Transcription
Release Notes for Cisco Intrusion PreventionSystem 6.1(1)E2Published: June 22, 2008, OL-19696-01Revised: August 1, 2012Contents IPS 6.1(1)E2 File List, page 2 Supported Platforms, page 3 Supported Servers, page 3 ROMMON and TFTP, page 3 IPS Management and Event Viewers, page 4 Cisco Security Intelligence Operations, page 4 New and Changed Information, page 5 MySDN Decommissioned, page 6 Before Upgrading to Cisco IPS 6.1(1)E2, page 6 Upgrading to Cisco IPS 6.1(1) E2, page 14 After Upgrading to Cisco IPS 6.1(1)E2, page 18 Installing Cisco IME, page 24 Restrictions and Limitations, page 25 Recovering the Password, page 26 Caveats, page 34 Related Documentation, page 37 Obtaining Documentation and Submitting a Service Request, page 38Americas Headquarters:Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA 2006-2012 Cisco Systems, Inc. All rights reserved.
IPS 6.1(1)E2 File ListCautionThe BIOS on Cisco IPS sensors is specific to Cisco IPS sensors and must only be upgraded underinstructions from Cisco with BIOS files obtained from the Cisco website. Installing a non-Cisco orthird-party BIOS on Cisco IPS sensors voids the warranty.IPS 6.1(1)E2 File ListThe following files are part of Cisco IPS 6.1(1)E2: Readme File– IPS-6.1-1-E2.readme.txt Minor Version Upgrade File– IPS-K9-6.1-1-E2.pkg– IPS-AIM-K9-6.1-1-E2.pkg System Image Files– IPS-4240-K9-sys-1.1-a-6.1-1-E2.img– IPS-4255-K9-sys-1.1-a-6.1-1-E2.img– IPS-4260-K9-sys-1.1-a-6.1-1-E2.img– IPS-4270 20-K9-sys-1.1-a-6.1-1-E2.img– IPS-AIM-K9-sys-1.1-a-6.1-1-E2.img– IPS-IDSM2-K9-sys-1.1-a-6.1-1-E2.bin.gz– IPS-SSM 10-K9-sys-1.1-a-6.1-1-E2.img– IPS-SSM 20-K9-sys-1.1-a-6.1-1-E2.img– IPS-SSM 40-K9-sys-1.1-a-6.1-1-E2.img Recovery Image Files– IPS-K9-r-1.1-a-6.1-1-E2.pkg– IPS-AIM-K9-r-1.1-a-6.1-1-E2.pkg E2 Signature Engine Update Files– IPS-engine-E2-req-6.1-1.pkgFor More InformationFor the procedure for obtaining IPS software, see Obtaining Software on Cisco.com, page 9.Release Notes for Cisco Intrusion Prevention System 6.1(1)E22OL-19696-01
Supported PlatformsSupported PlatformsNoteAll IPS platforms allow ten concurrent log in sessions.Cisco IPS 6.1(1)E2 is supported on the following platforms: IPS 4240 Series Sensor Appliances IPS 4255 Series Sensor Appliances IPS 4260 Series Sensor Appliances IPS 4270-20 Series Sensor Appliances WS-SVC-IDSM2 series Intrusion Detection System Module (IDSM2) ASA-SSM-AIP-10 series Cisco ASA Advanced Inspection and Prevention Security ServiceModules (AIP SSM-10) ASA-SSM-AIP-20 series Cisco ASA Advanced Inspection and Prevention Security ServiceModules (AIP SSM-20) ASA-SSM-AIP-40 series Cisco ASA Advanced Inspection and Prevention Security ServiceModules (AIP SSM-40) Intrusion Prevention System Advanced Integration Module (AIM IPS)Supported ServersThe following FTP servers are supported for IPS software updates: WU-FTPD 2.6.2 (Linux) Solaris 2.8 Sambar 6.0 (Windows 2000) Serv-U 5.0 (Windows 2000) MS IIS 5.0 (Windows 2000)The following HTTP/HTTPS servers are supported for IPS software updates: CMS - Apache Server (Tomcat) CMS - Apache Server (JRun)ROMMON and TFTPROMMON uses TFTP to download an image and launch it. TFTP does not address network issues suchas latency or error recovery. It does implement a limited packet integrity check so that packets arrivingin sequence with the correct integrity value have an extremely low probability of error. But TFTP doesnot offer pipelining so the total transfer time is equal to the number of packets to be transferred timesthe network average RTT. Because of this limitation, we recommend that the TFTP server be located onthe same LAN segment as the sensor. Any network with an RTT less than a 100 milliseconds shouldprovide reliable delivery of the image. Be aware that some TFTP servers limit the maximum file size thatcan be transferred to 32 MB.Release Notes for Cisco Intrusion Prevention System 6.1(1)E2OL-19696-013
