Cisco Cisco IPS 4255 Sensor
6
Release Notes for Cisco Intrusion Prevention System 6.1(1)E2
OL-19696-01
MySDN Decommissioned
•
The S339 signature update is a built in to the E2 engine update. You cannot download S399
separately.
separately.
•
The E2 engine update contains the following new and changed engines:
–
P2P engine—The existing Peer-to-Peer signatures have been organized in to a dedicated,
optimized engine that lets the sensor monitor all 65, 536 ports in both the TPC and UDP
protocols for peer-to-peer traffic. The P2P engine is enabled by default and because of the
implementation style of this engine, you cannot create custom P2P signatures.
optimized engine that lets the sensor monitor all 65, 536 ports in both the TPC and UDP
protocols for peer-to-peer traffic. The P2P engine is enabled by default and because of the
implementation style of this engine, you cannot create custom P2P signatures.
–
Fixed Depth All Ports Inspection engine—A series of new engines similar to the String TCP
engine has been developed to provide a more optimized approach to monitoring all ports. The
fixed inspection engines—Fixed TPC, Fixed UDP, and Fixed ICMP—provide monitoring for all
ports (TCP and UDP) by default. They inspect traffic in a stream mode per AaBb tuple to a
maximum of 250 bytes in both directions, that is, 250 bytes to service and 250 bytes from
service. The service ports option describes the ports for which you do not want to generate
alerts. Inspection still occurs, but alerts are suppressed for these ports defined per signature.
engine has been developed to provide a more optimized approach to monitoring all ports. The
fixed inspection engines—Fixed TPC, Fixed UDP, and Fixed ICMP—provide monitoring for all
ports (TCP and UDP) by default. They inspect traffic in a stream mode per AaBb tuple to a
maximum of 250 bytes in both directions, that is, 250 bytes to service and 250 bytes from
service. The service ports option describes the ports for which you do not want to generate
alerts. Inspection still occurs, but alerts are suppressed for these ports defined per signature.
–
Service Generic engine—This engine has been enhanced to support TCP stream processing,
which lets the Cisco signature team provide increased, higher fidelity support for protocol
analysis signatures when a dedicated engine does not already exist.
which lets the Cisco signature team provide increased, higher fidelity support for protocol
analysis signatures when a dedicated engine does not already exist.
–
Meta engine—The Meta engine now uses an OR operator and nesting, which allows complex
AND/OR combination to be used in the Meta signature logic.
AND/OR combination to be used in the Meta signature logic.
MySDN Decommissioned
Because MySDN has been decommissioned, the URL in older versions of IDM and IME is no longer
functional. If you are using IPS 6.0 or later, we recommend that you upgrade your version of IDM and
IME.
functional. If you are using IPS 6.0 or later, we recommend that you upgrade your version of IDM and
IME.
You can upgrade to the following versions to get the functioning MySDN URL:
•
IDM 7.0.3
•
IME 7.0.3
•
IPS 7.0(4), which contains IDM 7.0.4
If you are using version IPS 5.x, you must look up signature information manually at this URL:
For More Information
For detailed information on MySDN, for IDM refer to
, and for IME refer to
.
Before Upgrading to Cisco IPS 6.1(1)E2
This section describes the actions you should take before upgrading to Cisco IPS 6.1(1) E2. It contains
the following topics:
the following topics:
•
•
•