Cisco Cyber Vision Upgrade Guide, Release 5.1.x

 

Prepare for Upgrade: Health Check  3

Upgrade process considerations  3

Upgrade path  3

Cisco Cyber Vision partition size  3

Sentryo hardware and Cisco IC3000 sensors  3

Upgrade process time  4

Update software  4

Update sensors from their connected centers  5

Update the Cyber Vision knowledge database  5

 

 

Prepare for Upgrade: Health Check

Perform a health check of the global center, and of all the centers connected to the global center. For each center, open an SSH connection to the center and use the command:

 systemctl --failed

If any failures are listed, fix the failures before you initiate the upgrade processes. The list of failures must be 0 at this step for a successful upgrade.

 

Upgrade process considerations

If you are upgrading to Cisco Cyber Vision release 5.1.x from an earlier release, see the Cisco Cyber Vision Upgrade Guide, Release 5.1.x.

Upgrade path

Table 1.        Upgrade paths to Cisco Cyber Vision Center release 5.1.x

 

Cisco Cyber Vision partition size

Cisco Cyber Vision Center system has two partitions, one for the system and one for data. The system partition size must be at least 1 GB for the upgrade process to complete successfully—a lower partition size results in upgrade failure.

If your Cisco Cyber Vision center runs 3.1.0 or earlier versions, the system partition may be 512MB which is insufficient to upgrade to Cisco Cyber Vision center release 4.4.0 and later. Contact the Cisco TAC team to get support with updating the system partition to 1 GB.

To check the system partition size of your Cisco Cyber Vision center, access the center CLI and use the command:

lsblk

Sentryo hardware and Cisco IC3000 sensors

If you are upgrading to Cisco Cyber Vision release 4.4.0 or later releases:

1.     Sentryo hardware are not supported. Remove any connected Sentryo hardware before you start the upgrade process.

2.     Cisco IC3000 sensors must run Cyber Vision center release 4.3.0 or later releases. If the Cisco IC3000 sensors connected to your Cisco Cyber Vision center run an earlier Cyber Vision release, upgrade them to 4.3.0 or later releases before you initiate the upgrade process.

Upgrade process time

The upgrade process includes database updates, and the overall update time depends on the system performance and the amount of data stored. Do not restart or shut down the system, wait for the upgrade process to complete.

 

Update software

Go to  Cisco Software Central, and in the Download and Upgrade section, click Access Downloads. Use the search button to find Cyber Vision, choose Cyber Vision Updates, and select release 5.1.x.

From the list of software displayed, download the following:

1.     Cisco Cyber Vision Center DAT file

Go to  Cisco Software Central, and in the Download and Upgrade section, click Access Downloads. Use the search button to find Cyber Vision, choose Cyber Vision Center, and select release 5.1.x.

From the list of software displayed, download the following:

1.     Cisco Cyber Vision Sensor Management Extension

2.     Cisco Cyber Vision Reports Management Extension

Install the downloaded software on your global center, connected centers, or the single center in your deployment.

If you have a global center and connected centers, begin with updating your global center. Then, update the connected centers.

 

Update sensors from their connected centers

Sensor updates are carried out from the centers to which a sensor is connected, not the global center. From Cisco Cyber Vision Release 4.4.1, all sensors can be updated using the self-update method. You don’t need an extension to update sensors.

Procedure:

1.     From the classic UI main menu, choose Admin > Sensors > Sensor Explorer.

2.     Choose the sensors you want to update by clicking the check boxes next to them. To select all the sensors, click the check box at the top of the list of sensors.

3.     From the More Actions drop-down list, choose Update Sensors.

4.     The center adds a new job to the sensor queue, which the sensor automatically collects.

5.     The sensor automatically restarts with the new version, and the update status on the Sensor Explorer page is updated to Complete.

 

For the complete sensor installation procedures, see:

Cisco Cyber Vision Sensor Application for Cisco Switches Installation Guide, Release 4.4.0

Cisco Cyber Vision Network Sensor Installation Guide for Cisco IR8340, Release 5.1.x

Cisco Cyber Vision Network Sensor Installation Guide for Cisco IC3000, Release 5.1.x

Cisco Cyber Vision Network Sensor Installation Guide for Cisco IR1101 and IR1800, Release 5.1.x

 

Update the Cyber Vision knowledge database

The database is updated every week.

Once the center is deployed, update the Cyber Vision knowledge database. The centers use the database content to calculate vulnerabilities, communicate SNORT rules to IDS sensors, and display tags in the user interface. Keeping the database up to date helps fix some defects, and add update rules and properties to enrich the presented data.

Global center automatically sends the updated database to connected sensors. If you have a single center, you must update the database on it.

Go to  Cisco Software Central, and in the Download and Upgrade section, click Access Downloads. Use the search button to find Cyber Vision, choose Cyber Vision Updates, and choose the latest knowledge database.

To update the knowledge database for a center, log in to the center and carry out the following steps:

1.     From the classic UI main menu, go to Admin > System.

2.     In the Knowledge DB area, click Import a Knowledge DB.

3.     Upload the center software file that you downloaded from Cisco Software Central.