IPS Management and Event ViewersFor More Information For the procedure for downloading IPS software updates from Cisco.com, see Obtaining Softwareon Cisco.com, page 9. For the procedure for configuring automatic updates, for the CLI refer to Configuring AutomaticUpdates, for IDM refer to Configuring Automatic Upgrade, and for IME refer to ConfiguringAutomatic Update.IPS Management and Event ViewersUse the following tools for configuring Cisco IPS 6.1(1)E2 sensors: Cisco IDM 6.1 Cisco IME 6.1 IPS CLI 6.1 ASDM 5.2 and above CSM 3.2Use the following tools for monitoring Cisco IPS 6.1(1)E2 sensors: Cisco IME 6.1 MARS 4.2 and 4.3(1) CSM 4.0NoteViewers that are already configured to monitor the Cisco IPS 6.0 sensors may need to beconfigured to accept a new SSL certificate for the Cisco IPS 6.1(1) sensors.Cisco Security Intelligence OperationsThe Cisco Security Intelligence Operations site on Cisco.com provides intelligence reports about currentvulnerabilities and security threats. It also has reports on other security topics that help you protect yournetwork and deploy your security systems to reduce organizational risk.You should be aware of the most recent security threats so that you can most effectively secure andmanage your network. Cisco Security Intelligence Operations contains the top ten intelligence reportslisted by date, severity, urgency, and whether there is a new signature available to deal with the threat.Cisco Security Intelligence Operations contains a Security News section that lists security articles ofinterest. There are related security tools and links.You can access Cisco Security Intelligence Operations at this isco Security Intelligence Operations is also a repository of information for individual signatures,including signature ID, type, structure, and description.You can search for security alerts and signatures at this xRelease Notes for Cisco Intrusion Prevention System 6.1(1)E24OL-19696-01
New and Changed InformationNew and Changed InformationCisco IPS 6.1(1)E2 includes the following new features: IPS sensor enhancements– Automatic signature updates from Cisco.com– Sensor and security health statistics– Simplified initialization using the setup command– Unauthenticated NTP– Improved upgrade status information– Support of inline asymmetric traffic– Password integrity service Cisco Intrusion Prevention System Manager Express (IME)– Real-time and historical events monitoring– Health-monitoring console– Integrated configuration– Customizable dashboards– Tools (ping, traceroute, whois, DNS lookup)– RSS feeds– Video help– Reporting Enhanced IDM– Startup wizard– Health monitoring improvements– Customizable dashboards– Improved policy and signature tables– User interface performance improvements In earlier 6.0 releases, a manual workaround was available to support inline asymmetric traffic. Inthe IPS 6.1(1)E1 release, you can enable inline asymmetric traffic using the CLI or IDM. If you usedthe workaround to enable asymmetric traffic, remove the manual setting in the CLI, and reenableasymmetric traffic.NoteIf you do not remove the manual entry in the sensorApp.conf file, you will receive thefollowing main.log warning each time you reboot the sensor: NormalizerSettings insensorApp.conf (AsynchMode and AsymmetricFlows) have been removed. Use ServiceAnalysisEngine - VS - inline-TCP-evasion-protection-mode. The legacy RDEP Event Server, used by IDS versions 4.x to communicate events, is not enabled bydefault in this release. You can enable RDEP Event Server subscriptions in IDM or IME. Werecommend you migrate to SDEE/CIDEE because the RDEP Event Server is not supported in futurereleases.Release Notes for Cisco Intrusion Prevention System 6.1(1)E2OL-19696-015
MySDN Decommissioned The S339 signature update is a built in to the E2 engine update. You cannot download S399separately. The E2 engine update contains the following new and changed engines:– P2P engine—The existing Peer-to-Peer signatures have been organized in to a dedicated,optimized engine that lets the sensor monitor all 65, 536 ports in both the TPC and UDPprotocols for peer-to-peer traffic. The P2P engine is enabled by default and because of theimplementation style of this engine, you cannot create custom P2P signatures.