4D Compiler 6.0.6 serial key or number

Table Of Contents

Release Notes for Cisco Intrusion Prevention System 7.1(4)E4

Contents

IPS File List

Supported Platforms

Supported Servers

ROMMON and TFTP

IPS Management and Event Viewers

New and Changed Information

AC Power Supply in the IPS 4300 Series V01 and V02 Chassis

The IDM and JRE 1.7

The Sensor and Jumbo Packet Frame Size

The ASA IPS Modules and Jumbo Packets

Obtaining Software

Upgrading to IPS 7.1(4)E4

Upgrade Notes and Caveats

Upgrading the Sensor

Reimaging the Sensor

Installing the IPS 4270-20 System Image

Installing the IPS 4345 and IPS 4360 System Image

Installing the IPS 4510 and IPS 4520 System Image

Installing the ASA 5500-X IPS SSP System Image

Installing the ASA 5585-X IPS SSP System Image

Using the hw-module Command

Using ROMMON

Licensing the Sensor

Using the IDM or IME

Using the CLI

Obtaining a New License for the IPS 4270-20

Licensing the ASA 5500-X IPS SSP

Initializing the Sensor

Understanding Initialization

Simplified Setup Mode

System Configuration Dialog

Basic Sensor Setup

Advanced Setup for the IPS Appliance

Advanced Setup for the ASA 5500-X IPS SSP

Advanced Setup for the ASA 5585-X IPS SSP

Verifying Initialization

Logging In to the IDM

Installing or Upgrading the IME

Enabling Anomaly Detection

Enabling Anomaly Detection Using the IDM or IME

Enabling Anomaly Detection Using the CLI

Disabling Anomaly Detection

Disabling Anomaly Detection Using the IDM or IME

Disabling Anomaly Detection Using the CLI

Cisco Security Intelligence Operations

Restrictions and Limitations

Caveats

Resolved Caveats

Unresolved Caveats

Related Documentation

Obtaining Documentation, Using the Cisco Bug Search Tool, and Submitting a Service Request

Release Notes for Cisco Intrusion Prevention System 7.1(4)E4

Contents

•IPS File List

•Supported Platforms

•Supported Servers

•ROMMON and TFTP

•IPS Management and Event Viewers

•New and Changed Information

•AC Power Supply in the IPS 4300 Series V01 and V02 Chassis

•The IDM and JRE 1.7

•The Sensor and Jumbo Packet Frame Size

•The ASA IPS Modules and Jumbo Packets

•Obtaining Software

•Upgrading to IPS 7.1(4)E4

•Reimaging the Sensor

•Licensing the Sensor

•Initializing the Sensor

•Logging In to the IDM

•Installing or Upgrading the IME

•Enabling Anomaly Detection

•Disabling Anomaly Detection

•Cisco Security Intelligence Operations

•Restrictions and Limitations

•Caveats

•Related Documentation

•Obtaining Documentation, Using the Cisco Bug Search Tool, and Submitting a Service Request

IPS File List

The following files are part of Cisco IPS 7.1(4)E4:

