17-2
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter17 Administrative Tasks for the Sensor
Administrative Notes and Caveats
Administrative Notes and Caveats
The following notes and caveats apply to administrative tasks for the sensor:
•
Administrators may need to disable the password recovery feature for security reasons.
•
If you try to recover the password on a sensor on which password rec overy is disabled, the process
proceeds with no errors or warnings; however, the password is not reset. If you cannot log in to the
sensor because you have forgotten the password, and password recovery is set to disabled, y ou must
reimage your sensor.
•
We do not recommend that you use clear database command unless under the direction of TAC or
in some testing conditions when you need to clear accumulate d state information and start with a
clean database.
•
The ASA 5500-X IPS SSP an d the ASA 5585-X IPS SSP do not support bypass mode. The adaptive
security appliance will either fail open, fail close, or fail over depending on the configuration of the
adaptive security appliance and the type of activity being done on the IPS.
•
When the sensor is first starting, it is normal for certain health metric statuses to be red until the
sensor is fully up and running.
•
You do not need to set the system clock if your sensor is synchronized by a valid outside timing
mechanism such as an NTP clock source.
•
The show inventory command does not apply to the ASA 5500-X IPS SSP and
ASA 5585-X IPS SSP.
Recovering the Password
This section describes how to recover the password for the various IPS platforms. It contains the
following topics:
•
Understanding Password Recovery, page 17-2
•
Recovering the Password for the Appliance, page 17-3
•
Recovering the Password for the ASA 5500-X IPS SSP, page17-4
•
Recovering the Password for the ASA 5585-X IPS SSP, page17-6
•
Disabling Password Recovery, page 17-8
•
Verifying the State of Password Recovery, page17-9
•
Troubleshooting Password Recovery, page 17-9

Understanding Password Recovery

Note
Administrators may need to disable the password recovery feature for security reasons.
Password recovery implementations vary according to IPS platform requirem ents. Password recovery is
implemented only for the cisco administrative account and is enabled by default. The IPS administrator
can then recover user passwords for other accounts using the CLI. The cisco user password reverts to
cisco and must be changed after the next login.