.0.
  kjournald starting.  Commit interval 5 seconds
  Ext3-fs: mounted filesystem with ordered data mode.
  VFS: Mounted root (ext3 file system) readonly.
  Release of memory used kernel: 136 k released
  INIT: initialization of version 2.84
  Welcome to CIDS v4.1 (1) S47 (Phoenix)
  Mounting proc filesystem: [OK]
  Configuration of the kernel parameters: [OK]
  Setting clock (localtime): my Apr 19 19:14:53 UTC 2010 [OK]
  Activation of swap partitions: [OK]
  Hostname parameter sensor: [OK]
  modprobe: can't open dependencies file /lib/modules/2.4.26-IDS-smp-bigphys/modules.dep (no such file or directory)
  Checking file system root
  / dev/hdb1: clean, 27334/83520 files, 56775/166666 blocks
  [/sbin/fsck.ext3 (1)-/] fsck.ext3 - a/dev/hdb1
  [OK]
  Back the root read / write file system: [OK]
  Find the module dependencies: depmod: can't open /lib/modules/2.4.26-IDS-smp-bigphys/modules.dep for writing
  [NOT]
  Checking of file systems
  / dev/hdb3: clean, 12 files, 2008, 1300/8032 blocks
  / dev/hda1: clean, 33/2656 files, blocks of 4184/10584
  / dev/hdb4: clean, 32/2280320 files, blocks 80505/4558443
  / dev/hda3: clean, 20/58232 files, 84949/232848 blocks
  Check all file systems.
  [/sbin/fsck.ext3 (1)-/ bootmnt] fsck.ext3 - a/dev/hda1
  [/sbin/fsck.ext3 (2)-/ usr/cids/idsRoot/shared] fsck.ext3 - a/dev/hdb3
  [/sbin/fsck.ext3 (2)-/ usr/cids/idsRoot/var] fsck.ext3 - a/dev/hdb4
  [/sbin/fsck.ext3 (2)-/ mnt/recovery] fsck.ext3 - a/dev/hda3
  [OK]
  Mounting local filesystems: [OK]
  Activation of local file system quotas: [OK]
  Activation of the swap space: [OK]
  Non-interactive startup entry
  Setting the network parameters: [OK]
  Set up the loopback interface: [OK]
  modprobe: can't open dependencies file /lib/modules/2.4.26-IDS-smp-bigphys/modules.dep (no such file or directory)
  Setting up interface eth1: [OK]
  Start recorder system: [OK]
  Kernel start recorder: [OK]
  Load keymap: [OK]
  Loading system font: [OK]
  The initialization of the random number generator: [OK]
  Audit of the allocated kernel memory: [OK]
  No XL map shows
  Charge Cidmodcap: WARNING: the kernel-module version mismatch
  /lib/modules/CID/cidmodcap.o was compiled for kernel version 2.4.18 - 5smpbigphys
  While this kernel version 2.4.26 - IDS-smp-bigphys
  /lib/modules/CID/cidmodcap.o: symbol register_chrdev_Rsmp_0450333d pending
  /lib/modules/CID/cidmodcap.o:
  Tip: You are trying to load a module without a GPL compatible license
  and unresolved symbols.  Contact the provider module for
  help, only they can help you.

  [NOT]
  Creation of boot.info [OK]
  Checking for changes to the system since the last boot [WARNING]
  Check the identification of the model [OK]
  Model: IDS-4215
  Error: mainApp has not started
  From sshd: [OK]
  From xinetd: [OK]
  From crond: [OK]
  From anacron: [OK]

  Login: cisco
  Password:
  You are required to change your password immediately (years)
  Change password for cisco
  (ongoing) UNIX password:
  New password:
  Retype the new password:
  NOTICE *.
  This product contains cryptographic features and is under the United States
  and local laws governing the import, export, transfer and use. Delivery
  Cisco cryptographic products does not imply permission to third parties to import,
  export, distribute or use encryption. Importers, exporters, distributors and
  users
  sensor connection: cisco
  Password:
  NOTICE *.
  This product contains cryptographic features and is under the United States
  and local laws governing the import, export, transfer and use. Delivery
  Cisco cryptographic products does not imply permission to third parties to import,
  export, distribute or use encryption. Importers, exporters, distributors and
  users are responsible for compliance with U.S. and local country. With the help of
  This product you agree to comply with the regulations and laws in force. If you
  are unable to meet the United States and local laws, return the product.