•Readme

–IPS-7.1-4-E4_readme.txt

•Minor Version Upgrade Files

–IPS-4270_20-K9-7.1-4-E4.pkg

–IPS-4345-K9-7.1-4-E4.pkg

–IPS-4360-K9-7.1-4-E4.pkg

–IPS-SSP_5512-K9-7.1-4-E4.pkg

–IPS-SSP_5515-K9-7.1-4-E4.pkg

–IPS-SSP_5525-K9-7.1-4-E4.pkg

–IPS-SSP_5545-K9-7.1-4-E4.pkg

–IPS-SSP_5555-K9-7.1-4-E4.pkg

–IPS-SSP_10-K9-7.1-4-E4.pkg

–IPS-SSP_20-K9-7.1-4-E4.pkg

–IPS-SSP_40-K9-7.1-4-E4.pkg

–IPS-SSP_60-K9-7.1-4-E4.pkg

•System Image Files

–IPS-4270_20-K9-sys-1.1-a-7.1-4-E4.img

–IPS-4345-K9-sys-1.1-a-7.1-4-E4.img

–IPS-4360-K9-sys-1.1-a-7.1-4-E4.img

–IPS-4510-K9-sys-1.1-a-7.1-4-E4.img

–IPS-4520-K9-sys-1.1-a-7.1-4-E4.img

–IPS-SSP_5512-K9-sys-1.1-a-7.1-4-E4.aip

–IPS-SSP_5515-K9-sys-1.1-a-7.1-4-E4.aip

–IPS-SSP_5525-K9-sys-1.1-a-7.1-4-E4.aip

–IPS-SSP_5545-K9-sys-1.1-a-7.1-4-E4.aip

–IPS-SSP_5555-K9-sys-1.1-a-7.1-4-E4.aip

–IPS-SSP_10-K9-sys-1.1-a-7.1-4-E4.img

–IPS-SSP_20-K9-sys-1.1-a-7.1-4-E4.img

–IPS-SSP_40-K9-sys-1.1-a-7.1-4-E4.img

–IPS-SSP_60-K9-sys-1.1-a-7.1-4-E4.img

•Recovery Image Files

–IPS-4270_20-K9-r-1.1-a-7.1-4-E4.pkg

–IPS-4345-K9-r-1.1-a-7.1-4-E4.pkg

–IPS-4360-K9-r-1.1-a-7.1-4-E4.pkg

–IPS-4510-K9-r-1.1-a-7.1-4-E4.pkg

–IPS-4520-K9-r-1.1-a-7.1-4-E4.pkg

–IPS-SSP_5512-K9-r-1.1-a-7.1-4-E4.pkg

–IPS-SSP_5515-K9-r-1.1-a-7.1-4-E4.pkg

–IPS-SSP_5525-K9-r-1.1-a-7.1-4-E4.pkg

–IPS-SSP_5545-K9-r-1.1-a-7.1-4-E4.pkg

–IPS-SSP_5555-K9-r-1.1-a-7.1-4-E4.pkg

–IPS-SSP_10-K9-r-1.1-a-7.1-4-E4.pkg

–IPS-SSP_20-K9-r-1.1-a-7.1-4-E4.pkg

–IPS-SSP_40-K9-r-1.1-a-7.1-4-E4.pkg

–IPS-SSP_60-K9-r-1.1-a-7.1-4-E4.pkg

Supported Platforms

Cisco IPS 7.1(4)E4 is supported on the following platforms:

•IPS 4270-20

•IPS 4345

•IPS 4360

•IPS 4510

•IPS 4520

•ASA 5512-X IPS SSP

•ASA 5515-X IPS SSP

•ASA 5525-X IPS SSP

•ASA 5545-X IPS SSP

•ASA 5555-X IPS SSP

•ASA 5585-X IPS SSP-10

•ASA 5585-X IPS SSP-20

•ASA 5585-X IPS SSP-40

•ASA 5585-X IPS SSP-60

Supported Servers

The following FTP servers are supported for IPS software updates:

•WU-FTPD 2.6.2 (Linux)

•Solaris 2.8

•Sambar 6.0 (Windows 2000)

•Serv-U 5.0 (Windows 2000)

•MS IIS 5.0 (Windows 2000)

The following HTTP/HTTPS servers are supported for IPS software updates:

•CSM - Apache Server (Tomcat)

•CSM - Apache Server (JRun)

ROMMON and TFTP

ROMMON uses TFTP to download an image and launch it. TFTP does not address network issues such as latency or error recovery. It does implement a limited packet integrity check so that packets arriving in sequence with the correct integrity value have an extremely low probability of error. But TFTP does not offer pipelining so the total transfer time is equal to the number of packets to be transferred times the network average RTT. Because of this limitation, we recommend that the TFTP server be located on the same LAN segment as the sensor. Any network with an RTT less than a 100 milliseconds should provide reliable delivery of the image. Be aware that some TFTP servers limit the maximum file size that can be transferred to ~32 MB.

IPS Management and Event Viewers

Use the following tools for configuring Cisco IPS 7.1(4)E4 sensors:

•Cisco IDM 7.1.4

IDM 7.1.4 is included within the IPS 7.1(4)E4 files.

IDM 7.1.4 is included within IME 7.2.1.

IDM 7.1.4 requires JRE 1.6 or later.

You can use IDM 7.1.4 to configure IPS 6.2, 7.0, and 7.1 sensors.