– Fixed Depth All Ports Inspection engine—A series of new engines similar to the String TCPengine has been developed to provide a more optimized approach to monitoring all ports. Thefixed inspection engines—Fixed TPC, Fixed UDP, and Fixed ICMP—provide monitoring for allports (TCP and UDP) by default. They inspect traffic in a stream mode per AaBb tuple to amaximum of 250 bytes in both directions, that is, 250 bytes to service and 250 bytes fromservice. The service ports option describes the ports for which you do not want to generatealerts. Inspection still occurs, but alerts are suppressed for these ports defined per signature.– Service Generic engine—This engine has been enhanced to support TCP stream processing,which lets the Cisco signature team provide increased, higher fidelity support for protocolanalysis signatures when a dedicated engine does not already exist.– Meta engine—The Meta engine now uses an OR operator and nesting, which allows complexAND/OR combination to be used in the Meta signature logic.MySDN DecommissionedBecause MySDN has been decommissioned, the URL in older versions of IDM and IME is no longerfunctional. If you are using IPS 6.0 or later, we recommend that you upgrade your version of IDM andIME.You can upgrade to the following versions to get the functioning MySDN URL: IDM 7.0.3 IME 7.0.3 IPS 7.0(4), which contains IDM 7.0.4If you are using version IPS 5.x, you must look up signature information manually at this xFor More InformationFor detailed information on MySDN, for IDM refer to MySDN, and for IME refer to MySDN.Before Upgrading to Cisco IPS 6.1(1)E2This section describes the actions you should take before upgrading to Cisco IPS 6.1(1) E2. It containsthe following topics: Perform These Tasks, page 7 Backing Up and Restoring the Configuration File Using a Remote Server, page 7 Obtaining Software on Cisco.com, page 9Release Notes for Cisco Intrusion Prevention System 6.1(1)E26OL-19696-01
Before Upgrading to Cisco IPS 6.1(1)E2 IPS Software Versioning, page 10 Software Release Examples, page 13Perform These TasksBefore you upgrade your sensors to Cisco IPS 6.1(1) E2, make sure you perform the following tasks: Make sure you have a valid Cisco Service for IPS service contract per sensor so that you can applysoftware upgrades. Created a backup copy of your configuration. Saved the output of the show version command.I f you need to downgrade a signature update, you will know what version you had, and you can thenapply the configuration you saved when you backed up your configuration.NoteTo apply the E2 engine update, you must have version 6.1(1)E1 installed on your sensor. If you need toupgrade your system, consider installing the 6.1(1)E2 minor update, which eliminates the need for theE2 engine update because the E2 functionality is built in to the minor update.For More Information For more information on how to obtain a valid Cisco Service for IPS service contract, see ServicePrograms for IPS Products, page 20. For the procedure for creating a backup copy of your configuration, see Backing Up and Restoringthe Configuration File Using a Remote Server, page 7. For the procedure for finding your Cisco IPS software version, for the CLI refer to DisplayingVersion Information, for IDM refer to IDM Home Window, and for IME refer to Sensor InformationGadget. For the procedure for downgrading signature updates on your sensor, refer to Upgrading,Downgrading, and Installing System Images.Backing Up and Restoring the Configuration File Using a Remote ServerNoteWe recommend copying the current configuration file to a remote server before upgrading.Use the copy [/erase] source url destination url keyword command to copy the configuration file to aremote server. You can then restore the current configuration from the remote server. You are promptedto back up the current configuration first.OptionsThe following options apply: /erase—Erases the destination file before copying.This keyword only applies to the current-config; the backup-config is always overwritten. If thiskeyword is specified for destination current-config, the source configuration is applied to the systemdefault configuration. If it is not specified for the destination current-config, the sourceconfiguration is merged with the current-config.Release Notes for Cisco Intrusion Prevention System 6.1(1)E2OL-19696-017