  A summary of U.S. laws governing Cisco cryptographic products to:
  http://www.Cisco.com/WWL/export/crypto

  If you need assistance please contact us by mail at
  [email protected] / * /.

  connection of the sensor:

  Since you did the recovery I assumeyou already tried to the unit powering down and back up.

  This is a weird problem I havn't seen before, but sometimes the sensors get currupt and need a full reimage to return to normal.

  I would like to download the most recent image 4215 and TFTP in your sensor in ROMMON.

  http://www.Cisco.com/en/us/partner/docs/security/IPS/6.0/installation/guide/hwImage.html#wp1030874

  -Bob

• Cisco IDS 4215 signatures update

  Hello people,
  We have a few Cisco IDS 4215 and would like to know if the upgrade of signatures, we can remove those released previously or whether precedents should not be eliminated.

  Information system of these devices.

  ***

  TAC-contact information
  URL: http://www.cisco.com/public/support/tac/home.shtml/
  Phone: 1 (800) 553-2447

  Sensor time is 110 days.
  Platform: IDS-4215-4FE-K9
  Boot partition: application

  Partition: application
  Build version: 6.0 (6) E3
  Host:
  Domain keys key1.0
  Definition of signature:
  Update of the signature S439.0 2009-09-30
  Virus update V1.4 2007-03-02
  OS version: 2.4.30 - IDS-smp-bigphys
  Applications
  MainApp
  N NUBRA_2009_JUL_15_01_10_6_0_5_57 2009-07-15 T 01: 15:08 - 0500 ipsbuild
  The executing State: running
  AnalysisEngine
  N NUBRA_2009_JUL_15_01_10_6_0_5_57 2009-07-15 T 01: 15:08 - 0500 ipsbuild
  The executing State: running
  Updates installed
  Update name: IPS - K9 - 6.0 - 6 - E3
  Once installed: July 15, 2009 18.48.06
  Update name: IPS-GIS-S439-req - E3.pkg
  Installed time: 6 October 2009 13.07.55
  Next lower upgrade:
  Partition: recovery
  Build version: 1.1 - 6, 0000 E3

  PEP Udi chassis
  Description sensor unit IPS 4215
  PID ID-4215-4FE-K9
  vid V01
  SN 88808513168

  Memory usage
  usedBytes = 377655296
  freeBytes = 132685824
  totalBytes = 510341120

  Use of the disk
  the application data uses 33.2 M off 166,8 M bytes of disk space available (21% of use)
  start using 37.6 M off 68.6 M bytes of disk space available (58% of use)
  Application log using 529,5 M off bytes of 2.8 G of disk space available (20% of use)

  ***

  Many thanks in advance,

  Luca

  Luca;

  Signature updates are cumulative, so you can simply ask the S493 update.  A caveat, however, if you need to make a big move in the signature release (say S470 to S493) it is usually more effective to make small updates (especially on a platform of low memory as the IDS-4215).

  Scott

• If the IDS 4215 platform support E4 7.0 (2)

  Hello

  We are trying to upgrade the engine in our IPS and IDS devices. We have a single device IDS 4215 in our environment that installed with engine E3. Please let me know as this engine support E4 with 7.0 platform (2) version. If so, please update me with the name of the .pkg file. Thank you.

  Vinoth salvation,

  The IDS-4215 sensor does not support the version of the IPS 7.0 software. The latest version of the software supported on this platform is 6.0.

  He argues, however, E4 engine in combination with the version of the software 6.0 (6).

  To upgrade your sensor to the E4 engine (and use the latest signatures), improve it with the 6.0 (6) E4 software package pkg file.