•Cisco IME 7.2.1

You can use IME 7.2.1 to configure IPS 6.1, 6.2, 7.0, and 7.1 sensors.

•IPS CLI included in IPS 7.1(4)E4.

•Cisco ASDM 6.3.4 and later.

Use the following tools for monitoring Cisco IPS 7.1(4)E4 sensors:

•IDM 7.1.4

•IME 7.2.1

•MARS minimum version 5.2 and latest version 6.0.5

MARS does not support the IPS 4500 series sensors.

•Cisco Security Manager 4.0 and later

Cisco Security Manager 4.0(2) does not support the IPS 4270-20.

Cisco Security Manager 4.3 and later supports the IPS 4500 series sensors.

Note You may need to configure viewers that are already configured to monitor the earlier version sensors to accept a new SSL certificate for the Cisco IPS 7.1 sensors.

New and Changed Information

Cisco IPS 7.1(4)E4 contains the following new and changed information:

•Support for the IPS 4510 and IPS 4520.

•Although IME 7.2.1 supports the new platforms (IPS 4510 and IPS 4520), the online help does not yet reference them.

•Contains signature update S648.

•Continuing support for the IPS 4270-20, IPS 4340, IPS 4360, ASA 5585-X IPS SSP series, and ASA 5500-X IPS SSP series.

AC Power Supply in the IPS 4300 Series V01 and V02 Chassis

The Cisco IPS 4300 series sensors with the AC power supply can restore the previous power state of the system if AC power is lost. Earlier IPS 4300s (V01) require you to turn on the power with the power switch. Newer IPS 4300s (V02) automatically turn on when you plug in the power cable.

To determine your version, do one of the following:

•At the CLI, enter the show inventory command and look for V01 or V02 in the output.

•On the back of the chassis, look at the VID PID label for V01 or V02.

The V01 chassis has the following limitations (these limitations do not apply to the V02 chassis):

•The sensor requires 50 seconds from the time that AC power is applied before the power state can be updated and stored. This means that any changes to the power state within the first 50 seconds of applying AC power will not be observed if AC power is removed within that time.

•The sensor requires 10 seconds from the time it is placed into standby mode before the power state can be updated and stored. This means any changes to the power state within the first 10 seconds of entering standby mode (including the standby mode itself) will not be observed if AC power is removed within that time.

For More Information

For information on the AC power supplies in the IPS 4300 series sensors, refer to Installing the IPS 4345 and IPS 4360.

The IDM and JRE 1.7

In IPS versions 7.1(1)E4 through 7.1(5)E4, the IDM fails to connect to the sensor due to a failure during the initial handshake, because the web server is not RFC 5746-compliant. Try the following workaround.

Problem   Cannot launch the IDM, when the IDM is running under JRE 1.7 with IPS 7.1(1)E4 through 7.1(5)E4.

Solution   Use JRE 1.6 or enable the SSL 2.0-compatible ClientHello format in the Java settings under Control Panel.

The Sensor and Jumbo Packet Frame Size

For IPS standalone appliances with 1 G and 10 G fixed or add-on interfaces, the maximum jumbo frame size is 9216 bytes. For integrated IPS sensors, such as the ASA 5500-X and ASA 5585-X series, refer to the following URL for information:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/interface_start.html#wp1328869

Note A jumbo frame is an Ethernet packet that is larger than the standard maximum of 1518 bytes (including Layer 2 header and FCS).

The ASA IPS Modules and Jumbo Packets

The jumbo packet count in the show interface command output from the lines and for ASA IPS modules may be larger than expected due to some packets that were almost jumbo size on the wire being counted as jumbo size by the IPS. This miscount is a result of header bytes added to the packet by the ASA before the packet is transmitted to the IPS. For IPv4, 58 bytes of header data are added. For IPv6, 78 bytes of header data are added. The ASA removes the added IPS header before the packet leaves the ASA.

Obtaining Software

You can find major and minor updates, service packs, signature and signature engine updates, system and recovery files, firmware upgrades, and Readmes on the Download Software site on Cisco.com. Signature updates are posted to Cisco.com approximately every week, more often if needed. Service packs are posted to Cisco.com in a release train format, a new release every three months. Major and minor updates are also posted periodically. Check Cisco.com regularly for the latest IPS software.

