MARS 6.x Documentation Available

Unanswered Question
Sep 16th, 2008
I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (3 ratings)
Farrukh Haroon Tue, 09/16/2008 - 11:04

Some interesting enhancements:

1) Support for Internet Explorer 7.x-The MARS web interface is verified to run correctly on Microsoft® Internet Explorer 7.x.

I hope we no longer have to close two windows after hitting the 'Activate' button.

2) Rule Enhancements-Rules can now be deleted, and the audit log of which user deleted the rule is maintained by MARS. Rule now support up to 20 keywords. .....

3) Performance Enhancement for Inline Queries, Batch Queries and Reports

4) Device Support Framework-This feature enables the definition, export, and import of packages that describe a new device type. Specifically, it defines the device type, event parsing rules, inspection rules, and reports. You can export and reuse these packages across multiple Local Controllers and Global Controllers.

5) New Cisco Device Support-Support for the following new device types or versions is included:

-IOS 12.4(6)T - Zone-based Firewall

-Cisco IPS 6.x virtual sensor support

-ASA/PIX 7.2.3 and 7.2.4

-ASA/PIX 8.0.3

-ASA 8.1/6580 with NetFlow 9 support

-Cisco Secure Access Control Server 4.1.3

-FWSM 3.1.8

-CSC-SSM 6.1 and 6.2

-Cisco Clean Air 4.1.3

-Cisco WLAN 5.0

-Cisco Security Agent 6.0

•New 3rd-Party Device Support-Support for the following new device types or versions is included:

-Juniper Netscreen FW 5.4 and 6.0

-McAfee Foundstone 5.0 and 6.0

-McAfee ePolicy Orchestrator 3.6.x and 4.0 (McAfee AntiVirus 8.x supported through ePO)

-McAfee Intrushield 4.1

Enjoy :)



jeff_groesbeck Tue, 09/16/2008 - 11:36

Hello and thank you for the post. This is good information. For reference, I believe you meant Cisco Clean 'Access' 4.1.3 and not Clean 'Air'... Just so that nobody else wastes time trying to figure out what Cisco just purchased that I didn't know about... :)



Farrukh Haroon Tue, 09/16/2008 - 11:42

I just did a copy paste from the release notes mate :). It seems Cisco was in a hurry for the release. Even the ASA model is 6580 instead of 5580. Anyway no major issues there.



srdroppers Wed, 09/17/2008 - 11:35

Just checked the software download links - is available for download.


srdroppers Wed, 09/17/2008 - 11:37

The .pkg file is listed as 1.2 G bytes, csmars- was 121,881 KB.

jeff_groesbeck Wed, 09/17/2008 - 11:37

Agreed. Thank you for the post!


Edited to add: I am downloading the .iso right now. I haven't tried the upgrade yet.

js88888888 Thu, 09/18/2008 - 08:36

Downloading now.

Anyone upgrading from 4.3.x to 6.0? I will attempt this ASAP time permitting.

scottyd Thu, 09/18/2008 - 12:34

I Plan to do this next month.

Please share your experience.



Farrukh Haroon Thu, 09/18/2008 - 13:36

I'll be doing one for sure, but not until 2-3 weeks when I hear some nice success stories :)



js88888888 Thu, 09/18/2008 - 13:43

Mine is re-imaging now. Since ours was not yet in full production, I'm only importing config data.

On the Oracle DB creation phase now.

js88888888 Mon, 09/22/2008 - 10:51

So far so good. I only imported config data from 4.3.6 and abandoned the event data.

As far as the directions go, very easy with no work-arounds required.

srdroppers Tue, 09/23/2008 - 06:14

Download and upgrade from 5.3.6 was easy and pain free. (Note - your experience may very, my upgrade was for a small 110R system that has only had 5.3 loaded, and "only" 72 devices being monitored.)

hoffa2000 Mon, 09/29/2008 - 10:16

No real success for me I'm afraid. I did a complete export from my 4.3.6 MARS 50 as per the migration guide. Reimage to 6.0.1 went without any problems but the configurations import never completes.

I've done this twice now and never get further than the message

"Importing data into database ...

Updating data package, may take half hour or longer..."

If I reconnect and do a pnimp status I'm told no import is running.

I never see the messages

"Configuration data binary import done.

Configrestore succeeded!

!!! Updating system settings ..." as stated by the guide and I never get an automatic reboot.

What could be going on here?



hoffa2000 Mon, 09/29/2008 - 21:34

Strangest thing is after I manually rebooted the MARS.

Version command says 4.3.6 and the web gui says 4.3 but as far as I can see all the 6.x features are present.

smburke Mon, 09/29/2008 - 17:16

Upgrade on our 110R was successful, and so far, so good performance/functionality-wise. We've been solid for the last week, averaging 43 million plus events per day.

In the release notes it's mentioned that restricted models automatically upgrade to non-restricted as part of the 6.0.1 update? Is this actually true? It's a $60k list upgrade to take our 110R to a full 110. While I sure won't complain if that's the case, it seems rather generous of Cisco to do so at no cost.


This Discussion