Signature for NM/CIDS on Cisco 3840

[lei.silva]

I'm running

Network Module IDS ona 3845 router.  The build is 6.0(5)E3.  Up until last week, Cisco has been putting out signatures for the E3.  The last one I've seen is the IPS-sig-S479-req-E3.pkg.  I've noticed that over the last week they issued IPS-sig-S481-req-E4.pkg and IPS-sig-S481-req-E4.pkg.

Has Cisco ceased updating/supporting E3?  If so, what are my options if I am forced to keep the same hardware?  As I understand it, the highest build that a 3845 NM module will support is 6.0(5)E3.  If this is incorrect, please let me know.

Thanks in advance.

Lei Silva

(210) 221-9085

lei.silva@us.army.mil

[Jennifer Halim]

You are absolutely right. There will be no more signature update on E3 engine (the latest is sig# 479).

You would need to upgrade it to the latest 7.0.2(E4).

Do you have NME-IPS-K9 module? if that's the module you have, then upgrade it using this upgrade file:                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              IPS-NME-K9-7.0-2-E4.pkg

[lei.silva]

I Do not have and NME-IPS-K9 module. I have an NM/CIDS.  Here's information taken from the IDM

TAC Contact Information
URL:http://www.cisco.com/public/support/tac/home.shtml/
Phone:1 (800) 553-2447

Sensor up-time is 47 days.
Platform: NM-CIDS
Booted Partition: application

Partition: application
  Build Version: 6.0(5)E3
  Host:
    Realm Keys      key1.0
  Signature Definition:
    Signature Update      S479.0    2010-03-19
    Virus Update      V1.4    2007-03-02
  Os Version: 2.4.30-IDS-smp-bigphys
  Applications
    MainApp
      N-2008_JUN_06_02_35  2008-06-06T03:23:18-0500  Release
      Execution State: running
    AnalysisEngine
      NE-2008_OCT_16_22_05  2008-10-16T22:30:37-0500  Release
      Execution State: running
  Installed Upgrades
    Upgrade name: IPS-sig-S478-req-E3
    Time Installed: March 22, 2010 1:12:38 PM
    Upgrade name: IPS-sig-S479-req-E3.pkg
    Time Installed: March 26, 2010 9:00:57 AM
  Next Downgrade:
Partition: recovery
  Build Version: 1.1 - 6.0(5)E3

PEP Udi Chassis
  description NM-CIDS
  pid NM-CIDS
  vid (unknown)
  sn FOC11014468

Memory usage
  usedBytes=405614592
  freeBytes=103677952
  totalBytes=509292544

Disk usage
  system is using 17.7M out of 29.0M bytes of available disk space (61% usage)
  application-data is using 34.1M out of 174.7M bytes of available disk space (21% usage)
  boot is using 39.1M out of 75.9M bytes of available disk space (54% usage)
  application-log is using 532.0M out of 2.8G bytes of available disk space (20% usage)

Lei Silva

(210) 221-9085

lei.silva@us.army.mil

[Jennifer Halim]

For NM-CIDS, you can upgrade it to 6.0.6(E4). That's the latest you can upgrade it to. The upgrade filename is                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              IPS-K9-6.0-6-E4.pkg.

Please also be advised that NM-CIDS is EOL, so you can't upgrade it to version 7.0. Version 6.0.x would be the last release for NM-CIDS.

Here is the EOL notification:

http://www.cisco.com/en/US/partner/prod/collateral/modules/ps2797/end_of_life_notice_eol_for_cisco_intrusion_detection_system.html

Hope that answers your questions.