You must have an account with cryptographic access before you can download software. You set this account up the first time you download IPS software from the Download Software site.

Note You must be logged in to Cisco.com to download software. You must have an active IPS maintenance contract and a Cisco.com password to download software. You must have a sensor license to apply signature updates.

Downloading Cisco IPS Software

To download software on Cisco.com, follow these steps:

Step 1 Log in to Cisco.com.

Step 2 From the Support drop-down menu, choose Download Software.

Step 3 Under Select a Software Product Category, choose Security Software.

Step 4 Choose Intrusion Prevention System (IPS).

Step 5 Enter your username and password.

Step 6 In the Download Software window, choose IPS Appliances > Cisco Intrusion Prevention System and then click the version you want to download.

Note You must have an IPS subscription service license to download software.

Step 7 Click the type of software file you need. The available files appear in a list in the right side of the window. You can sort by file name, file size, memory, and release date. And you can access the Release Notes and other product documentation.

Step 8 Click the file you want to download. The file details appear.

Step 9 Verify that it is the correct file, and click Download.

Step 10 Click Agree to accept the software download rules. The File Download dialog box appears. The first time you download a file from Cisco.com, you must fill in the Encryption Software Export Distribution Authorization form before you can download the software.

a. Fill out the form and click Submit. The Cisco Systems Inc. Encryption Software Usage Handling and Distribution Policy appears.

b. Read the policy and click I Accept. The Encryption Software Export/Distribution Form appears.

If you previously filled out the Encryption Software Export Distribution Authorization form, and read and accepted the Cisco Systems Inc. Encryption Software Usage Handling and Distribution Policy, these forms are not displayed again.

Step 11 Open the file or save it to your computer.

Step 12 Follow the instructions in the Readme or the Release Notes to install the update.

Upgrading to IPS 7.1(4)E4

This section describes how to upgrade the IPS 4270-20, IPS 4340, IPS 4360, ASA 5500-X IPS SSP series, and the ASA 5585-X IPS SSP series, and contains the following topics:

•Upgrade Notes and Caveats

•Upgrading the Sensor

Upgrade Notes and Caveats

Pay attention to the following upgrade notes and caveats when upgrading to IPS 7.1(4)E4:

•If you are upgrading the IPS 4270-20 and you have a license for 6.0.x and earlier, you receive the following error message:

You must get a new license before upgrading your IPS 4270-20.

•Anomaly detection has been disabled by default. If you did not configure the operation mode manually before the upgrade, it defaults to inactive after you upgrade to IPS 7.1(4)E4. If you configured the operation mode to detect, learn, or inactive, the tuned value is preserved after the upgrade.

•After you upgrade any IPS software on your sensor, you must restart the IDM to see the latest software features.

•You must have a valid maintenance contract per sensor to download software upgrades from Cisco.com.

•For the ASA 5585-X IPS SSP series, you must be running IPS 7.1(1)E4 or later to upgrade to IPS 7.1(4)E4. For the IPS 4270-20, you must be running IPS 6.0(6) or later. For the IPS 4340, IPS 4360, and the ASA 5500-X IPS SSP series, you must be running IPS 7.1(3)E4.

•This service pack automatically reboots the sensor to apply the changes. During reboot, inline network traffic is disrupted.

•You cannot uninstall 7.1(4)E4. To revert to a previous version, you must reimage the sensor using the appropriate system image file

For More Information

•For the procedure to download software from Cisco.com, see Obtaining Software.

•For the procedure for using the upgrade command to upgrade the sensor, see Upgrading the Sensor.

•For the procedure for using ROMMON to restore the IPS 4270-20 system image, see Installing the IPS 4270-20 System Image.

•For the procedure for installing the ASA 5500-X IPS SSP system image, see Installing the ASA 5500-X IPS SSP System Image.

•For the procedure for installing the ASA 5585-X IPS SSP system image, see Installing the ASA 5585-X IPS SSP System Image.

Upgrading the Sensor

Use the upgradesource-url command to apply service pack, signature update, engine update, minor version, major version, or recovery partition file upgrades. The following options apply:

•source-url—Specifies the location of the source file to be copied:

–ftp:—Source URL for an FTP network server. The syntax for this prefix is:

ftp://[[username@]location][/relativeDirectory]/filename

ftp://[[username@]location][//absoluteDirectory]/filename

Note You are prompted for a password.

