النتائج 1 إلى 4 من 4

الموضوع: تشغيل ال IPS/IDS علــــــــى VMWARE

  1. #1
    تاريخ التسجيل
    Nov 2007
    الدولة: Malaysia
    معدل تقييم المستوى

    تشغيل ال IPS/IDS علــــــــى VMWARE

    السلام عليكم

    هذه الخطوات التي تطبقها لتشغيل ال IPS / IDS
    على ال VMWARE

    1 - هذا هو الينك الخاص بي ال IPS.ISO وهي مهمة ونادرة .

    2 - هذه نسخة حاظرة وجاهزة فقط تحملها على ال في ام وير وطبق الخطوات التالية ؟


    نتوكل على الله ونبدء بل الخطوات :

    Running Cisco IDS/IPS v5 Software in VMWare
    This Howto describes how to get the Cisco IDS/IPS Software Release 5 running
    inside VMWare. After successful installtion, the VM will emulate a IDS-4215
    platform with 3 GigabitEthernet interfaces Wink
    I developed this Howto by using VMWare Workstation for Linux, I didnt tested
    this with any VMWare version for Windows.
    - VMWare Workstation, I use version 5.5, running on a debian etch host system
    I never tested with a Windows host system
    - Cisco IPS recovery CD image, I used IPS-K9-cd-1.1-a-5.1-4.iso
    This file can be downloaded from CCO.
    CCO download access requires a valid support contract.
    - modified VMWare BIOS (CISCO_IDS4215_440.BIOS.ROM)
    This file should be in the archive from where you extracted this Howto
    - some basic UNIX skills for working with a shell and using vi
    - knowledge of the english keyboard layout Wink
    It seems that with IDS/IPS software release 5, Cisco implemented a more strict
    hardware identification checks, making it impossible to load the code on 4.x
    custom-build systems or in VMWare.
    I'm not skilled enough to produce anything useful with the BIOS that can be
    downloaded from CCO Wink, so I investigated in how to get VMWare to provide
    anything the IPS software wants to hear. I still would prefer to have the native
    BIOS running, but this is a start for all the desperate souls that need a
    working IPS for study/LAB preparation.
    I concentrated myself on the 4215 platform, because it seems that it does not
    have any special ROM/PROM chips built in.
    Basically, IPSv5 is based on Redhat Linux, so it is able to run inside VMWare.
    The recovery CD boots and reimages fine, as long as the virtual harddisks are
    large enough (256M for hda, 4GB for hdb).
    hda is the flash in the appliance and holds the complete OS and the
    configuration. hdb is a real harddisk and is for "var" storage (event store
    etc.). The reimage fails when you have disks that are too small (fdisk will
    complain about wrong boundaries/size).
    With a fresh system, you can boot into runlevel 1, mount the remaining
    filesystems and inspect what the system will do at regular startups.
    The procedure collection file /etc/init.d/ids_functions will determine the
    platform type during bootup. Because the 4215 doesnt have a special chip, the
    routine makes selections based on the CPU speed and processor count. You can
    trick the routine by entering the CPU speed reported by linux.
    But this is not enough. At some point, a program called smbios_bios_info is
    called, reading information from the BIOS. Also, the binary mainApp will do this
    again later, so we have to find a way how to tell the systems what it wants to
    hear. Luckily, on the 4215 only DMI strings are checked.
    VMWare allows to extract the required portion of the BIOS, and with a resource
    editor you can modify the DMI strings to match the values the software checks.
    By telling VMWare to load this modified BIOS, the IPS software is satisfied and
    identifies the VM as a 4215 sensor.
    I basically changed all the DMI strings to read as Vendor "Cisco Systems",
    Platform "IDS-4215", Chassis/Asset Tag "12345678901".
    Now that the sensor boots and the CLI is useable, network connectivity must
    work. VMWare and the IPS linux both support Intel e1000 cards, so this looks
    The physical interface configuration layout of all the appliances are defined in
    /usr/cids/idsRoot/etc/interface.conf. By replacing the pci device-id values with
    the one provided by VMWare (see /proc/pci), the sensor recognized the VMWare
    virtual ethernet cards.
    By modifying this file you are able to use interface types a platform normally
    will not support (Gigabit cards in the 4215).
    With this VM I was able to use IDM from a windoze system, create own signatures
    and put a sensing interface between two dynamips instances (aletring each
    time it sees EIGRP packets). This should be proof enough!
    Well, this are nearly all the information I collected during 8-12 hours of
    experimenting in a few sentences. However, there are still some quirks and areas
    I dont understand well, for example, the problems caused by the absence of the
    file /usr/share/zoneinfo/cidsZoneInfo.
    I hope this Howto is a start and encourages people to modify and enhance it.
    Have fun!

