Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual page 428

Disaster Recovery
You should carefully consider whether you want to create a service account. The service account
Caution
provides shell access to the system, which makes the system vulnerable. However, you can use the
service account to create a new password if the Administrator password is lost. Analyze your situation
to decide if you want a service account existing on the system.
You cannot use the service account for password recovery on AIP-SSM, because you cannot get shell
Note
access to AIP-SSM. You must use ROMMON to get shell access to AIP-SSM.
Disaster Recovery
This section provides recommendations and steps to take if you need to recover your sensor after a
disaster.
Follow these recommendations so that you are ready in case of a disaster:
•
•
When a disaster happens and you need to recover the sensor, try the following:
1.
2.
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
C-2
If you are using the CLI or IDM for configuration, copy the current configuration from the sensor
to an FTP or SCP server any time a change has been made.
For the procedure, see Creating and Using a Backup Configuration File, page
You should note the specific software version for that configuration. You can apply the
Note
copied configuration only to a sensor of the same version.
Note You also need the list of user IDs that have been used on that sensor. The list of user IDs and
passwords are not saved in the configuration. For the procedure for obtaining a list of the
current users on the sensor, see
If you are using IDS MC, the current configuration is saved in the IDS MC database and a separate
copy is not needed.
The list of user IDs is not saved in the IDS MC database. You must make a note of the user
Note
IDs.
You should note the specific software version for that configuration. You can push the copied
Note
configuration only to a sensor of the same version.
Reimage the sensor.
For the procedures for appliances and modules, see
Installing System Images."
Log in to the sensor with the default user ID and password—cisco.
Viewing User Status, page
Chapter 17, "Upgrading, Downgrading, and
Appendix C Troubleshooting
12-17.
4-16.
78-16527-01