–scp:—Source URL for the SCP network server. The syntax for this prefix is:

scp://[[username@]location][/relativeDirectory]/filename

scp://[[username@]location][//absoluteDirectory]/filename

Note You are prompted for a password. You must add the remote host to the SSH known hosts list.

–http:—Source URL for the web server. The syntax for this prefix is:

http://[[username@]location][/directory]/filename

Note The directory specification should be an absolute path to the desired file.

–https:—Source URL for the web server. The syntax for this prefix is:

https://[[username@]location][/directory]/filename

Note The directory specification should be an absolute path to the desired file. The remote host must be a TLS trusted host.

Upgrading the Sensor

To upgrade the sensor, follow these steps:

Step 1 Download the appropriate file to an FTP, SCP, HTTP, or HTTPS server that is accessible from your sensor.

Step 2 Log in to the CLI using an account with administrator privileges.

Step 3 Enter configuration mode.

Step 4 Upgrade the sensor.

The URL points to where the update file is located, for example, to retrieve the update using FTP, enter the following:

Step 5 Enter the password when prompted.

Step 6 Enter yes to complete the upgrade.

Note Major updates, minor updates, and service packs may force a restart of the IPS processes or even force a reboot of the sensor to complete installation.

Note The operating system is reimaged and all files that have been placed on the sensor through the service account are removed.

Step 7 Verify your new sensor version.

For More Information

For a list of the specific IPS upgrade filenames, see IPS File List.

Reimaging the Sensor

This section describes how to reimage the sensor using the system image, and contains the following topics:

•Installing the IPS 4270-20 System Image

•Installing the IPS 4345 and IPS 4360 System Image

•Installing the IPS 4510 and IPS 4520 System Image

•Installing the ASA 5500-X IPS SSP System Image

•Installing the ASA 5585-X IPS SSP System Image

Installing the IPS 4270-20 System Image

You can install the IPS 4270-20 system image by using the ROMMON on the appliance to TFTP the system image onto the compact flash device.

To install the IPS 4270-20 system image, follow these steps:

Step 1 Download the IPS 4270-20 system image file to the tftp root directory of a TFTP server that is accessible from your IPS 4270-20.

Note Make sure you can access the TFTP server location from the network connected to the Ethernet port of your IPS 4270-20.

Step 2 Boot the IPS 4270-20.

Note The controller type errors are a known issue and can be disregarded.

Step 3 Press Break or Esc at the following prompt while the system is booting to interrupt boot. Press the spacebar to begin boot immediately.

Note You have ten seconds to press Break or Esc.

The system enters ROMMON mode. The prompt appears.

Step 4 Check the current network settings.

The variables have the following definitions:

•Address—Specifies the local IP address of the IPS 4270-20.

•Server—Specifies the TFTP server IP address where the application image is stored.

•Gateway—Specifies the gateway IP address used by the IPS 4270-20.

•Port—Specifies the Ethernet interface used for IPS 4270-20 management.

•VLAN—Specifies the VLAN ID number (leave as untagged).

•Image—Specifies the system image file/path name.

•Config—Unused by these platforms.

Note Not all values are required to establish network connectivity. The address, server, gateway, and image values are required. If you are not sure of the settings needed for your local environment, contact your system administrator.

Step 5 If necessary, assign an IP address for the local port on the IPS 4270-20.

Note Use the same IP address that is assigned to the IPS 4270-20.

Step 6 If necessary, assign the TFTP server IP address.

Step 7 If necessary, assign the gateway IP address.

Step 8 Verify that you have access to the TFTP server by pinging it from your local Ethernet port with one of the following commands:

Step 9 If necessary define the path and filename on the TFTP file server from which you are downloading the image.

UNIX Example

Note The path is relative to the UNIX TFTP server default tftpboot directory. Images located in the default tftpboot directory do not have any directory names or slashes in the IMAGE specification.

Windows Example

Step 10 Enter set and press Enter to verify the network settings.

Note You can use the sync command to store these settings in NVRAM so they are maintained across boots. Otherwise, you must enter this information each time you want to boot an image from ROMMON.

Step 11 Download and install the system image.

Caution To avoid corrupting the system image, do not remove power from the IPS 4270-20 while the system image is being installed.