    1. VMWare
    Extract the content of the archive to a place you remember; you'll need to
    specify the location of the BIOS file soon.
    Start VMWare and create a new Virtual Machine (VM). The wizard starts; please
    use the following options:
    - "Custom" configuration
    - "Workstation 5" format
    - Guest: "Linux" / Version: "Red Hat Linux"
    - Name: whatever you like, maybe "Cisco:IPS"
    make sure you remember the path listed in "Location"
    - "One" processor
    - 512 MB RAM
    - "use brdged networking"
    - SCSI Adapter: "BusLogic" (doesnt matter)
    - "create a new virtual disk"
    - Disk type "IDE"
    - Size 0.3GB (yes, 300MB not GB)
    - accept, then click "Finish"
    Edit your VM Settings.
    - Remove the sound adapter
    - Remove the USB controller
    - Remove the floppy disk
    - Add two additional Ethernet adapters
    The network connection type doesnt matter at the moment (leave
    it as bridged, for example)
    - Add one additional hard disk
    - "create a new virtual disk"
    - Disk type "IDE"
    - Size 4 GB (yes, 4GB this time, values below 4 GB will not
    - accept, then click "Finish"
    - modify CD-ROM settings
    - "use ISO image"
    point it to the IPS recovery CD iso file
    Now, finish modifications and quit VMWare.
    Go to the folder where your VM resides (for me, it is ~/vmware/<VM_name>), and
    edit the VM configuration file (.vmx).
    Put in the config option that tells VMWare to boot an alternative BIOS:
    bios440.filename =
    Put in the device type for the Ethernet adapters (we want Intel GE cards):
    ethernet0.virtualDev = "e1000"
    ethernet1.virtualDev = "e1000"
    ethernet2.virtualDev = "e1000"
    Now save and close the configuration file.
    2. Recovery Image installation
    Start VMWare and fire up the newly created VM. The recovery CD iso file will
    automatically selected for loaded; you have to enter "k" to start the CD boot
    The recovery CD loads and does a full re-imaging of the VM hard drives. Please
    ignore any errors about failed platform identification and wait until the system
    When rebooting (VMWare BIOS message is presented), STOP the VM and continue to
    read the next step.
    3. First boot
    Before we continue, we have to modify the GRUB boot parameters to get into
    single user mode. When the system boots for the first time after re-imaging, and
    the GRUB menu is displayed, press any key to stop the timer (up/down arrow, for
    example). Without that, the system boots and get stuck at hardware detection.
    Now that you know it is safe to turn on the VM again. Wait until GRUB menu is
    displayed amd select "Cisco IPS".
    Press "e" to enter edit mode.
    Select the second line (the one starting with "kernel"), and press "e" again.
    Scroll to the left until you see the entry "init=loadrc". replace loadrc with 1
    (should read "init=1") - dont touch any other option.
    Press Enter and then "b" to start the boot process. After booting linux, the
    system stop at init level 1.
    4. Modifications
    Press Enter to get a shell. Execute (english keymap!)
    touch /usr/share/zoneinfo/cidsZoneInfo
    Now determine the speed of your CPU:
    cat /proc/cpuinfo
    by looking at the line named "cpu MHz". Write down the value (int only). Make a
    copy of the file ids_functions and modify it:
    cd /etc/init.d
    cp ids_functions ids_functions.orig
    vi ids_functions
    Search for the string "4215" or go directly to the line #252 that reads
    elif [[ 'isCPU 845' -eq $TRUE && ...
    Modify the string "845" to the CPU speed you determined earlier - use only the
    int value (for example, 2659). Of course you can copy the whole line, comment
    the original one and keep it for further reference.
    3 lines below there are variables named "DEFAULT_MGT_OS" and "DEFAULT_MGT_CIDS".
    Modify their values to:
    Save the file and close vi.
    Now, modify the interface cofiguration file:
    cd /usr/cids/idsRoot/etc
    cp interface.conf interface.conf.orig
    vi interface.conf
    Scroll down until you find the section for the IDS-4215 (its the second one).
    Modify the pci-bus numbers in the slot definition subsection:
    # lower slot
    pci-bus=0 # change this to 1
    # upper slot
    pci-bus=0 # change this to 2
    Now, modify the built-in Interfaces by going to [models/IDS-4215/interfaces/1]
    # built-in 10/100 TX mgmt interface, Intel 82559ER
    # was eth1 (int1) in 4.x
    # rightmost connector on front panel
    # labeled "Ethernet 1" on panel
    name-template=FastEthernet0/0 # change this to Management0/0
    pci-device= 14 # change this to 17
    device-id=0x1209 # change this to 0x100f
    type=ge # change this to ge
    Modify the second interface
    # built-in 10/100 TX sensing interface, Intel 82559ER
    # was eth0 (int0) in 4.x
    # leftmost connector labeled "Ethernet 0"
    name-template=FastEthernet0/1 # change this to GigabitEthernet0/1
    pci-device= 13 # change to 18
    device-id=0x1209 # change to 0x100f
    type=fe # change to ge
    CREATE a third interface by copying the whole [models/IDS-4215/interfaces/2]
    [models/IDS-4215/interfaces/2] # rename to /3
    name-template=GigabitEthernet0/1 # rename to GigabitEthernet0/2
    pci-device= 18 # change to 19
    Now increase the interface number by 1 for the remaining (dummy) interfaces
    [models/IDS-4215/interfaces/3] to 6; the ones that have "1 x 4-FE card" in the
    Save the file and quit vi.
    Now move to the IPS bin directory and replace the file smbios_bios_info
    cd /usr/cids/idsRoot/bin/
    mv smbios_bios_info smbios_bios_info.orig
    vi smbios_bios_info
    Enter the following content into this file:
    echo "Platform: IDS-4215"
    exit 0
    Save and quit. Now make the file executeable and test it
    chmod +x smbios_bios_info
    The system should display "Platform: IDS-4215". And thats it for all the system
    Now reboot the VM by entering
    5. second boot
    After making all the modifications, the VM sould start and present you a login
    promt. If it gets stuck (no login), reload it again - this can happen when you
    booted the system completely without going into runlevel 1 in step 4.
    There is still a yellow warning about modifications since last reboot - this
    message disappears after the next reboot.
    Log on with the factory default account (cisco/cisco) and assign a new password.
    Now assign the service account a password:
    conf t
    username service pass <yourpass> privi service
    Log out and login as user "service" - you will have a shell. Do a switch user to
    root "su -", the password is the same as for the user "service".
    Now look if the file "/usr/share/zoneinfo/cidsZoneInfo" is still there. If not,
    "touch /usr/share/zoneinfo/cidsZoneInfo" it. Without that file, you are not able
    to see any config in the CLI (for whatever reasons). Exit until you reach the
    login prompt again.
    Login as "cisco" and you should be able to do a "show conf". Bacup the
    configuration with "copy current-config backup-config" and reload by doing a
    After the next reboot, the system is fully useable.
    - initial setup
    The first thing you shoud to is to get network access to the VM via
    ssh/PDM/telnet. Make sure the VMWare "Ethernet 1" is connected as you need it
    (bridged to the VMWare host NIC for example).
    In the cli, enter
    conf t
    service host
    host-ip x.x.x.x/<maks>,<gateway> # for example, host-ip,
    access-list x.x.x.x/<mask> # for example, access-list
    telnet-option enabled # if you want telnet access
    This allows anybody specified in access-list to access the sensor Management IP
    address, specified by host-ip. IDM access works then out of the box.
    - network access
    After my VM starts, I'm not able to use any network interface unless I
    disable/enable the corresponding VMWare NIC (right click in the network card
    icon in VMWare status line).
    - PDM
    PDM does not show system information under Monitoring. Cometic issue, IMHO.
    - IPS Updates
    I didnt applied version 5 service packs, but I'm certain that with each update
    that brings modifications to the underlying OS, you have to check your
    modifications again.
    I didnt tried software release 6 either; it may force you not only to apply my
    modifications again, but also introduce improved hardware checking, making the