Before Upgrading to Cisco IPS 6.1(1)E2 source url—The location of the source file to be copied. It can be a URL or keyword. destination url—The location of the destination file to be copied. It can be a URL or a keyword. current-config—The current running configuration. The configuration becomes persistent as thecommands are entered. backup-config—The storage location for the configuration backup.The exact format of the source and destination URLs varies according to the file. Here are the validtypes: ftp:—Source or destination URL for an FTP network server. The syntax for this prefix is:ftp:[//[username@] ame@]location]//absoluteDirectory]/filename scp:—Source or destination URL for the SCP network server. The syntax for this prefix is:scp:[//[username@] ame@] location]//absoluteDirectory]/filenameNote If you use FTP or SCP protocol, you are prompted for a password. If you use SCP protocol,you must also add the remote host to the SSH known hosts list.http:—Source URL for the web server. The syntax for this prefix e https:—Source URL for the web server. The syntax for this prefix meNoteCautionHTTP and HTTPS prompt for a password if a username is required to access the website. Ifyou use HTTPS protocol, the remote host must be a TLS trusted host.Copying a configuration file from another sensor may result in errors if the sensing interfaces and virtualsensors are not configured the same.Backing Up the Current Configuration to a Remote ServerTo back up your current configuration to a remote server, follow these steps:Step 1Log in to the CLI using an account with administrator privileges.Step 2Back up the current configuration to the remote server.sensor# copy current-config scp://user@192.0.2.0//configuration/cfg current-configPassword: ********Warning: Copying over the current configuration may leave the box in an unstable state.Would you like to copy current-config to backup-config before proceeding? [yes]:Step 3Enter yes to copy the current configuration to a backup configuration.cfg100% ************************************************ 3612400:00Release Notes for Cisco Intrusion Prevention System 6.1(1)E28OL-19696-01
Before Upgrading to Cisco IPS 6.1(1)E2Restoring the Current Configuration From a Backup FileTo restore your current configuration from a backup file, follow these steps:Step 1Log in to the CLI using an account with administrator privileges.Step 2Back up the current configuration to the remote server.sensor# copy scp://user@192.0.2.0//configuration/cfg current-configPassword: ********Warning: Copying over the current configuration may leave the box in an unstable state.Would you like to copy current-config to backup-config before proceeding? [yes]:Step 3Enter yes to copy the current configuration to a backup configuration.cfg100% ************************************************ 3612400:00Warning: Replacing existing network-settings may leave the box in an unstable state.Would you like to replace existing network t) on sensor before proceeding? [no]:sensor#Step 4Enter no to retain the currently configured hostname, IP address, subnet mask, management interface,and access list. We recommend you retain this information to preserve access to your sensor after therest of the configuration has been restored.For More InformationFor the procedure for adding trusted hosts, for the CLI refer to Adding TLS Trusted Hosts, for IDM referto Adding Trusted Hosts, and for IME refer to Adding Trusted Hosts.Obtaining Software on Cisco.comYou can find major and minor updates, service packs, signature and signature engine updates, systemand recovery files, firmware upgrades, and readmes on the Download Software site on Cisco.com.Signature updates are posted to Cisco.com approximately every week, more often if needed. Servicepacks are posted to Cisco.com as needed. Major and minor updates are also posted periodically. CheckCisco.com regularly for the latest IPS software.NoteYou must be logged in to Cisco.com to download software. You must have an active IPS maintenancecontract and a Cisco.com password to download software. You must have a license to apply signatureupdates.Downloading IPS SoftwareTo download software on Cisco.com, follow these steps:Step 1Log in to Cisco.com.Step 2From the Support drop-down menu, choose Download Software.Step 3Under Select a Software Product Category, choose Security Software.Step 4Choose Intrusion Prevention System (IPS).Step 5Enter your username and password.Release Notes for Cisco Intrusion Prevention System 6.1(1)E2OL-19696-019