Note If the network settings are correct, the system downloads and boots the specified image on the IPS 4270-20. Be sure to use the IPS 4270-20 image.

For More Information

•For the procedure for locating software, see Obtaining Software.

•For a list of supported TFTP servers, see Supported Servers.

•For a list of the specific IPS software files, see IPS File List.

•For the procedure for initializing the sensor with the setup command, see Initializing the Sensor.

Installing the IPS 4345 and IPS 4360 System Image

You can install the IPS 4345 and IPS 4360 system image by using the ROMMON on the appliance to TFTP the system image on to the compact flash device.

Note This procedure is for IPS 4345, but is also applicable to IPS 4360. The system image for IPS 4360 has "4360" in the filename.

To install the IPS 4345 and IPS 4360 system image, follow these steps:

Step 1 Download the IPS 4345 system image file to the tftp root directory of a TFTP server that is accessible from your IPS 4345.

Note Make sure you can access the TFTP server location from the network connected to the Ethernet port of your IPS 4345.

Step 2 Boot the IPS 4345.

Step 3 Press Break or Esc at the following prompt while the system is booting to interrupt boot. Press the spacebar to begin boot immediately.

Note You have ten seconds to press Break or Esc.

The system enters ROMMON mode. The prompt appears.

Step 4 Check the current network settings.

The variables have the following definitions:

•Address—Local IP address of the IPS 4345.

•Server—TFTP server IP address where the application image is stored.

•Gateway—Gateway IP address used by the IPS 4345.

•Port—Ethernet interface used for the IPS 4345 management.

•VLAN—VLAN ID number (leave as untagged).

•Image—System image file/path name.

•Config—Unused by these platforms.

Note Not all values are required to establish network connectivity. The address, server, gateway, and image values are required. If you are not sure of the settings needed for your local environment, contact your system administrator.

Step 5 If necessary, change the interface used for the TFTP download.

Note The default interface used for TFTP downloads is Management 0/0, which corresponds to the MGMT interface of the IPS 4345.

Step 6 If necessary, assign an IP address for the local port on the IPS 4345.

Note Use the same IP address that is assigned to the IPS 4345.

Step 7 Assign the TFTP server IP address.

Step 8 If necessary, assign the gateway IP address.

Step 9 Verify that you have access to the TFTP server by pinging it from your local Ethernet port with one of the following commands:

Step 10 If necessary define the path and filename on the TFTP file server from which you are downloading the image.

Caution Make sure that you enter the IMAGE command in all uppercase. You can enter the other ROMMON commands in either lower case or upper case, but the IMAGE command specifically must be all uppercase.

UNIX Example

Note The path is relative to the default tftpboot directory of the UNIX TFTP server. Images located in the default tftpboot directory do not have any directory names or slashes in the IMAGE specification.

Windows Example

Step 11 Enter set and press Enter to verify the network settings.

Note You can use the sync command to store these settings in NVRAM so they are maintained across boots. Otherwise, you must enter this information each time you want to boot an image from ROMMON.

Step 12 Download and install the system image.

Caution To avoid corrupting the system image, do not remove power from the IPS 4345 while the system image is being installed.

Note If the network settings are correct, the system downloads and boots the specified image on the IPS 4345. Be sure to use the IPS 4345 image.

For More Information

•For the procedure for locating software, see Obtaining Software.

•For a list of supported TFTP servers, see Supported Servers.

•For a list of the specific IPS software files, see IPS File List.

•For the procedure for initializing the sensor with the setup command, see Initializing the Sensor.

Installing the IPS 4510 and IPS 4520 System Image

You can install the IPS 4510 and IPS 4520 system image by using the ROMMON on the appliance to TFTP the system image onto the compact flash device.

Note The following procedure references the IPS 4510 but it also refers to the IPS 4520.

To install the IPS 4510 system image, follow these steps:

Step 1 Download the IPS 4510 system image file to the tftp root directory of a TFTP server that is accessible from your IPS 4510.

Note Make sure you can access the TFTP server location from the network connected to the Management port of your IPS 4510.

Step 2 Boot the IPS 4510.

Step 3 Press Break or Esc at the following prompt while the system is booting to interrupt boot. Press the spacebar to begin boot immediately.