  You can download this update from the link below:

  http://tools.cisco.com/support/downloads/go/PlatformList.x?sftType=Intrusion+Prevention+System+%28IPS%29+System+Upgrades&mdfid=278244333&treeName=Security&mdfLevel=Model&url=null&modelName=Cisco+IDS+4215+Sensor&isPlatform=N&treeMdfId=268438162&modifmdfid=null&imname=&hybrid=Y&imst=N

  If you are currently using version 6.0, you will just need the "IPS-engine-E4-req-6.0-6.pkg" file to upgrade the engine, if you are on an earlier version of the software, you will need to download "IPS - K9 - 6.0 - 6 - E4.pkg"

  Be sure to read the readme file before the upgrade:

  http://www.Cisco.com/Web/software/282549759/32618/IPS-Engine-E4.Readme.txt'

  Let me know if you have any other questions.

  Best regards

  Stijn

• Assign the virtual sensor in the MODE SINGLE ASA5510-AIP10SP-K9

  Hello

  I install asa 2 ASA5510-AIP10SP-K9 in standby mode active failover. I know how to assign virtual devices to the contexts of the ASA in multiple mode (active/active failover). But I want it to be done in simple mode (active/standby failover). Any idea will be welcomed.

  OK, now I understand what you need.

  Most users need only the single default «vs0» virtual sensor

  To get traffic from the ASA to send to the SSM for follow-up here are the basic steps:

  (The assumption is that you have already previously connected and changed the password and went through the steps in "setup" to set the IP address, network and other settings on your sensor mask.)

  (1) in the AIP - SSM (telnet or ssh) session as the default user "cisco".

  (2) adding interface backplane of the AIP - SSM GigabitEthernet0/1 in the virtual sensor default "vs0" using these commands:

  Configure the terminal

  service-analysis engine

  vs0 virtual sensor

  phyiscal-interface GigabitEthernet0/1

  output

  output

  Answer Yes when prompted

  output

  NOTE: The above could also be done through the advanced configuration command, or could be done through ASDM or IDM. To put it simply I just give you the CLI commands.

  3) connect to the ASA CLI. If you're "ridden" on the SSM, then an exit from your session will respond to the ASA CLI. If connect you via the console through a ssh or telnet or ASA ASA.

  (4) set the ASA to send traffic to the AIP - SSM.

  To do this, you would create an ACL for the traffic you want to monitor. This ACL is then used to create a class map. The plan of the class is then added in a political map. The political map is applied.

  Here's an example of how you can get any traffic to monitor histocompatibility of the AIP - SSM:

  conf t

  IPS ip access list allow a whole

  my class-map-ips-class

  corresponds to the IP access list

  Policy-map global_policy

  My ips-category

  IPS overcrowding relief

  global service-policy global_policy

  NOTE: The foregoing will send all IP packets to the SSM for surveillance of promiscuity. To change monitoring online simply substitute "inline" instead of promiscuity in the line of configuration of IP addresses.

  Note 2: The service-policy command is a reptition of the command that should already be in your configuration of ASA by default. So, it will probably generate an error/warning letting you know that the policy is already applied.

  IF you do not use the default configuration on the SAA and instead create your own policy, then you can use the steps above, but add the class to your own policy rather than the value default 'global_policy '.

  (4) repeat steps 1 and 2 on the MSS of your Eve ASA.

  The configuration of the AIP - SSM does NOT automatically copied between the AIP-SSMs. If you need to do the configuration manually on the two AIP-SSMs.

  (5) connection to standby you ASA and check tha the configuration in step 3 is automatically copied to your Eve ASA.

  The steps above are in force at step 4/5 in your original list.

  Your AIP - SSM should now be followed by traffic.

  You can now proceed to step 6 of your original list.

• Error on server IDS 4215 TLS certificate VEI

  IDS 4215 5.0 software version not connect with IVE and IME server. "" IOException when trying to get the certificate: java.security.cert.CertificateExpiredException. error message is displayed. How this can be solved?

