App partition recovery on IDSM2, 4.1

[csthomas]

I have a question about the procedure for application partition recovery for the IDSM2 under 4.1.

The document Cisco IDS Appl & Module Inst & Conf quide 4.1 (78-15597-01) on page 9-80 & 9-81 lists procedures for CatOS and native IOS. In Step 6 under IOS, it shows UPGRADE FTP ... -install

Is the "-install" correct, or it is a typo in the doc? There's no -install flag in the CatOS example, and it's not clear why a sensor command should depend on the OS running in the 6500. The 4.1 Cmd Ref doesn't seem to document a -install switch, and the syntax in the Config Guide doesn't seem to be UNIX syntax (switch after operand).

Thanks,

/Chris Thomas, UCLA

[marcabal · Accepted solution]

The "--install" (NOTE: Their should be 2 dashes) is an option to the upgrade command ONLY in the Maintenance Partition upgrade command fo the IDSM2 used when re-imaging the Application Partition.

The "--install" should have been in the documentation for both Cat OS and Native IOS.

The "--install" was manditory for early versions of the MP to work properly, but I am not sure if the most recent version still requires it for proper operation.

I recommend to continue using it just in case.

It is not mentioned in the 4.1 reference because it is an MP command which is not documented in the 4.1 reference which apply to the AP commands.

As for Unix syntax, it is a CLI and they chose a different syntax.

[csthomas]

If it's --install then that IS UNIX syntax. Looks like the typesetter merged them into one dash.

[marcabal]

Yup looks like they were merged in the docs. We'll try to get it fixed in the next revision of the docs.

[csthomas]

Upgrade ? on the 1.3.2 maint image shows:

upgrade [ftp-url] [device:partition-num] - upgrade application on the specified device-partition

upgrade [ftp-url] --install - factory installation

upgrade [ftp-url] - default installation

But it doesn't clarify what the difference between factory and default installation is (ie, --install).

[marcabal]

The MP is a similar image for different service modules (the IDSM2,the NAM2, the FWSM, etc..)

Each module development team has tweaked the base code to work specific their module.

For some of the other modules they have a difference between factory installs and default installations.

Like the erasing of some pieces of configuration with the factory method that the default method leaves in place.

The IDSM2, however, does not have any difference between the 2. The factory should operate the exact same as the default.

The IDSM2 does not save any configuration on re-images. So just to be consistent with those modules that do we go ahead and tell users to use the "--install" option.

We have concentrated our testing on ensuring that the "--install" option to do factory installs works correctly, and that is what I would encourage you to use as well.

The default should work and run the exact same code as the factory install, but we just don't use it on a regular basis.

SIDE NOTE: You should only be running the upgrade command on the MP when you want to re-image the AP back to default settings. If you are just upgrading the AP from 4.0 to 4.1 then upgrade the MP to 1.3.2, and then while still in the AP upgrade the AP through it's own upgrade command using the 4.1 upgrade file (the -min- file, instead of the -a- file).