Running Cisco IDS/IPS v5 Software in VMWare

This Howto describes how to get the Cisco IDS/IPS Software Release 5 running
inside VMWare. After successful installtion, the VM will emulate a IDS-4215
platform with 3 GigabitEthernet interfaces.

I developed this Howto by using VMWare Workstation for Linux, although it works
with VMWare for Windows, too.

- VMWare Workstation, I use version 5.5, running on a debian etch host system

- Cisco IPS recovery CD image, I used IPS-K9-cd-1.1-a-5.1-4.iso
	This file can be downloaded from CCO.
	CCO download access requires a valid support contract.

- modified VMWare BIOS (CISCO_IDS4215_440.BIOS.ROM)
	This file should be available here.
- some basic UNIX skills for working with a shell and using vi

- knowledge of the english keyboard layout
It seems that with IDS/IPS software release 5, Cisco implemented a more strict
hardware identification checks, making it impossible to load the code on 4.x
custom-build systems or in VMWare.
I'm not skilled enough to produce anything useful with the BIOS that can be
downloaded from CCO, so I investigated in how to get VMWare to provide
anything the IPS software wants to hear. I still would prefer to have the native
BIOS running, but this is a start for all the desperate souls that need a
working IPS for study/LAB preparation.

I concentrated myself on the 4215 platform, because it seems that it does not
have any special ROM/PROM chips built in.

Basically, IPSv5 is based on Redhat Linux, so it is able to run inside VMWare.
The recovery CD boots and reimages fine, as long as the virtual harddisks are
large enough (256M for hda, 4GB for hdb).

hda is the flash in the appliance and holds the complete OS and the
configuration. hdb is a real harddisk and is for "var" storage (event store
etc.). The reimage fails when you have disks that are too small (fdisk will
complain about wrong boundaries/size).
With a fresh system, you can boot into runlevel 1, mount the remaining
filesystems and inspect what the system will do at regular startups.

The procedure collection file /etc/init.d/ids_functions will determine the
platform type during bootup. Because the 4215 doesnt have a special chip, the
routine makes selections based on the CPU speed and processor count. You can
trick the routine by entering the CPU speed reported by linux.

But this is not enough. At some point, a program called smbios_bios_info is
called, reading information from the BIOS. Also, the binary mainApp will do this
again later, so we have to find a way how to tell the systems what it wants to
hear. Luckily, on the 4215 only DMI strings are checked.

VMWare allows to extract the required portion of the BIOS, and with a resource
editor you can modify the DMI strings to match the values the software checks.
By telling VMWare to load this modified BIOS, the IPS software is satisfied and
identifies the VM as a 4215 sensor.

I basically changed all the DMI strings to read as Vendor "Cisco Systems",
Platform "IDS-4215", Chassis/Asset Tag "12345678901".

Now that the sensor boots and the CLI is useable, network connectivity must
work. VMWare and the IPS linux both support Intel e1000 cards, so this looks

The physical interface configuration layout of all the appliances are defined in
/usr/cids/idsRoot/etc/interface.conf. By replacing the pci device-id values with
the one provided by VMWare (see /proc/pci), the sensor recognized the VMWare
virtual ethernet cards.

By modifying this file you are able to use interface types a platform normally
will not support (Gigabit cards in the 4215).

With this VM I was able to use IDM from a windoze system, create own signatures
and put a sensing interface between two dynamips instances (aletring each
time it sees EIGRP packets). This should be proof enough!

Well, this are nearly all the information I collected during 8-12 hours of
experimenting in a few sentences. However, there are still some quirks and areas
I dont understand well, for example, the problems caused by the absence of the
file /usr/share/zoneinfo/cidsZoneInfo.

I hope this Howto is a start and encourages people to modify and enhance it.

Have fun!



1. VMWare

Extract the content of the archive to a place you remember; you'll need to
specify the location of the BIOS file soon.