Before Upgrading to Cisco IPS 6.1(1)E2Step 6In the Download Software window, choose IPS Appliances Cisco Intrusion Prevention System andthen click the version you want to download.NoteYou must have an IPS subscription service license to download software.Step 7Click the type of software file you need. The available files appear in a list in the right side of thewindow. You can sort by file name, file size, memory, and release date. And you can access the ReleaseNotes and other product documentation.Step 8Click the file you want to download. The file details appear.Step 9Verify that it is the correct file, and click Download.Step 10Click Agree to accept the software download rules.The first time you download a file from Cisco.com, you must fill in the Encryption Software ExportDistribution Authorization form before you can download the software. Fill out the form and click Submit. The Cisco Systems Inc. Encryption Software Usage Handlingand Distribution Policy appears. Read the policy and click I Accept. The Encryption Software Export/Distribution Form appears.If you previously filled out the Encryption Software Export Distribution Authorization form, and readand accepted the Cisco Systems Inc. Encryption Software Usage Handling and Distribution Policy, theseforms are not displayed again. The File Download dialog box appears.Step 11Open the file or save it to your computer.Step 12Follow the instructions in the Readme to install the update.NoteMajor and minor updates, service packs, recovery files, signature and signature engine updatesare the same for all sensors. System image files are unique per platform.IPS Software VersioningWhen you download IPS software images from Cisco.com, you should understand the versioningscheme so that you know which files are base files, which are cumulative, and which are incremental.Major UpdateA major update contains new functionality or an architectural change in the product. For example, theCisco IPS 6.0 base version includes everything (except deprecated features) since the previous majorrelease (the minor update features, service pack fixes, and signature updates) plus any new changes.Major update 6.0(1) requires 5.x. With each major update there are corresponding system and recoverypackages.NoteThe 6.0(1) major update is only used to upgrade 5.x sensors to 6.0(1). If you are reinstalling 6.0(1) on asensor that already has 6.0(1) installed, use the system image or recovery procedures rather than themajor update.Release Notes for Cisco Intrusion Prevention System 6.1(1)E210OL-19696-01
Before Upgrading to Cisco IPS 6.1(1)E2Minor UpdateA minor update is incremental to the major version. Minor updates are also base versions for servicepacks. The first minor update for 6.0 is 6.1(1). Minor updates are released for minor enhancements tothe product. Minor updates contain all previous minor features (except deprecated features), service packfixes, signature updates since the last major version, and the new minor features being released. You caninstall the minor updates on the previous major or minor version (and often even on earlier versions).The minimum supported version needed to upgrade to the newest minor version is listed in the Readmethat accompanies the minor update. With each minor update there are corresponding system andrecovery packages.Service PackA service pack is cumulative following a base version release (minor or major). Service packs are usedfor the release of defect fixes with no new enhancements. Service packs contain all service pack fixessince the last base version (minor or major) and the new defect fixes being released. Service packsrequire the minor version. The minimum supported version needed to upgrade to the newest service packis listed in the Readme that accompanies the service pack. Service packs also include the latest engineupdate. For example, if service pack 6.0(3) is released, and E3 is the latest engine level, the