  Hello

  I think it's easy, please go to the CLI and try the following?

  generate TLS keys

  Let me know the results!

  http://www.Cisco.com/en/us/docs/security/IPS/6.0/Configuration/Guide/CLI/cliTasks.html#wp1036929

  Mike

• How to see the log files in IDS 4215

  Hi all

  I have an IDS 4215, I want to check the Logs of the system for this ID, as Interface something like that.

  Thanks in advance.

  All system messages, including signature events are all 'show' commands.

  Enter the command show event displays only events in real time. If you want ot, past events, you need to add a time to the command option; show events past 20:00

  -Bob

• IDS 4215 date and time change after restart

  Hello

  I am facing problem with cisco IDS 4215 (version 6.0), date and time of change in the device after reboot. What is the command to save the configuration. record or write mem does not work.

  Amarjeet Singh

  Once the date and time changes are applied Cisco IPS CLI, they should have been saved. No additional step of "savings" manually is necessary.

  Also, have you thought about Configure NTP on IPS server. IPS synchronizes time with NTP server, if there is no difference.

  I suggest you contact Cisco TAC and report the problem of equipment.

  Kind regards

  Sawan Gupta

• The system IDS 4215 sensor no IPLogs

  Can someone enlighten me please?

  I have configured a sensor 4215 running the latest version 4 of the software & signatures.

  I have configure the sensor to use a Pix to help fleeing, the configuration worked for more than a week and I chose some to block on signatures and it works and I can see guests in the red list.

  My problem is that under , there is no listed log files,

  Is this correct?

  In version 3 on a 4210 sensor there are several listed log files, these are downloadable on my local machine, where as soon as I could import them in event IDS Viewer and display all events, this is no longer how it's done in version 4?

  What I can do under , is see the list of events that have been posted through the web page of IDM.

  Any help would be greatly appreciated.

  Concerning

  Mark

  First of all, I think that there is some confusion between the IP logs and alarms logs.

  There are 2 types of log files in version 3.x.

  The traditional log file which contained alarms in a comma delimited format that can be imported into VEI.

  The second was an IP trail which was a log of the actual binary packages that have been observed after the signing of fire.

  The action of "log" on the signature would result in the creation of a file of Log of IP and had nothing to do with or no alarm was recorded in the comma-delimited log file.

  Logging of alarms in the comma-delimited log file was controlled by will loggerd has been enabled on the sensor and if loggerd has been installed as a destination for messages in the destination file.

  In version 3.x, you might download individual logs to your own PC files and open them in IEV or load them into your own database.

  In version 4.x is therefore more the concept of individual alarms for files and the log of the IP on the sensor data.

  The alarm logs have been replaced by a circular buffer called eventStore. It can be compared to a large circular database. The eventStore is 4 GB in size and when it is full will begin to overwrite the oldest alarms with the most recent alarms.

  IP logs have been replaced by a similar circular storage for the journal of intellectual property data.

  The data of the alarm in version 4.x cannot be FTP'd the sensor as a diary of the alarm.

  Instead, you have two options:

  (1) use IDM to query the eventstore and pull the alarms that match some criteria. You can then view messages in plain text format.

  (2) use the command "Show events" CLI to do the same thing as IDM can do.

  3) contact Cisco TAC and ask for RDEP specification which provides the syntax for you to create your own queries to plug into the sensor and fire alarms in a raw XML format that you can then load into your own database.

  (4) If you are a user of VEI then the 4.x VEI has the ability to pull older alarms of the probe.

  http://www.Cisco.com/univercd/CC/TD/doc/product/iaabu/csids/csids10/idmiev/swchap6.htm#604023

  In the device properties simply, with the older start time and VEI will automatically extract in these earlier events of the sensor.

  NOTE: It is not a function import that can import plain text or events XML you would see options 1, 2 or 3 above. SO if you want to see in VEI then use option 4.

  Now for iplogs they can be FTP'd to the sensor using the command copy. But iplogs are the binary packet data and not a list of alarms. They are created only when the action of "log" is selected.