  2. #2
    عضو الصورة الرمزية boguce
    تاريخ التسجيل
    Jan 2008
    معدل تقييم المستوى

    رد: تشغيل ال IPS/IDS علــــــــى VMWARE

    بارك الله فيك يا أخي

  3. #3
    عضو الصورة الرمزية somaaoo
    تاريخ التسجيل
    Jan 2008
    الدولة: Egypt
    معدل تقييم المستوى

    رد: تشغيل ال IPS/IDS علــــــــى VMWARE

    ممكن اقول لك مش فاهم حاجه بس ماتزعلش مني بجد مش فاهم ياريت بس تشرح ips ids
    لان كا معلوماتي انهم security فقطغير كده لااعرف والطريقه الي هاعمل بيها الlab
    وشكرا جدا علي موضوعك الي اكيد جميل بس لو كملته

  4. #4

المواضيع المتشابهه

  1. كيف بدي الـ workstation موجودة على vmware تشتغل أثناء تشغيل جهاز الguest ??
    بواسطة akram801 في المنتدى منتدى الشهادات العام
    مشاركات: 4
    آخر مشاركة: 14-12-2012, 13:24
  2. كيفية تشغيل الASA على الgns3 او vmware ؟؟؟
    بواسطة sadam20 في المنتدى الأرشيف
    مشاركات: 2
    آخر مشاركة: 16-08-2012, 22:24
  3. استفسار عن تشغيل الايزا سيرفر مع برنامج VMware
    بواسطة SR123 في المنتدى منتدى الشهادات العام
    مشاركات: 9
    آخر مشاركة: 03-03-2010, 19:57
  4. مشكلة فى تشغيل vmware
    بواسطة eng_adelm في المنتدى منتدى الشهادات العام
    مشاركات: 2
    آخر مشاركة: 05-12-2009, 17:30
  5. بحاجة نظام تشغيل ويندوس اكس بي لبرنامج vmware
    بواسطة maher3 في المنتدى الأرشيف
    مشاركات: 7
    آخر مشاركة: 25-11-2009, 13:21

الكلمات الدلالية لهذا الموضوع


ضوابط المشاركة

  • لا تستطيع إضافة مواضيع جديدة
  • لا تستطيع الرد على المواضيع
  • لا تستطيع إرفاق ملفات
  • لا تستطيع تعديل مشاركاتك