Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 704
  • Last Modified:

Enabling IPS on Cisco ASA5515x

I have a Cisco ASA5515x firewall and I need to enable and configure IPS module on it.
On the 5515x it's a software module and I have software loaded on Disk 0.
One of the commands I need to run is: sw-module module ips recover boot

When I run it, I get a warning that image on the disk will be erased and replaced with factory settings.
Does it mean entire ASA device is going to be wiped? I can't have that and I can't imagine this is the case.
But I need to know the correct process of enabling and configuring IPS.

Any help is appreciated.
Thanks.
0
Lev Kaytsner
Asked:
Lev Kaytsner
  • 2
1 Solution
 
btanExec ConsultantCommented:
You are referring to the below - disk0 is  ASA internal flash.
http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/modules_ips.html#wp1262325

You can recover the application partition image on your sensor if it becomes unusable. Using the recover command lets you retain your host settings while other settings revert to the factory defaults.
http://www.cisco.com/c/en/us/td/docs/security/ips/7-1/configuration/guide/cli/cliguide71/cli_system_images.html#wp1369494

You can recover the application partition image for the sensor if it becomes unusable. Some network configuration information is retained when you use this method, which lets you have network access after the recovery is performed. Use the recover application-partition command to boot to the recovery partition, which automatically recovers the application partition on your sensor. If you have upgraded your recovery partition to the most recent version before you recover the application partition image, you can install the most up-to-date software image.

Also use the upgrade command to upgrade the recovery partition with the most recent version so that it is ready if you need to recover the application partition on your sensor. Recovery partition images are generated for major and minor updates and only in rare situations for service packs or signature updates.

Note: - You cannot use the downgrade command to revert to a previous major or minor version, for example, from Cisco IPS 7.1 to 7.0. You can only use the downgrade command to downgrade from the latest signature update or signature engine update. To revert to 7.0, you must reimage the sensor.

Kindly refer to also IPS Reimage Process for Modules in an ASA Failover Pair Configuration Example - always good to back up the current running configuration prior to activities
http://www.cisco.com/c/en/us/support/docs/security/intrusion-prevention-system/116155-configure-product-00.html#anc5
0
 
Lev KaytsnerAuthor Commented:
Thanks for your comment. Got it all set up now.
0
 
btanExec ConsultantCommented:
Thanks for sharing, if poss can also share the significant steps or notes :)
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now