service packis released as 6.0(3)E3.Patch ReleaseA patch release is used to address defects that are identified in the upgrade binaries after a softwarerelease. Rather than waiting until the next major or minor update, or service pack to address thesedefects, a patch can be posted. Patches include all prior patch releases within the associated service packlevel. The patches roll in to the next official major or minor update, or service pack.Before you can install a patch release, the most recent major or minor update, or service pack must beinstalled. For example, patch release 5.0(1p1) requires 5.0(1).NoteUpgrading to a newer patch does not require you to uninstall the old patch. For example, you can upgradefrom patch 5.0(1p1) to 5.0(1p2) without first uninstalling 5.0(1p1).Figure 1 illustrates what each part of the IPS software file represents for major and minor updates,service packs, and patch releases.Figure 1IPS Software File Name for Major and Minor Updates, Service Packs, and PatchReleasesIPS-K9-x.y-z[a or p1]-E1.pkgProduct line/platform designatorStrong crypto designatorMajor version levelMinor version levelService pack levelRepackage levelSignature engine levelFile extension191013Patch levelRelease Notes for Cisco Intrusion Prevention System 6.1(1)E2OL-19696-0111
Before Upgrading to Cisco IPS 6.1(1)E2Signature UpdateA signature update is a package file containing a set of rules designed to recognize malicious networkactivities. Signature updates are released independently from other software updates. Each time a majoror minor update is released, you can install signature updates on the new version and the next oldestversion for a period of at least six months. Signature updates are dependent on a required signatureengine version. Because of this, a req designator lists the signature engine required to support aparticular signature update.Figure 2 illustrates what each part of the IPS software file represents for signature updates.Figure 2IPS Software File Name for Signature UpdatesIPS-[sig]-[S]-req-E1.pkgProduct line designatorPackage typeSignature update191014Software version requirement designatorRequired engine versionFile extensionSignature Engine UpdateA signature engine update is an executable file containing binary code to support new signature updates.Signature engine files require a specific service pack, which is also identified by the req designator.Figure 3 illustrates what each part of the IPS software file represents for signature engine updates.Figure 3IPS Software File Name for Signature Engine UpdatesIPS-[engine]-[E]-req-x.y-z.pkgProduct line designatorPackage typeSignature engine levelRequired software versionFile extension191861Software version requirement designatorRecovery and System Image FilesRecovery and system image files contain separate versions for the installer and the underlyingapplication. The installer version contains a major and minor version field. The major version isincremented by one of any major changes to the image installer, for example, switching from .tar to rpmor changing kernels. The minor version can be incremented by any one of the following: Minor change to the installer, for example, a user prompt added. Repackages require the installer minor version to be incremented by one if the image file must berepackaged to address a defect or problem with the installer.Release Notes for Cisco Intrusion Prevention System 6.1(1)E212OL-19696-01
Before Upgrading to Cisco IPS 6.1(1)E2Figure 4 illustrates what each part of the IPS software file represents for recovery and system image files.Figure 4IPS Software File Name for Recovery and System Image FilesIPS-K9-[mfq,sys,r,]-x.y-a-* .img or pkgProduct line/platform designatorStrong crypto designatorPackage typeInstaller major versionInstaller minor versionApplication version designator191015Application versionFile extensionSoftware Release ExamplesTable 1 lists platform-independent Cisco IPS 6.x software release examples. Refer to the Readmes thataccompany the software files for detailed instructions on how to install the files.Table 1Platform-Independent Release mple FilenameWeeklysigS700IPS-sig-S700-req-E1.pkgAs allyor as