IDSM version on IDS 4235

guy.tetru · ‎05-06-2010

Hello to all

I did not deal with IDS in the past, nut I do now

The model in discussion is 4235.

I need to reset one to factory default or at least reset the password which probably means re-imaging.

Done some reading about the issue and cannot seem to determine the correct,

The detail I need to retrieve is how to find out the IDSM version ?

Please remember that the system boots into a user/pass right after GRUB.

Thank you for your help,

Guy

rhermes · ‎05-06-2010

Guy -

The 4235 ended signature support (no new signaturte updates) in May 06, and just ended hardware support (no fixing you box if it breaks) May 2010.

The 4235 had a CDROM drive that you could use to image the sensor by downloading and .iso from CCO. It also has the tradditional TFTP method of reimaging available too. Since this sensor has been out of support for a while you will mostly likely only be able to run version 5.x software on it.

- Bob

guy.tetru · ‎05-06-2010

Hi Bob,

thank you for your reply.

at this point, the system boots up to a user/pass, I dont have the CDRom drive,

is there a way for me to run a pass recovery utility, or anything at all to do with the system ? ( I’m being a little extreme)

I could run a sniffer and obtain the IP address , but I'm pretty sure that it will be a dead end as well...

thank you for your time,

Guy

rhermes · ‎05-06-2010

Guy -

No CDROM drive? Man, it sounds like you got a hurting, old sensor there. Check your junk server pile for any old PATA CDROM drive. Open you sensor and connect the power and data cables. You don;t need to permenantly install the drive, you'll only need it to image your sensor. Find an 4.x or 5.x 4200 system image for the 4235 sensors and boot the sensor with the CD in the drive.

It looks likeyou don;t have a ROMMON TFTP option:

http://www.cisco.com/en/US/partner/docs/security/ips/5.0/configuration/guide/cli/cliimage.html#wp1044331

- Bob

guy.tetru · ‎05-07-2010

thank you

I have A CD drive now, will attempt to proceed and let know ones I have new (hopefully successful) info