21-15
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter2 1 Upgrading, Downgrading, and Installing System Images
Installing System Images
•
Installing the System Image for the IPS 4345 and IPS 4360, page 21-16
•
Installing the System Image for the IPS 4510 and IPS 4520, page 21-19
•
Installing the System Image for the ASA 5500-X IPS SSP, page 21-22
•
Installing the System Image for the ASA 5585-X IPS SSP, page 21-23
ROMMON
Some Cisco sensors include a preboot CLI called ROMMON, which lets you boot images on sensors
where the image on the primary device is missing, corrupt, or otherwis e unable to boot the normal
application. ROMMON is particularly useful for recovering remote sensors as long as the serial console
port is available.
Access to ROMMON is available only through the serial console port, a Cisco-standard asy nchronous
RS-232C DTE available in an RJ-45F connector on the sensor chassis. The serial port is configured for
9600 baud, 8 data bits, 1 stop bit, no parity, and no flow control.
For More Information
For the procedure for using a terminal server, see Connecting an Appliance to a Terminal Server,
page 21-15.
TFTP Servers
ROMMON uses TFTP to download an image and launch it. TFTP does not address network issues such
as latency or error recovery. It does implement a limited packet integrity check so that packets arriving
in sequence with the correct integrity value have an extremely low probability of error. But TFTP does
not offer pipelining so the total transfer time is equal to the number of packets to be transferred times
the network average RTT. Because of this limitation, we recommend that the TFTP server be located on
the same LAN segment as the sensor. Any network with an RTT less than a 100 milliseconds should
provide reliable delivery of the image. Be aware that some TFTP servers limit the maximum file size that
can be transferred to ~32 MB.
Connecting an Appliance to a Terminal Server
A terminal server is a router with multiple, low speed, asynchronous ports that are connected to other
serial devices. You can use terminal servers to remotely manage network equipment, including
appliances. To set up a Cisco terminal server with RJ-45 or hydra cable assembly connections, follow
these steps:
Step 1
Connect to a terminal server using one of the following methods:
•
For terminal servers with RJ-45 connections, connect a rollover cable from the console port on the
appliance to a port on the terminal server.
•
For hydra cable assemblies, connect a straight-through patch c able from the console port on the
appliance to a port on the terminal server.