needed—6.1(3)IPS-K9-6.1-3-E1.pkgMinor version ly—6.0(1)IPS-K9-6.0-1-E1.pkgAs ally or aseSignature update1Signature engine updateService packs3Major version updatePatch release6Recovery package721. Signature updates include the latest cumulative IPS signatures.2. Signature engine updates add new engines or engine parameters that are used by new signatures in later signature updates.3. Service packs include defect fixes.4. Minor versions include new minor version features and/or minor version functionality.5. Major versions include new major version functionality or new architecture.6. Patch releases are for interim fixes.7. The r 1.1 can be revised to r 1.2 if it is necessary to release a new recovery package that contains the same underlyingapplication image. If there are defect fixes for the installer, for example, the underlying application version may still be 6.0(1),but the recovery partition image will be r 1.2.Release Notes for Cisco Intrusion Prevention System 6.1(1)E2OL-19696-0113
Upgrading to Cisco IPS 6.1(1) E2Table 2 describes platform-dependent software release examples.Table 2Platform-Dependent Release te file IPS-4240-K9-sys-1.1-a-6.1-1-E1.imgfor lympIDSM2c6svc-mp.2-1-2.bin.gzBootloaderAs neededblAIM IPSpse aim x.y.z.bin (where x, y, z is therelease number)Mini-kernelAs neededmini-kernel AIM IPSReleaseSystem image1SupportedPlatformExample Filenamepse mini kernel 1.1.10.64.bz21. The system image includes the combined recovery and application image used to reimage an entire sensor.2. The maintenance partition image includes the full image for the IDSM2 maintenance partition. The file is installed from butdoes not affect the IDSM2 application partition.Table 3 describes the platform identifiers used in platform-specific names.Table 3Platform IdentifiersSensor FamilyIdentifierIPS 4240 series4240IPS 4255 series4255IPS 4260 series4260IPS 4270-20 series4270 20IDS module for Catalyst 6KIDSM2IPS network moduleAIMAIP SSMSSM 10SSM 20SSM 40Upgrading to Cisco IPS 6.1(1) E2This section provides information on upgrading to Cisco IPS 6.1(1) E2, and contains the followingtopics: E2 Signature Engine Upgrade Notes and Caveats, page 15 Upgrading to the E2 Signature Engine, page 15 IPS 6.1(1)E2 Upgrade Notes and Caveats, page 16 Upgrading to IPS 6.1(1)E2, page 17Release Notes for Cisco Intrusion Prevention System 6.1(1)E214OL-19696-01
Upgrading to Cisco IPS 6.1(1) E2E2 Signature Engine Upgrade Notes and CaveatsThe following upgrade notes and caveats apply to the E2 signature engine: Do not use IPS-K9-6.1-1-E2.pkg or IPS-AIM-K9-6.1-1-E2.pkg to upgrade an existing 6.1(1)E1sensor to E2. You must use the E2 engine upgrade file IPS-engine-E2-req-6.1-1.pkg. If you use theminor upgrade file rather than the signature engine upgrade file, you receive an incorrect errormessage stating the minor upgrade file is already installed on the system (DDTS CSCsq94450).While this error message is misleading, you still must use the signature engine upgrade file toupgrade a 6.1(1)E1 sensor to E2. Installing the E2 engine update only replaces the sensing software portion of the sensor. IPSinspection is halted and the sensor is placed in bypass mode according to your bypass modeconfiguration. If bypass mode is configured to auto or on, traffic is bypassed without inspection. Ifbypass mode is set to off, traffic is not passed during the update. The sensor configuration settings are maintained, but we strongly advise you to save a copy of thecurrent configuration of your sensor to an FTP server before you install the E2 engine upgrade. Your sensor must show version 6.1(1)E1 for you to upgrade to E2. If you have an earlier version,you can install the minor version upgrade file, IPS-K9-6.1-1-E2.pkg or IPS-AIM-K9-6.1-1-E2.pkg. After you upgrade any IPS software on your sensor, you must restart the IDM to see the latestsoftware features. When you upgrade the AIM IPS, you must disable heartbeat reset on
maximum of 250 bytes in both directions, that is, 250 bytes to service and 250 bytes from service. The service ports option describes the ports for which you do not want to generate alerts. Inspection still occurs, but alerts are suppressed for these ports defined per signature.