Start VMWare and create a new Virtual Machine (VM). The wizard starts; please
use the following options:

	- "Custom" configuration
	- "Workstation 5" format
	- Guest: "Linux" / Version: "Red Hat Linux"
	- Name: whatever you like, maybe "Cisco:IPS"
		make sure you remember the path listed in "Location"
	- "One" processor
	- 512 MB RAM
	- "use brdged networking"
	- SCSI Adapter: "BusLogic" (doesnt matter)
	- "create a new virtual disk"
		- Disk type "IDE"
		- Size 0.3GB (yes, 300MB not GB)
	- accept, then click "Finish"

Edit your VM Settings.

	- Remove the sound adapter
	- Remove the USB controller
	- Remove the floppy disk

	- Add two additional Ethernet adapters
		The network connection type doesnt matter at the moment (leave
		it as bridged, for example)

	- Add one additional hard disk
		- "create a new virtual disk"
		- Disk type "IDE"
		- Size 4 GB (yes, 4GB this time, values below 4 GB will not
		- accept, then click "Finish"
	- modify CD-ROM settings
		- "use ISO image"
		point it to the IPS recovery CD iso file
Now, finish modifications and quit VMWare.

Go to the folder where your VM resides (for me, it is ~/vmware/), and
edit the VM configuration file (.vmx).

Put in the config option that tells VMWare to boot an alternative BIOS:

bios440.filename = "/CISCO_IDS4215_440.BIOS.ROM"

Put in the device type for the Ethernet adapters (we want Intel GE cards):

ethernet0.virtualDev = "e1000"
ethernet1.virtualDev = "e1000"
ethernet2.virtualDev = "e1000"

Now save and close the configuration file.

2. Recovery Image installation

Start VMWare and fire up the newly created VM. The recovery CD iso file will
automatically selected for loaded; you have to enter "k" to start the CD boot

The recovery CD loads and does a full re-imaging of the VM hard drives. Please
ignore any errors about failed platform identification and wait until the system

When rebooting (VMWare BIOS message is presented), STOP the VM and continue to
read the next step.

3. First boot

Before we continue, we have to modify the GRUB boot parameters to get into
single user mode. When the system boots for the first time after re-imaging, and
the GRUB menu is displayed, press any key to stop the timer (up/down arrow, for
example). Without that, the system boots and get stuck at hardware detection.

Now that you know it is safe to turn on the VM again. Wait until GRUB menu is
displayed amd select "Cisco IPS".

Press "e" to enter edit mode.

Select the second line (the one starting with "kernel"), and press "e" again.

Scroll to the left until you see the entry "init=loadrc". replace loadrc with 1
(should read "init=1") - dont touch any other option.

Press Enter and then "b" to start the boot process. After booting linux, the
system stop at init level 1.

4. Modifications

Press Enter to get a shell. Execute (english keymap!)

touch /usr/share/zoneinfo/cidsZoneInfo

Now determine the speed of your CPU:

cat /proc/cpuinfo

by looking at the line named "cpu MHz". Write down the value (int only). Make a
copy of the file ids_functions and modify it:

cd /etc/init.d
cp ids_functions ids_functions.orig
vi ids_functions

Search for the string "4215" or go directly to the line #252 that reads

elif [[ 'isCPU 845' -eq $TRUE && ...
Modify the string "845" to the CPU speed you determined earlier - use only the
int value (for example, 2659). Of course you can copy the whole line, comment
the original one and keep it for further reference.

3 lines below there are variables named "DEFAULT_MGT_OS" and "DEFAULT_MGT_CIDS".
Modify their values to:


Save the file and close vi.

Now, modify the interface cofiguration file:

cd /usr/cids/idsRoot/etc
cp interface.conf interface.conf.orig
vi interface.conf

Scroll down until you find the section for the IDS-4215 (its the second one).