  NOTE: IP logging consumes resources sensor and can slow down the performance of the sensor. It is not necessary to IP Log an alarm to see the alarm itself VEI or other management positions. If the action of "journal" that should rarely be used when the binary packet data are necessary.

• Virtual sensors IPS

  Hello

  1. can I use the sensor default virtual vs0 for incoming traffic on all interfaces.

  2. How can I assign interfaces to the AIP - SSM module.

  3. How can I assign interafces to the JOINT module.

  I'm assuming that the assigned interfaces are those on which inline inspection is carried out.

  The AIP - SSM is not "both" of these modes. This applies only to sensors/JOINT AFAIK.

  The AIP is inwardly 'connected' to the ASA and has only two modes of deployment instead of three, here is a brief description of EAC:

  #Is the AIP - SSM module to operate or be deployed in inline mode or promiscuous?

  * "Promiscuous" mode means that data is copied to the AIP - SSM while ASA passes the original data to the destination. The AIP - SSM in promiscuous mode can be considered an intrusion (IDS) detection system. In this mode, the trigger package (the package that causes the alarm) can still reach the destination. Fleeing can take place and stop the extra packages to reach the destination, but the triggering packet is not stopped.

  * Mode Inline means that the ASA transmits data to the AIP - SSM for inspection. If the data meets the AIP - SSM inspection requirements, data refers to the ASA in order to continue to be processed and sent to the destination. The AIP - SSM mode inline can be considered as a system of prevention of intrusion (IPS). Unlike promiscuous mode, mode inline (IPS) can actually stop the trigger packet to reach the destination.

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00807335ca.shtml

  Concerning

  Farrukh

• How to monitor a Cisco IDS 4215 (version 6.0)?

  Hello

  I am new to this IDS and need an inexpensive or open source to collect and store the logs of this device.  It seems that the unit can only store a day or two of his own newspapers and I need to collect 1 year.  I have Red Hat linux machines at my disposal, but can use Windows devices or other forms of Linux if necessary.  It would be great if I could just have this thing log to a file on a Linux server on the local network. I can then configure scripts to view and create reports on the balls.

  I installed the IDM on my Windows desktop and can connect to the IDS, but don't see a way to collect newspapers, to trigger alerts by e-mail or create reports.  Is there something Cisco offers (without additional purchase) for this?

  Thank you

  Paul

  For email alerts, you can use IPS Manager Express http://www.cisco.com/en/US/products/ps9610/index.html I think that he will succeed up to 10 IPS sensors.

• VMS IDS MC - error sensor software update

  Hi, we are security monitor and evaluate/test VMS IDS MC.

  We have encountered a problem when you try to update the software of the sensor.

  The Admin of the IDs MC > System Configuration > updated IDS Signatures network:

  After choosing to apply one of the following updated files (I tried everything)

  IDSSk9-sp - 3.0 - 5 - S17.bin

  IDSSk9-sp - 3.1 - 2 - S23.bin

  IDSSk9-sp - 3.1 - 3 - S31.bin

  ID - sig - 3.1 - 3 - S40.bin

  I got the following error message (before I have a chance to choose the sensor):

  "Failed to update the object. An unexpected exception occurred during validation of the

  content of the signature update package. Detail = error opening the zip file.

  Same message in the report of the subsystem for the Java System Services.

  Our version of the software is:

  Common services 1.0

  IDS MC 1.0

  Security Monitor 1.0

  JRE 1.2.2 (V2.1)

  Any idea or suggestion how to solve this problem. Thank you.

  Hi TSUI

  You must have the .zip files the * / updates of the directory of the IDS MC/s lun. But you copied files *.bin which is not supported with IDS MC/s lun. *.Bin files are for the Director of Unix.

  You can get the files generated from the following location

  http://www.Cisco.com/cgi-bin/tablebuild.pl/Mgmt-CTR-IDs

  which is used to update the sensor of the IDS MC/s lun.

  Concerning

  V