C-6
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixC Troubleshooting
Disaster Recovery
Note
For IPS 5.0 and later, you can no longer remove the cisco account. You can disable it using the no
password cisco command, but you cannot remove it. To use the no password cisco command, there
must be another administrator account on the sensor. Removing the cisco account through the service
account is not supported. If you remove the cisco account through the service account, the sensor m ost
likely will not boot up, so to recover the sensor you must reinstall the sensor system image.
To create the service account, follow these steps:
Step 1
Log in to the CLI using an account with administrator privileges.
Step 2
Enter configuration mode.
sensor# configure terminal
Step 3
Specify the parameters for the service account. The username follows the pattern
^[A-Za-z0-9()+:,_/-]+$, which means the username must start with a letter or number, and can include
any letter A to Z (capital or small), any number 0 to 9, - and _, and can contain 1 to 64 characters.
sensor(config)# user
username
privilege service
Step 4
Specify a password when prompted. A valid password is 8 to 32 characters long. All characters except
space are allowed. If a service account already exists for this sensor, the following error is displayed and
no service account is created.
Error: Only one service account may exist
Step 5
Exit configuration mode.
sensor(config)# exit
sensor#
When you use the service account to log in to the CLI, you receive this warning.
************************ WARNING *******************************************************
UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS PROHIBITED. This account is intended to be
used for support and troubleshooting purposes only. Unauthorized modifications are not
supported and will require this device to be reimaged to guarantee proper operation.
****************************************************************************************
Disaster Recovery
Follow these recommendations so that you are ready in case of a disaster:
•
If you are using the CLI, IDM, or IME for con figuration, copy the current configuration from the
sensor to an FTP or SCP server any time a change has been made.
•
You should note the specific software version for that configuration. You can apply the copied
configuration only to a sensor of the same version.
•
You also need the list of user IDs that have been used on that sensor. The list of user IDs and
passwords are not saved in the configuration.
When a disaster happens and you need to recover the sensor, try the following:
1.
Reimage the sensor.