Modify the pci-bus numbers in the slot definition subsection:

# lower slot
pci-bus=0   	# change this to 1

# upper slot
pci-bus=0	# change this to 2

Now, modify the built-in Interfaces by going to [models/IDS-4215/interfaces/1]

# built-in 10/100 TX mgmt interface, Intel 82559ER
# was eth1 (int1) in 4.x
# rightmost connector on front panel
# labeled "Ethernet 1" on panel
name-template=FastEthernet0/0   # change this to Management0/0
pci-device= 14			# change this to 17
device-id=0x1209		# change this to 0x100f
type=ge				# change this to ge

Modify the second interface

# built-in 10/100 TX sensing interface, Intel 82559ER
# was eth0 (int0) in 4.x
# leftmost connector labeled "Ethernet 0"
name-template=FastEthernet0/1 	# change this to GigabitEthernet0/1
pci-device= 13			# change to 18
device-id=0x1209		# change to 0x100f
type=fe				# change to ge

CREATE a third interface by copying the whole [models/IDS-4215/interfaces/2]

[models/IDS-4215/interfaces/2] 	# rename to /3
name-template=GigabitEthernet0/1 # rename to GigabitEthernet0/2
pci-device= 18			# change to 19

Now increase the interface number by 1 for the remaining (dummy) interfaces
[models/IDS-4215/interfaces/3] to 6; the ones that have "1 x 4-FE card" in the

Save the file and quit vi.

Now move to the IPS bin directory and replace the file smbios_bios_info

cd /usr/cids/idsRoot/bin/
mv smbios_bios_info smbios_bios_info.orig 
vi smbios_bios_info

Enter the following content into this file:

echo "Platform: IDS-4215"
exit 0

Save and quit. Now make the file executeable and test it

chmod +x smbios_bios_info

The system should display "Platform: IDS-4215". And thats it for all the system

Now reboot the VM by entering


5. second boot

After making all the modifications, the VM sould start and present you a login
promt. If it gets stuck (no login), reload it again - this can happen when you
booted the system completely without going into runlevel 1 in step 4.

There is still a yellow warning about modifications since last reboot - this
message disappears after the next reboot.

Log on with the factory default account (cisco/cisco) and assign a new password.

Now assign the service account a password:

conf t
username service pass  privi service

Log out and login as user "service" - you will have a shell. Do a switch user to
root "su -", the password is the same as for the user "service".
Now look if the file "/usr/share/zoneinfo/cidsZoneInfo" is still there. If not,
"touch /usr/share/zoneinfo/cidsZoneInfo" it. Without that file, you are not able
to see any config in the CLI (for whatever reasons). Exit until you reach the
login prompt again.
Login as "cisco" and you should be able to do a "show conf". Bacup the
configuration with "copy current-config backup-config" and reload by doing a

After the next reboot, the system is fully useable.


- initial setup

The first thing you shoud to is to get network access to the VM via
ssh/PDM/telnet. Make sure the VMWare "Ethernet 1" is connected as you need it
(bridged to the VMWare host NIC for example).

In the cli, enter

conf t
service host
host-ip x.x.x.x/,  # for example, host-ip,
access-list x.x.x.x/        # for example, access-list
telnet-option enabled		  # if you want telnet access

This allows anybody specified in access-list to access the sensor Management IP
address, specified by host-ip. IDM access works then out of the box.

- network access

After my VM starts, I'm not able to use any network interface unless I
disable/enable the corresponding VMWare NIC (right click in the network card
icon in VMWare status line).

(update) IPS inline configuration doesnt work relieable on Linux, because of
how VMWare integrates/intercepts packets from the Linux kernel. Running the IPS
VM in Windows, bridged to some real NICs, provides correct results for inline

PDM does not show system information under Monitoring. Cosmetic issue, IMHO.

- IPS Updates

I didnt applied version 5 service packs, but I'm certain that with each update
that brings modifications to the underlying OS, you have to check your
modifications again.
I didnt tried software release 6 either; it may force you not only to apply my
modifications again, but also introduce improved hardware checking, making the
modifications mentioned above incomplete/useless.

(update) IPS release 6 introduces new drivers for the Intel NICs, they are not
compatible with the VMWare emulated network cards.

v1.01 by einval - 11-Jan-2009